enable lanzaboote

flake.nix

@@ -38,7 +38,10 @@
       url = "git+ssh://git@git.nyxerinys.dev:222/nyxerinys/nix-secrets";
       flake = false;
     };
-
+    lanzaboote = {
+      url = "github:nix-community/lanzaboote/v1.2.0";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs = { self, nixpkgs, nix-darwin, home-manager, ... } @ inputs:

hosts/apollo/autologin.nix

@@ -0,0 +1,16 @@
+{ ... }:
+
+{
+  services.getty = {
+    autologinUser = "nyxerinys";
+    autologinOnce = true;
+  };
+
+  systemd.defaultUnit = "graphical.target";
+
+  programs.zsh.loginShellInit = ''
+    if [[ "$TTY" == "/dev/tty1" ]] && uwsm check may-start; then 
+      exec uwsm start hyprland-uwsm.desktop
+    fi
+  '';
+}

hosts/apollo/boot.nix

@@ -1,7 +1,25 @@
 { pkgs, lib, inputs, ... }:
 
 {
-  boot.initrd = {
+  imports = [
+    lanzaboote.nixosModules.lanzaboote
+  ];
+
+  boot = {
+
+    #Bootloader
+    environment.systemPackages = [ pkgs.sbctl ];
+    lanzaboote = {
+      enable = true;
+      pkiBundle = "/var/lib/sbctl";
+      autoGenerateKeys.enable = true;
+      autoEnrollKeys.enable = true;
+    };
+    loader.efi.canTouchEfiVariables = true;
+    loader.systemd-boot.enable = lib.mkForce false;
+
+    # Luks Decryption for ZFS
+    initrd = {
       supportedFilesystems = [ "ext4" "zfs" ];
       availableKernelModules = [ "hid_apple" ];
       systemd = {
@@ -30,6 +48,7 @@
       };
 
     };
+  };
 
   systemd.services."zfs-import-nix-main" = {
     wants = [ "keys.mount" ];

hosts/apollo/default.nix

@@ -4,6 +4,7 @@
   imports = [
     ./boot.nix
     ./hardware.nix
+    ./autologin.nix
   ];
 
   networking.hostName = "apollo";
@@ -19,17 +20,4 @@
   environment.systemPackages = with pkgs; [
     kitty
   ];
-
-  services.getty = {
-    autologinUser = "nyxerinys";
-    autologinOnce = true;
-  };
-
-  systemd.defaultUnit = "graphical.target";
-
-  programs.zsh.loginShellInit = ''
-    if [[ "$TTY" == "/dev/tty1" ]] && uwsm check may-start; then 
-      exec uwsm start hyprland-uwsm.desktop
-    fi
-  '';
 }

hosts/base.nix

@@ -17,7 +17,7 @@
         devices = ["nodev"];
       };
     };
-    kernelParams = lib.mkDefault [ "ipv6.disable=1" ];
+    kernelParams = [ "ipv6.disable=1" ];
   };
 
   # system.autoUpgrade = mkDefault {