Add lanzaboote secure boot support

flake.nix

@@ -15,6 +15,11 @@
     nixpkgs-stable.url = "github:NixOS/nixpkgs/nixos-unstable";
     nixos-hardware.url = "github:NixOS/nixos-hardware";
 
+    lanzaboote = {
+      url = "github:nix-community/lanzaboote/v0.4.1";
+      inputs.nixpkgs.follows = "nixpkgs-unstable";
+    };
+
     # Packages
     home-manager.url = "github:nix-community/home-manager/master";
     home-manager.inputs.nixpkgs.follows = "nixpkgs-stable";
@@ -38,13 +43,14 @@
   outputs =
     {
       self,
-      nixpkgs-unstable,
-      nixpkgs-stable,
-      home-manager,
-      nixos-hardware,
-      fcc-unlock,
       catppuccin,
       emanote,
+      fcc-unlock,
+      home-manager,
+      lanzaboote,
+      nixos-hardware,
+      nixpkgs-stable,
+      nixpkgs-unstable,
       ...
     }@inputs:
     let
@@ -91,6 +97,7 @@
               modules = [
                 home-manager.nixosModules.home-manager
                 catppuccin.nixosModules.catppuccin
+                lanzaboote.nixosModules.lanzaboote
                 ./host/${host}/default.nix
               ] ++ (if host == "bachtel" then [ ] else [ home-manager-config ]);
             };