{ config, inputs, pkgs, lib, ... }:

let
  cfg = config.modules.secure-boot;
in
{
  imports = [
    inputs.lanzaboote.nixosModules.lanzaboote
  ];

  options.modules.secure-boot = {
    enable = lib.mkEnableOption "Secure boot with lanzaboote";
  };

  config = lib.mkIf cfg.enable {
    boot.lanzaboote.enable = true;
    boot.lanzaboote.pkiBundle = "/etc/secureboot";

    # Managed by lanzaboote
    boot.loader.systemd-boot.enable = lib.mkForce false;

    modules.persistence.directories = [
      "/etc/secureboot"
    ];

    environment.systemPackages = [ pkgs.sbctl ];
  };
}