From eb95abfc230dc239122f1e89e90cd9a998491a2f Mon Sep 17 00:00:00 2001
From: adikro <adikro@disroot.org>
Date: Tue, 3 Feb 2026 22:58:50 +0100
Subject: ...

---
 os/core/bootloader.nix | 91 ++++++++++++++++++++++++++++++++++++--------------
 1 file changed, 66 insertions(+), 25 deletions(-)

(limited to 'os/core/bootloader.nix')

diff --git a/os/core/bootloader.nix b/os/core/bootloader.nix
index 8ba9406..f0aacc0 100644
--- a/os/core/bootloader.nix
+++ b/os/core/bootloader.nix
@@ -1,43 +1,84 @@
-{ config, lib, ... }:
-let
-  cfg = config.os.core.bootloader;
-in
 {
-  options.os.core.bootloader = lib.mkOption {
-    type = lib.types.enum [ "systemd-boot" "grub" "none" ];
-    default = "systemd-boot";
-    description = "which bootloader to use";
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.os.core.bootloader;
+in {
+  options.os.core.bootloader = {
+    type = lib.mkOption {
+      type = lib.types.enum ["systemd-boot" "grub" "none"];
+      default = "systemd-boot";
+      description = "which bootloader to use";
+    };
+    useOSProber = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "scan for other operating systems";
+    };
+    enableEncryption = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Enables LUKS encryption";
+    };
+    grubDevice = lib.mkOption {
+      type = lib.types.str;
+      default = "nodev";
+    };
+    luksDevice = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      description = "The underlying partition for LUKS";
+    };
   };
+
   config = lib.mkMerge [
     {
-      boot.loader.efi.canTouchEfiVariables = true;
-      boot.supportedFilesystems = [ "ntfs" ];
-      boot.kernelParams = [ "quiet" "splash" ];
-      systemd.settings.Manager = {
-        DefaultTimeoutStopSec = "5s";
+      boot = {
+        supportedFilesystems = ["ntfs" "btrfs"];
+        kernelParams = ["quiet" "splash"];
+        initrd.luks.devices = lib.mkIf (cfg.enableEncryption && cfg.luksDevice != null) {
+          "crypted" = {
+            device = cfg.luksDevice;
+            preLVM = true;
+            allowDiscards = true;
+          };
+        };
       };
+      systemd.settings.Manager.DefaultTimeoutStopSec = "5s";
     }
 
-    (lib.mkIf (cfg == "systemd-boot") {
-      boot.consoleLogLevel = 0;
-      boot.loader = {
-        systemd-boot.enable = true;
-        systemd-boot.editor = false;
-        timeout = 0;
+    (lib.mkIf (cfg.type == "systemd-boot") {
+      boot = {
+        consoleLogLevel = 0;
+        loader = {
+          efi.canTouchEfiVariables = true;
+          timeout = 0;
+          systemd-boot = {
+            enable = true;
+            editor = false;
+          };
+        };
       };
     })
 
-    (lib.mkIf (cfg == "grub") {
+    (lib.mkIf (cfg.type == "grub") {
       boot.loader = {
         timeout = 3;
-        efi.efiSysMountPoint = "/boot";
+        efi.canTouchEfiVariables = cfg.grubDevice == "nodev";
         grub = {
           enable = true;
-          device = "nodev";
-          efiSupport = true;
-          useOSProber = true;
+          device = cfg.grubDevice;
+          useOSProber = cfg.useOSProber;
+          enableCryptodisk = cfg.enableEncryption;
+
+          default =
+            if cfg.useOSProber
+            then 2
+            else 0;
 
-          default = 2;
+          efiSupport = lib.mkDefault (cfg.grubDevice == "nodev");
+          copyKernels = lib.mkIf cfg.enableEncryption true;
         };
       };
     })
-- 
cgit v1.3