fix: do not allow edits to the bootloader

Reviewed-on: #90

hosts/krypton/configuration.nix

@@ -32,6 +32,13 @@
   # host-specific niri config (input devices, laptop binds)
   home-manager.users.aaron.imports = [ ./niri.nix ];
 
+  # hidpi panel (2880x1920): the sddm greeter runs in weston, which doesn't scale
+  services.displayManager.sddm.settings.General.GreeterEnvironment = "QT_SCALE_FACTOR=2";
+
+  # bigger boot menu font, mode found with "r" in the menu; mode 6 is beyond
+  # what boot.loader.systemd-boot.consoleMode accepts, so set via lanzaboote
+  boot.lanzaboote.settings.console-mode = "6";
+
   networking.hostName = "krypton";
   system.stateVersion = "26.05"; # don't change
 }

modules/nixos/bootloader.nix

@@ -4,6 +4,8 @@
   # set bootloader to systemd
   boot.loader = {
     systemd-boot.enable = true;
+    # no kernel command line editing at the boot menu (e.g. init=/bin/sh)
+    systemd-boot.editor = false;
     efi.canTouchEfiVariables = true;
   };