enable secure boot, remove gpu drivers from initrd

modules/sys/hw/boot.nix

@@ -6,9 +6,24 @@
     "scsi_mod.use_blk_mq=1"
     "transparent_hugepage=madvise"  # CachyOS default
   ];
-  boot.loader.limine.enable = true;
+  boot.loader.limine = {
+    enable = true;
+    enrollConfig = true;
+    secureBoot = {
+      enable = true;
+      autoGenerateKeys = true;
+      autoEnrollKeys = {
+        enable = true;
+        extraArgs = [ "--microsoft" ];
+      };
+    };
+    style = {
+      wallpaperStyle = "centered";
+      wallpapers = [ pkgs.nixos-artwork.wallpapers.binary-black.gnomeFilePath ];
+    };
+  };
   boot.loader.efi.canTouchEfiVariables = true;
   boot.extraModulePackages = [ ];
-  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" "i915" "amdgpu" ];
+  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
   boot.kernelModules = [ "v4l2loopback" ];
 }

modules/sys/pkgs.nix

@@ -19,5 +19,6 @@
     ffmpeg
     playerctl
     sshfs
+    sbctl
   ];
 }