6 files changed, 129 insertions, 0 deletions
diff --git a/sys/boot/boot_pictures/gnu.png b/modules/system/boot/boot_pictures/gnu.png
index d07dee3e..d07dee3e 100755
--- a/sys/boot/boot_pictures/gnu.png
+++ b/modules/system/boot/boot_pictures/gnu.png
Binary files differdiff --git a/sys/boot/boot_pictures/gnulin_emb_1.png b/modules/system/boot/boot_pictures/gnulin_emb_1.png
index 483f2681..483f2681 100755
--- a/sys/boot/boot_pictures/gnulin_emb_1.png
+++ b/modules/system/boot/boot_pictures/gnulin_emb_1.png
Binary files differdiff --git a/sys/boot/boot_pictures/gnulin_emb_2.png b/modules/system/boot/boot_pictures/gnulin_emb_2.png
index 48cd6ad7..48cd6ad7 100755
--- a/sys/boot/boot_pictures/gnulin_emb_2.png
+++ b/modules/system/boot/boot_pictures/gnulin_emb_2.png
Binary files differdiff --git a/modules/system/boot/default.nix b/modules/system/boot/default.nix
new file mode 100644
index 00000000..1e6fa99b
--- /dev/null
+++ b/modules/system/boot/default.nix
@@ -0,0 +1,129 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  cfg = config.soispha.boot;
+in {
+  options.soispha.boot = {
+    enable = lib.mkEnableOption "Bootloader configuration";
+    # TODO: Add this option <2024-05-16>
+    # enableIsoEntry = lib.mkEnableOption "an tails iso boot entry";
+  };
+
+  config = lib.mkIf cfg.enable (
+    # let
+    # cfg = config.boot.loader.systemd-boot;
+    # inherit (config.boot.loader) efi;
+    #
+    # esa = n: lib.strings.escapeShellArg n;
+    #
+    # bootMountPoint =
+    #   if cfg.xbootldrMountPoint != null
+    #   then cfg.xbootldrMountPoint
+    #   else efi.efiSysMountPoint;
+    #
+    # nixosDir = "/EFI/nixos";
+    #
+    # # FIXME: This system has two big problems:
+    # # 1. It does not updated files, which still have the same name
+    # # 2. It forgets about files, which were 'deleted' in this configuration (these just
+    # #    stay on disk forever) <2024-05-11>
+    # copyExtraFiles = ''
+    #   echo "[systemd-boot] copying files to ${bootMountPoint}"
+    #   empty_file=$(mktemp)
+    #
+    #   ${lib.concatStrings (lib.mapAttrsToList (n: v:
+    #     /*
+    #     bash
+    #     */
+    #     ''
+    #       if ! [ -e ${esa "${bootMountPoint}/${n}"} ]; then
+    #         install -Dp "${v}" ${esa "${bootMountPoint}/${n}"}
+    #         install -D "$empty_file" ${esa "${bootMountPoint}/${nixosDir}/.extra-files/${n}"}
+    #       fi
+    #     '')
+    #   cfg.extraFiles)}
+    #
+    #   ${lib.concatStrings (lib.mapAttrsToList (n: v:
+    #     /*
+    #     bash
+    #     */
+    #     ''
+    #       # if ! [ -e ${esa "${bootMountPoint}/loader/entries/${n}"} ]; then
+    #         install -Dp "${pkgs.writeText n v}" ${esa "${bootMountPoint}/loader/entries/${n}"}
+    #         install -D "$empty_file" ${esa "${bootMountPoint}/${nixosDir}/.extra-files/loader/entries/${n}"}
+    #       # fi
+    #     '')
+    #   cfg.extraEntries)}
+    # '';
+    # in
+    {
+      # FIXME: Reactviate this whole iso thing when a disko redeploy is done.
+      # (and switch to tails instead of arch) <2024-05-12>
+      #
+      # system.activationScripts = {
+      #   copyExtraFilesForBoot = copyExtraFiles;
+      # };
+
+      boot = {
+        initrd = {
+          kernelModules = ["nvme" "btrfs"];
+        };
+
+        kernelPackages = pkgs.linuxPackages_latest;
+
+        lanzaboote = {
+          enable = true;
+          pkiBundle = "/etc/secureboot";
+
+          settings = {
+            # Disable editing the kernel command line (which could allow someone to become root)
+            editor = false;
+          };
+        };
+
+        loader = {
+          systemd-boot = {
+            # Lanzaboote currently replaces the systemd-boot module.
+            # This setting is usually set to true in configuration.nix
+            # generated at installation time. So we force it to false
+            # for now.
+            enable = false;
+
+            # extraEntries = {
+            #   "live.conf" = ''
+            #     title Archlinux Live ISO
+            #     linux /live/vmlinuz-linux
+            #     initrd /live/initramfs-linux.img
+            #     options img_dev=${config.soispha.disks.disk} img_loop=/archlinux.iso copytoram
+            #   '';
+            # };
+            #
+            # extraFiles = let
+            #   iso = import ./archlive_iso.nix {inherit pkgs;};
+            # in {
+            #   "archlinux.iso" = "${iso}/archlinux.iso";
+            #   "live/initramfs-linux.img" = "${iso}/live/initramfs-linux.img";
+            #   "live/vmlinuz-linux" = "${iso}/live/vmlinuz-linux";
+            # };
+          };
+
+          grub = {
+            enable = false;
+            # theme = pkgs.nixos-grub2-theme;
+            splashImage = ./boot_pictures/gnu.png;
+            efiSupport = true;
+            device = "nodev"; # only for efi
+          };
+
+          efi = {
+            canTouchEfiVariables = true;
+            efiSysMountPoint = "/boot";
+          };
+        };
+      };
+    }
+  );
+}
diff --git a/sys/boot/archlive_iso.nix b/modules/system/boot/iso_entry/archlive_iso.nix
index d19a4a87..d19a4a87 100644
--- a/sys/boot/archlive_iso.nix
+++ b/modules/system/boot/iso_entry/archlive_iso.nix
diff --git a/sys/boot/signing_key.nix b/modules/system/boot/iso_entry/signing_key.nix
index 788447be..788447be 100644
--- a/sys/boot/signing_key.nix
+++ b/modules/system/boot/iso_entry/signing_key.nix