rdp and lanzaboot

flake.nix

@@ -17,12 +17,18 @@
       url = "github:mic92/sops-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    zen-browser.url = "github:MarceColl/zen-browser-flake";
+    zen-browser.url = "github:0xc000022070/zen-browser-flake";
     home-manager = {
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     trilium-next-pr.url = "github:FliegendeWurst/nixpkgs/trilium-next";
+    lanzaboote = {
+      url = "github:nix-community/lanzaboote/v0.4.2";
+
+      # Optional but recommended to limit the size of your system closure.
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs = inputs:
@@ -79,6 +85,23 @@
 
       systems.modules.nixos = with inputs; [
         # my-input.nixosModules.my-module
+        lanzaboote.nixosModules.lanzaboote ({ pkgs, lib, ... }: {
+          environment.systemPackages = [
+            # For debugging and troubleshooting Secure Boot.
+            pkgs.sbctl
+          ];
+
+          # Lanzaboote currently replaces the systemd-boot module.
+          # This setting is usually set to true in configuration.nix
+          # generated at installation time. So we force it to false
+          # for now.
+          boot.loader.systemd-boot.enable = lib.mkForce false;
+
+          boot.lanzaboote = {
+            enable = true;
+            pkiBundle = "/var/lib/sbctl";
+          };
+        })
       ];
 
       # The attribute set specified here will be passed directly to NixPkgs when