From a86bd1a7f487297958ac9ec3e38285ec014f96bf Mon Sep 17 00:00:00 2001
From: Leander Scherer <leander@schererleander.de>
Date: Thu, 2 Jul 2026 13:40:14 +0200
Subject: feat(adam): setup secure boot with lanzaboote

---
 modules/hosts/adam/configuration.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

(limited to 'modules/hosts/adam/configuration.nix')

diff --git a/modules/hosts/adam/configuration.nix b/modules/hosts/adam/configuration.nix
index 8e134f2..85a352f 100644
--- a/modules/hosts/adam/configuration.nix
+++ b/modules/hosts/adam/configuration.nix
@@ -11,9 +11,13 @@
         kernelModules = [ "amdgpu" ];
         loader = {
           timeout = 0;
-          systemd-boot.enable = true;
+          systemd-boot.enable = pkgs.lib.mkForce false;
           efi.canTouchEfiVariables = true;
         };
+        lanzaboote = {
+          enable = true;
+          pkiBundle = "/var/lib/sbctl";
+        };
       };
 
       # Disable waiting for network to be online
@@ -38,6 +42,10 @@
         ];
       };
 
+      environment.systemPackages = [
+        pkgs.sbctl
+      ];
+
       nix.settings.experimental-features = [
         "nix-command"
         "flakes"
-- 
cgit v1.3.1