1 files changed, 41 insertions, 3 deletions

diff --git a/os/core/bootloader.nix b/os/core/bootloader.nix
index dfd9101..aae167e 100644
--- a/os/core/bootloader.nix
+++ b/os/core/bootloader.nix
@@ -1,10 +1,12 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }:
 let
   cfg = config.os.core.bootloader;
+  gpgHome = "/root/.gnupg";
 in
 {
   options.os.core.bootloader = {
@@ -12,6 +14,7 @@ in
       type = lib.types.enum [
         "systemd-boot"
         "grub"
+        "none"
       ];
       default = "systemd-boot";
       description = "Which bootloader to use";
@@ -19,7 +22,7 @@ in
 
     efi = lib.mkOption {
       type = lib.types.bool;
-      default = true;
+      default = if cfg.grub.device == "nodev" then true else false;
       description = "Whether the system uses UEFI or Legacy BIOS";
     };
 
@@ -45,6 +48,13 @@ in
         default = 0;
         description = "Index of the default boot entry";
       };
+      signing = {
+        enable = lib.mkEnableOption "GPG signing for Libreboot/GRUB";
+        keyId = lib.mkOption {
+          type = lib.types.str;
+          description = "The GPG Key ID used to sign the boot files";
+        };
+      };
     };
 
     luks.enable = lib.mkEnableOption "LUKS encryption support";
@@ -56,7 +66,7 @@ in
       boot = {
         loader = {
           timeout = cfg.timeout;
-          efi.canTouchEfiVariables = cfg.efi;
+          efi.canTouchEfiVariables = lib.mkDefault cfg.efi;
         };
         supportedFilesystems = [
           "ntfs"
@@ -92,10 +102,38 @@ in
         efiSupport = cfg.efi;
         useOSProber = cfg.grub.useOSProber;
         default = cfg.grub.defaultEntry;
-
         enableCryptodisk = cfg.luks.enable;
         copyKernels = true;
+
+        extraConfig = lib.mkIf cfg.grub.signing.enable ''
+          set check_signatures=enforce
+          terminal_input console
+          terminal_output console
+        '';
+
+        extraInstallCommands = lib.mkIf cfg.grub.signing.enable ''
+          echo "Signing with keys from ${gpgHome}"
+
+          SIGN_CMD="${pkgs.gnupg}/bin/gpg --homedir ${gpgHome} --detach-sign --batch --yes --default-key ${cfg.grub.signing.keyId}"
+
+          $SIGN_CMD /boot/grub/grub.cfg
+
+          for f in /boot/nixos/*; do
+            if [[ "$f" != *.sig ]]; then
+              $SIGN_CMD "$f"
+            fi
+          done
+        '';
       };
+      environment.systemPackages = lib.optional cfg.grub.signing.enable pkgs.gnupg;
     })
+    {
+      assertions = [
+        {
+          assertion = cfg.grub.signing.enable -> cfg.grub.signing.keyId != "";
+          message = "Bootloader signing is enabled but os.core.bootloader.grub.signing.keyId is not set.";
+        }
+      ];
+    }
   ];
 }