enable lanzaboote

flake.nix

@@ -38,7 +38,10 @@
       url = "git+ssh://git@git.nyxerinys.dev:222/nyxerinys/nix-secrets";
       flake = false;
     };
-
+    lanzaboote = {
+      url = "github:nix-community/lanzaboote/v1.2.0";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs = { self, nixpkgs, nix-darwin, home-manager, ... } @ inputs:

hosts/apollo/autologin.nix

@@ -0,0 +1,16 @@
+{ ... }:
+
+{
+  services.getty = {
+    autologinUser = "nyxerinys";
+    autologinOnce = true;
+  };
+
+  systemd.defaultUnit = "graphical.target";
+
+  programs.zsh.loginShellInit = ''
+    if [[ "$TTY" == "/dev/tty1" ]] && uwsm check may-start; then 
+      exec uwsm start hyprland-uwsm.desktop
+    fi
+  '';
+}

hosts/apollo/boot.nix

@@ -1,34 +1,53 @@
 { pkgs, lib, inputs, ... }:
 
 {
-  boot.initrd = {
+  imports = [
-    supportedFilesystems = [ "ext4" "zfs" ];
+    lanzaboote.nixosModules.lanzaboote
-    availableKernelModules = [ "hid_apple" ];
+  ];
-    systemd = {
+
+  boot = {
+
+    #Bootloader
+    environment.systemPackages = [ pkgs.sbctl ];
+    lanzaboote = {
       enable = true;
-      fido2.enable = true;
+      pkiBundle = "/var/lib/sbctl";
-      emergencyAccess = true;
+      autoGenerateKeys.enable = true;
-      mounts = [
+      autoEnrollKeys.enable = true;
-        {
-          what = "/dev/mapper/zfs-keys";
-          where = "/keys";
-          type = "ext4";
-          options = "ro";
-        }
-      ];
     };
-    luks.fido2Support = false;
+    loader.efi.canTouchEfiVariables = true;
+    loader.systemd-boot.enable = lib.mkForce false;
+
+    # Luks Decryption for ZFS
+    initrd = {
+      supportedFilesystems = [ "ext4" "zfs" ];
+      availableKernelModules = [ "hid_apple" ];
+      systemd = {
+        enable = true;
+        fido2.enable = true;
+        emergencyAccess = true;
+        mounts = [
+          {
+            what = "/dev/mapper/zfs-keys";
+            where = "/keys";
+            type = "ext4";
+            options = "ro";
+          }
+        ];
+      };
+      luks.fido2Support = false;
+
+      luks.devices."zfs-keys" = {
+        device = "/dev/disk/by-id/nvme-CT1000P2SSD8_2138E5D5DA5A-part2";
+        crypttabExtraOpts = [ "fido2-device=auto" ];
+      };
+
+      systemd.services."zfs-import-nix-root" = {
+        wants = [ "keys.mount" ];
+        after = [ "keys.mount" ];
+      };
 
-    luks.devices."zfs-keys" = {
-      device = "/dev/disk/by-id/nvme-CT1000P2SSD8_2138E5D5DA5A-part2";
-      crypttabExtraOpts = [ "fido2-device=auto" ];
     };
-
-    systemd.services."zfs-import-nix-root" = {
-      wants = [ "keys.mount" ];
-      after = [ "keys.mount" ];
-    };
-
   };
 
   systemd.services."zfs-import-nix-main" = {

hosts/apollo/default.nix

@@ -4,6 +4,7 @@
   imports = [
     ./boot.nix
     ./hardware.nix
+    ./autologin.nix
   ];
 
   networking.hostName = "apollo";
@@ -19,17 +20,4 @@
   environment.systemPackages = with pkgs; [
     kitty
   ];
-
-  services.getty = {
-    autologinUser = "nyxerinys";
-    autologinOnce = true;
-  };
-
-  systemd.defaultUnit = "graphical.target";
-
-  programs.zsh.loginShellInit = ''
-    if [[ "$TTY" == "/dev/tty1" ]] && uwsm check may-start; then 
-      exec uwsm start hyprland-uwsm.desktop
-    fi
-  '';
 }

hosts/base.nix

@@ -17,7 +17,7 @@
         devices = ["nodev"];
       };
     };
-    kernelParams = lib.mkDefault [ "ipv6.disable=1" ];
+    kernelParams = [ "ipv6.disable=1" ];
   };
 
   # system.autoUpgrade = mkDefault {