1 files changed, 20 insertions, 0 deletions
diff --git a/nix/modules/secure-boot.nix b/nix/modules/secure-boot.nix
new file mode 100644
index 0000000..0785835
--- /dev/null
+++ b/nix/modules/secure-boot.nix
@@ -0,0 +1,20 @@
+{ pkgs, lib, config, inputs, ... }:
+{
+  imports = [
+    inputs.lanzaboote.nixosModules.lanzaboote
+  ];
+
+  options = {
+    secure-boot.enable = lib.mkEnableOption "Enables secure boot on system";
+  };
+
+  config = lib.mkIf config.secure-boot.enable {
+    boot = {
+      loader.systemd-boot.enable = lib.mkForce false;
+      lanzaboote = {
+        enable = true;
+        pkiBundle = "/etc/secureboot";
+      };
+    };
+  };
+}