feat(boot): configure systemd-boot and GRUB based on options

modules/nixos/boot/loader.nix

@@ -1,8 +1,29 @@
 {
-  flake.modules.nixos.boot = {
+  flake.modules.nixos.boot =
-    boot.loader = {
+    { config, lib, ... }:
-      timeout = 1;
+    let
-      efi.canTouchEfiVariables = true;
+      cfg = config.tnix.boot;
+    in
+    {
+      options.tnix.boot.legacy = {
+        enable = lib.mkEnableOption "legacy boot (GRUB) instead of systemd-boot";
+      };
+
+      config = lib.mkMerge [
+        {
+          boot.loader = {
+            timeout = 1;
+            efi.canTouchEfiVariables = true;
+          };
+        }
+
+        (lib.mkIf (!cfg.legacy.enable && !cfg.secure-boot.enable) {
+          boot.loader.systemd-boot.enable = true;
+        })
+
+        (lib.mkIf cfg.legacy.enable {
+          boot.loader.grub.enable = true;
+        })
+      ];
     };
-  };
 }

modules/nixos/boot/secure-boot.nix

@@ -18,11 +18,16 @@
       };
 
       config = lib.mkIf cfg.secure-boot.enable {
-        environment.systemPackages = [
+        assertions = [
-          pkgs.sbctl
+          {
+            assertion = !cfg.legacy.enable;
+            message = "secure-boot and legacy boot (GRUB) cannot be enabled at the same time";
+          }
         ];
 
-        # Lanzaboote currently replaces the systemd-boot module.
+        environment.systemPackages = [ pkgs.sbctl ];
+
+        # Lanzaboote replaces systemd-boot, so force it off
         boot.loader.systemd-boot.enable = lib.mkForce false;
 
         boot.lanzaboote = {