# Secure Boot with lanzaboote. systemd-boot stays the bootloader, but lanzaboote
# installs it signed and writes signed boot entries instead of the nixos module.
# The keys are created once per host with `sudo sbctl create-keys` before the
# first rebuild, and enrolled into the firmware with `sbctl enroll-keys`.

{
  inputs,
  lib,
  pkgs,
  ...
}:

{
  imports = [ inputs.lanzaboote.nixosModules.lanzaboote ];

  boot.loader.systemd-boot.enable = lib.mkForce false;

  boot.lanzaboote = {
    enable = true;
    pkiBundle = "/var/lib/sbctl";
  };

  # key management and verification
  environment.systemPackages = [ pkgs.sbctl ];
}