{ lib, ... }:

{
  # NOTE: secureboot enabled in flake.nix
  boot = {
    consoleLogLevel = lib.mkDefault 3;
    loader = {
      timeout = 0;
      efi.canTouchEfiVariables = true;
      systemd-boot = {
        enable = lib.mkDefault true; # mkDefault for Lanzaboote
        editor = false; # Disabled for security
        ### Utilities
        #netbootxyz.enable = true;
        #memtest86.enable = true;
      };
    };
  };
}