Allow enabling Secure Boot

lib/modules/os.nix

@@ -25,7 +25,20 @@
                 ];
               };
 
-              linuxVariant = osVariant.extendModules { };
+              linuxVariant = osVariant.extendModules {
+                modules = [
+                  ({ ... }: {
+                    options = {
+                      secureBoot = mkOption {
+                        type = types.bool;
+                        description = "A value indicating whether the system supports Secure Boot.";
+                        default = false;
+                      };
+                    };
+                  })
+                ];
+              };
+
               windowsVariant = osVariant.extendModules { };
             in {
               options = {

profiles/machines/manuel/DerGeret/config.nix

@@ -6,6 +6,7 @@
   config = {
     valhalla = {
       hostname = lib.mkDefault "der-geret";
+      linux.secureBoot = true;
 
       windows = {
         dualboot = {

profiles/machines/manuel/ManuSurface/config.nix

@@ -6,6 +6,7 @@
   config = {
     valhalla = {
       hostname = "manu-surface";
+      linux.secureBoot = true;
       partition.os.deviceName = "nvme0n1";
     };
   };

scripts/Arch/Config/SecureBoot/main.fish

@@ -0,0 +1,35 @@
+#!/bin/env fish
+begin
+    set -l dir (status dirname)
+    source "$dir/../../Scripts/software.fish"
+
+    function installSW -V dir
+        yayinst secureboot-grub
+    end
+
+    function configureSW -V dir
+        source "$dir/../../../Common/Scripts/config.fish"
+        set -l label (getConfig valhalla.boot.label)
+        set -l efiDir (getConfig valhalla.boot.efiMountPoint)
+        set -l bootNums (efibootmgr | sed "/$label/{ s/^.*Boot\([[:digit:]]\+\)\*.*\$/\1/; p; }; d")
+
+        for bootNum in $bootNums
+            sudo efibootmgr --delete-bootnum --bootnum $bootNum
+        end
+
+        sudo sed -i \
+            -e "/esp=/{" \
+                -e "a esp=\"$efiDir\"" \
+                -e "d" \
+            -e "}" \
+            -e "/bootloader_id=/{" \
+                -e "a bootloader_id=\"$label\"" \
+                -e "d" \
+            -e "}" \
+            /etc/secureboot.conf
+
+        sudo secure-grub-install
+    end
+
+    runInstaller $argv
+end

scripts/Arch/Scripts/deploy.fish

@@ -14,7 +14,11 @@ function deploySoftware -d "Deploys a the specified software action" -a action
         end
     )
 
-    if collectionActive essential
+    if getConfig valhalla.linux.secureBoot --json | jq --exit-status > /dev/null
+        source "$dir/../Config/SecureBoot/main.fish" $argv
+    end
+
+    and if collectionActive essential
         if $isInstall
             yayinst \
                 mkinitcpio-firmware \