hosts/pumpkin/lanzaboote.nix

   1 {
   2   config,
   3   pkgs,
   4   lib,
   5   ...
   6 }:
   7 {
   8   # Lanzaboote currently replaces the systemd-boot module.
   9   # This setting is usually set to true in configuration.nix
  10   # generated at installation time. So we force it to false
  11   # for now.
  12   boot.loader.systemd-boot.enable = lib.mkForce false;
  13   boot.lanzaboote = {
  14     enable = true;
  15     pkiBundle = "/var/lib/sbctl";
  16   };
  17   environment.systemPackages = [
  18     pkgs.sbctl
  19   ];
  20 }