# based on https://tangled.org/ed209.dev/nix-config/blob/c68d0f252cb126cbe0540cb7a1709e8294777c1c/modules/nixos/system/boot/default.nix
{
  config,
  lib,
  pkgs,
  ...
}: let
  cfg = config.hardened;
in {
  config = lib.mkIf cfg.secureboot.enable {
    systemd.tmpfiles.rules = [
      "d /etc/secureboot/pki 0700 root root -"
    ];

    boot = {
      lanzaboote = {
        enable = true;
        pkiBundle = "/etc/secureboot/pki";
        autoGenerateKeys.enable = true;
        autoEnrollKeys = {
          includeMicrosoftKeys = false;
          allowBrickingMyMachine = true;
          enable = true;
          autoReboot = true;
        };
      };
      loader.systemd-boot = {
        enable = lib.mkForce false;
        configurationLimit = 10;
        editor = false;
      };
    };

    environment.systemPackages = with pkgs; [
      sbctl
    ];

    environment.persistence = lib.mkIf config.hardened.impermanence.enable {
      "/persistent" = {
        directories = [
          "/etc/secureboot"
        ];
      };
    };
  };
}