nix-config/modules/nixos/boot/secure-boot.nix

{ inputs, ... }:
{
  flake.modules.nixos.boot =
    {
      config,
      lib,
      pkgs,
      ...
    }:
    let
      cfg = config.tnix.boot;
    in
    {
      imports = [ inputs.lanzaboote.nixosModules.lanzaboote ];

      options.tnix.boot.secure-boot = {
        enable = lib.mkEnableOption "Enable secure-boot";
      };

      config = lib.mkIf cfg.secure-boot.enable {
        assertions = [
          {
            assertion = !cfg.legacy.enable;
            message = "secure-boot and legacy boot (GRUB) cannot be enabled at the same time";
          }
        ];

        environment.systemPackages = [ pkgs.sbctl ];

        # Lanzaboote replaces systemd-boot, so force it off
        boot.loader.systemd-boot.enable = lib.mkForce false;

        boot.lanzaboote = {
          enable = true;
          autoGenerateKeys.enable = true;
          autoEnrollKeys.enable = true;

          configurationLimit = 10;
          pkiBundle = "/var/lib/sbctl";
        };
      };
    };
}