From dbc5cb478c7fad1c1750421486252f0a5d98ef9c Mon Sep 17 00:00:00 2001
From: Collin Williams <96917990+bluedragon1221@users.noreply.github.com>
Date: Sun, 11 Jan 2026 13:36:45 -0600
Subject: now there's docs

---
 modules/boot/options.nix | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

(limited to 'modules/boot')

diff --git a/modules/boot/options.nix b/modules/boot/options.nix
index 2f670f9..9e85570 100644
--- a/modules/boot/options.nix
+++ b/modules/boot/options.nix
@@ -1,9 +1,11 @@
 {
+  my-lib,
   config,
   lib,
   ...
 }: let
-  inherit (lib) mkOption mkEnableOption types;
+  inherit (lib) mkOption mkEnableOption;
+  inherit (my-lib.options {inherit lib config;}) mkThemeOption;
 in {
   options = {
     collinux.boot = {
@@ -15,10 +17,7 @@ in {
       };
       plymouth = {
         enable = mkEnableOption "plymouth bootsplash";
-        theme = mkOption {
-          type = types.enum ["catppuccin" "adwaita"];
-          default = config.collinux.theme;
-        };
+        theme = mkThemeOption "plymouth";
       };
       secureBoot.enable = mkEnableOption "lanzaboote";
     };
-- 
cgit v1.3.1


From 49b87521de5e5456680c7dcc094ff39255e298e6 Mon Sep 17 00:00:00 2001
From: Collin Williams <96917990+bluedragon1221@users.noreply.github.com>
Date: Wed, 14 Jan 2026 13:35:04 -0600
Subject: disable some useless kernel modules

---
 modules/boot/nixos/default.nix | 50 +++++++++++++++++++++++++++++++++++-------
 1 file changed, 42 insertions(+), 8 deletions(-)

(limited to 'modules/boot')

diff --git a/modules/boot/nixos/default.nix b/modules/boot/nixos/default.nix
index 026226b..06efa15 100644
--- a/modules/boot/nixos/default.nix
+++ b/modules/boot/nixos/default.nix
@@ -26,6 +26,37 @@ in {
         efi.canTouchEfiVariables = true;
         timeout = cfg.timeout; # hold space to show boot menu
       };
+
+      # from hardened.nix
+      blacklistedKernelModules = [
+        # Obscure network protocols
+        "ax25"
+        "netrom"
+        "rose"
+
+        # Old or rare or insufficiently audited filesystems
+        "adfs"
+        "affs"
+        "bfs"
+        "befs"
+        "cramfs"
+        "efs"
+        "erofs"
+        "exofs"
+        "freevxfs"
+        "f2fs"
+        "hfs"
+        "hpfs"
+        "jfs"
+        "minix"
+        "nilfs2"
+        "ntfs"
+        "omfs"
+        "qnx4"
+        "qnx6"
+        "sysv"
+        "ufs"
+      ];
     }
     // (lib.optionalAttrs cfg.secureBoot.enable {
       lanzaboote = {
@@ -34,14 +65,17 @@ in {
       };
     });
 
-  system.etc.overlay.enable = true;
+  system.etc.overlay = {
+    enable = true;
+    mutable = true; # would love this to be false, but we're not there yet
+  };
   system.nixos-init.enable = true;
 
-  environment.systemPackages =
-    (
-      if cfg.secureBoot.enable
-      then [pkgs.sbctl]
-      else []
-    )
-    ++ [pkgs.efibootmgr];
+  # store journald logs in memory
+  services.journald.extraConfig = ''
+    Storage=volatile
+    RuntimeMaxUse=100M
+  '';
+
+  environment.systemPackages = [pkgs.efibootmgr] ++ lib.optional cfg.secureBoot.enable pkgs.sbctl;
 }
-- 
cgit v1.3.1


From e7c83878a87355f30716fa0a91e128b1e21cc898 Mon Sep 17 00:00:00 2001
From: Collin Williams <96917990+bluedragon1221@users.noreply.github.com>
Date: Fri, 16 Jan 2026 16:57:40 -0600
Subject: fixed issue where system would break when booting because it couldn't
 mount the /etc overlay (kernel module for erofs missing)

---
 modules/boot/nixos/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'modules/boot')

diff --git a/modules/boot/nixos/default.nix b/modules/boot/nixos/default.nix
index 06efa15..49cca5e 100644
--- a/modules/boot/nixos/default.nix
+++ b/modules/boot/nixos/default.nix
@@ -41,7 +41,7 @@ in {
         "befs"
         "cramfs"
         "efs"
-        "erofs"
+        # "erofs" # necessary for system.etc.overlay
         "exofs"
         "freevxfs"
         "f2fs"
-- 
cgit v1.3.1