From d223de2604450269ae467d69d21add7de13cb0c8 Mon Sep 17 00:00:00 2001
From: nyxerinys <nyxerinys5@gmail.com>
Date: Fri, 2 Oct 2026 18:33:05 -0500
Subject: [PATCH] enable lanzaboote

---
 flake.nix                  |  5 ++-
 hosts/apollo/autologin.nix | 16 +++++++++
 hosts/apollo/boot.nix      | 67 ++++++++++++++++++++++++--------------
 hosts/apollo/default.nix   | 14 +-------
 hosts/base.nix             |  2 +-
 5 files changed, 65 insertions(+), 39 deletions(-)
 create mode 100644 hosts/apollo/autologin.nix

diff --git a/flake.nix b/flake.nix
index f5077a3..af88464 100644
--- a/flake.nix
+++ b/flake.nix
@@ -38,7 +38,10 @@
       url = "git+ssh://git@git.nyxerinys.dev:222/nyxerinys/nix-secrets";
       flake = false;
     };
-
+    lanzaboote = {
+      url = "github:nix-community/lanzaboote/v1.2.0";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs = { self, nixpkgs, nix-darwin, home-manager, ... } @ inputs:
diff --git a/hosts/apollo/autologin.nix b/hosts/apollo/autologin.nix
new file mode 100644
index 0000000..dbe6241
--- /dev/null
+++ b/hosts/apollo/autologin.nix
@@ -0,0 +1,16 @@
+{ ... }:
+
+{
+  services.getty = {
+    autologinUser = "nyxerinys";
+    autologinOnce = true;
+  };
+
+  systemd.defaultUnit = "graphical.target";
+
+  programs.zsh.loginShellInit = ''
+    if [[ "$TTY" == "/dev/tty1" ]] && uwsm check may-start; then 
+      exec uwsm start hyprland-uwsm.desktop
+    fi
+  '';
+}
\ No newline at end of file
diff --git a/hosts/apollo/boot.nix b/hosts/apollo/boot.nix
index 2560f94..f0581f1 100644
--- a/hosts/apollo/boot.nix
+++ b/hosts/apollo/boot.nix
@@ -1,34 +1,53 @@
 { pkgs, lib, inputs, ... }:
 
 {
-  boot.initrd = {
-    supportedFilesystems = [ "ext4" "zfs" ];
-    availableKernelModules = [ "hid_apple" ];
-    systemd = {
+  imports = [
+    lanzaboote.nixosModules.lanzaboote
+  ];
+
+  boot = {
+
+    #Bootloader
+    environment.systemPackages = [ pkgs.sbctl ];
+    lanzaboote = {
       enable = true;
-      fido2.enable = true;
-      emergencyAccess = true;
-      mounts = [
-        {
-          what = "/dev/mapper/zfs-keys";
-          where = "/keys";
-          type = "ext4";
-          options = "ro";
-        }
-      ];
+      pkiBundle = "/var/lib/sbctl";
+      autoGenerateKeys.enable = true;
+      autoEnrollKeys.enable = true;
     };
-    luks.fido2Support = false;
+    loader.efi.canTouchEfiVariables = true;
+    loader.systemd-boot.enable = lib.mkForce false;
+
+    # Luks Decryption for ZFS
+    initrd = {
+      supportedFilesystems = [ "ext4" "zfs" ];
+      availableKernelModules = [ "hid_apple" ];
+      systemd = {
+        enable = true;
+        fido2.enable = true;
+        emergencyAccess = true;
+        mounts = [
+          {
+            what = "/dev/mapper/zfs-keys";
+            where = "/keys";
+            type = "ext4";
+            options = "ro";
+          }
+        ];
+      };
+      luks.fido2Support = false;
+
+      luks.devices."zfs-keys" = {
+        device = "/dev/disk/by-id/nvme-CT1000P2SSD8_2138E5D5DA5A-part2";
+        crypttabExtraOpts = [ "fido2-device=auto" ];
+      };
+
+      systemd.services."zfs-import-nix-root" = {
+        wants = [ "keys.mount" ];
+        after = [ "keys.mount" ];
+      };
 
-    luks.devices."zfs-keys" = {
-      device = "/dev/disk/by-id/nvme-CT1000P2SSD8_2138E5D5DA5A-part2";
-      crypttabExtraOpts = [ "fido2-device=auto" ];
     };
-
-    systemd.services."zfs-import-nix-root" = {
-      wants = [ "keys.mount" ];
-      after = [ "keys.mount" ];
-    };
-
   };
 
   systemd.services."zfs-import-nix-main" = {
diff --git a/hosts/apollo/default.nix b/hosts/apollo/default.nix
index 3ac64b3..f2a00dc 100644
--- a/hosts/apollo/default.nix
+++ b/hosts/apollo/default.nix
@@ -4,6 +4,7 @@
   imports = [
     ./boot.nix
     ./hardware.nix
+    ./autologin.nix
   ];
 
   networking.hostName = "apollo";
@@ -19,17 +20,4 @@
   environment.systemPackages = with pkgs; [
     kitty
   ];
-
-  services.getty = {
-    autologinUser = "nyxerinys";
-    autologinOnce = true;
-  };
-
-  systemd.defaultUnit = "graphical.target";
-
-  programs.zsh.loginShellInit = ''
-    if [[ "$TTY" == "/dev/tty1" ]] && uwsm check may-start; then 
-      exec uwsm start hyprland-uwsm.desktop
-    fi
-  '';
 }
\ No newline at end of file
diff --git a/hosts/base.nix b/hosts/base.nix
index 4eaedcb..a4d6a4d 100644
--- a/hosts/base.nix
+++ b/hosts/base.nix
@@ -17,7 +17,7 @@
         devices = ["nodev"];
       };
     };
-    kernelParams = lib.mkDefault [ "ipv6.disable=1" ];
+    kernelParams = [ "ipv6.disable=1" ];
   };
 
   # system.autoUpgrade = mkDefault {