feat(configuration): override EFI loader to shim when Secure Boot enabled

2026-04-02 04:34:47 +02:00
parent 0928588c1f
commit 57417514e3
1 changed files with 9 additions and 0 deletions
--- a/roles/configuration/tasks/_resolve_platform.yml
+++ b/roles/configuration/tasks/_resolve_platform.yml
@@ -14,3 +14,12 @@
 - name: Set platform configuration
  ansible.builtin.set_fact:
    _configuration_platform: "{{ configuration_platform_config[os_family] }}"
+
+- name: Override EFI loader to shim for Secure Boot
+  when:
+    - system_cfg.features.secure_boot.enabled | bool
+    - _configuration_platform.efi_loader != 'shimx64.efi'
+    - os != 'archlinux'
+  ansible.builtin.set_fact:
+    _configuration_platform: >-
+      {{ _configuration_platform | combine({'efi_loader': 'shimx64.efi'}) }}