4 files changed, 41 insertions, 0 deletions
diff --git a/sys/boot/boot_pictures/gnu.png b/sys/boot/boot_pictures/gnu.png
new file mode 100755
index 00000000..d07dee3e
--- /dev/null
+++ b/sys/boot/boot_pictures/gnu.png
Binary files differdiff --git a/sys/boot/boot_pictures/gnulin_emb_1.png b/sys/boot/boot_pictures/gnulin_emb_1.png
new file mode 100755
index 00000000..483f2681
--- /dev/null
+++ b/sys/boot/boot_pictures/gnulin_emb_1.png
Binary files differdiff --git a/sys/boot/boot_pictures/gnulin_emb_2.png b/sys/boot/boot_pictures/gnulin_emb_2.png
new file mode 100755
index 00000000..48cd6ad7
--- /dev/null
+++ b/sys/boot/boot_pictures/gnulin_emb_2.png
Binary files differdiff --git a/sys/boot/default.nix b/sys/boot/default.nix
new file mode 100644
index 00000000..9606c7b3
--- /dev/null
+++ b/sys/boot/default.nix
@@ -0,0 +1,41 @@
+{
+  pkgs,
+  lib,
+  ...
+}: {
+  boot = {
+    initrd = {
+      #compressor = "lz4";
+      #compressorArgs = ["-9"];
+      kernelModules = ["nvme" "btrfs"];
+    };
+
+    kernelPackages = pkgs.linuxPackages_latest;
+
+    lanzaboote = {
+      enable = true;
+      pkiBundle = "/etc/secureboot";
+    };
+
+    loader = {
+      # Lanzaboote currently replaces the systemd-boot module.
+      # This setting is usually set to true in configuration.nix
+      # generated at installation time. So we force it to false
+      # for now.
+      systemd-boot.enable = lib.mkForce false;
+
+      grub = {
+        enable = false;
+        # theme = pkgs.nixos-grub2-theme;
+        splashImage = ./boot_pictures/gnu.png;
+        efiSupport = true;
+        device = "nodev"; # only for efi
+      };
+
+      efi = {
+        canTouchEfiVariables = true;
+        efiSysMountPoint = "/boot";
+      };
+    };
+  };
+}