From 18c9fe35f2c91f6b9342fff23249a0f81a45190f Mon Sep 17 00:00:00 2001
From: Loic NITOUD <l.nitoud@partner.samsung.com>
Date: Fri, 19 Jun 2026 17:20:24 +0200
Subject: [PATCH] feat: add samsung Galaxy Book6 EE (PVAP) hardware profile and
 fixes

---
 examples/basic/default.nix    | 11 +++----
 hardware/default.nix          |  1 +
 hardware/galaxybook6-pvap.nix | 56 +++++++++++++++++++++++++++++++++++
 modules/anssi/preboot.nix     |  8 ++---
 modules/self.nix              |  7 ++++-
 modules/vpn/default.nix       |  6 +++-
 6 files changed, 76 insertions(+), 13 deletions(-)
 create mode 100644 hardware/galaxybook6-pvap.nix

diff --git a/examples/basic/default.nix b/examples/basic/default.nix
index 4e49563c..bc04eee5 100644
--- a/examples/basic/default.nix
+++ b/examples/basic/default.nix
@@ -9,18 +9,18 @@
   mainDisk ? "/dev/nvme0n1",
 }:
 let
-  securix = import securix {
+   securixPkgs = import securix {
     edition = "my-team";
     defaultTags = [ "my-team" ];
-    inherit mainDisk pkgs;
+  inherit pkgs;
   };
   inherit (pkgs) lib;
 in
 rec {
-  users = securix.lib.readInventory ./inventory;
+  users = securixPkgs.lib.readInventory ./inventory;
   vpn-profiles = import ./vpn-profiles { inherit lib; };
   # Base system is provided.
-  terminals = securix.lib.mkTerminals users vpn-profiles (
+ terminals = securixPkgs.lib.mkTerminals { inherit users vpn-profiles; edition = "my-team"; } (
     { lib, ... }:
     {
       imports = [
@@ -28,6 +28,7 @@ rec {
       ];
 
       securix = {
+  self.mainDisk = mainDisk;
         # Le terminal est multi-opérateur
         users.allowAnyOperator = true;
 
@@ -54,5 +55,5 @@ rec {
     }
   );
 
-  docs = securix.lib.mkDocs { inherit users terminals vpn-profiles; };
+  docs = securixPkgs.lib.mkDocs { inherit users terminals vpn-profiles; };
 }
diff --git a/hardware/default.nix b/hardware/default.nix
index 2ebebbe6..dfe00065 100644
--- a/hardware/default.nix
+++ b/hardware/default.nix
@@ -12,5 +12,6 @@
     ./e14-g7.nix
     ./x13-20ug.nix
     ./qemu-vm.nix
+    ./galaxybook6-pvap.nix
   ];
 }
diff --git a/hardware/galaxybook6-pvap.nix b/hardware/galaxybook6-pvap.nix
new file mode 100644
index 00000000..dd705248
--- /dev/null
+++ b/hardware/galaxybook6-pvap.nix
@@ -0,0 +1,56 @@
+# SPDX-FileCopyrightText: 2026 Contributors
+# SPDX-License-Identifier: MIT
+#
+# Samsung Galaxy Book6 Enterprise Edition — Model PVAP
+# CPU: Intel Core Ultra 5 325 (Panther Lake)
+
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+let
+  inherit (lib) mkIf;
+in
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+
+  config = mkIf (config.securix.self.machine.hardwareSKU == "galaxybook6-pvap") {
+
+    boot.initrd.availableKernelModules = [
+      "xhci_pci"
+      "thunderbolt"
+      "nvme"
+      "usb_storage"
+      "sd_mod"
+      "i2c_designware_platform"
+      "i2c_hid_acpi"
+    ];
+
+    boot.initrd.kernelModules = [ ];
+
+    boot.kernelModules = [
+      "kvm-intel"
+      "samsung-galaxybook"
+    ];
+
+    boot.extraModulePackages = [ ];
+
+    boot.kernelParams = [
+      "i8042.nopnp"
+      "i8042.reset"
+      "i8042.probe_defer"
+    ];
+
+    hardware.firmware = [
+      pkgs.linux-firmware
+      pkgs.wireless-regdb
+    ];
+
+    nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+    powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+    hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  };
+}
diff --git a/modules/anssi/preboot.nix b/modules/anssi/preboot.nix
index fef25149..99178612 100644
--- a/modules/anssi/preboot.nix
+++ b/modules/anssi/preboot.nix
@@ -120,9 +120,7 @@
       };
     };
 
-    config = _: {
-      # TODO: grub or systemd-boot password
-    };
+    config = _: { boot.loader.systemd-boot.editor = false; };
 
     checkScript =
       pkgs:
@@ -141,9 +139,7 @@
 
     # implementations.secureboot = { checkScript = {}; depends = [ "R3" ]; };
 
-    config = _: {
-      # TODO
-    };
+    config = _: { boot.loader.systemd-boot.editor = false; };
 
     checkScript =
       pkgs:
diff --git a/modules/self.nix b/modules/self.nix
index b4386cb3..6d2bb566 100644
--- a/modules/self.nix
+++ b/modules/self.nix
@@ -80,7 +80,7 @@ in
       username = mkOption {
         type = types.nullOr types.str;
         default = if cfg.user.email != null then deriveUsernameFromEmail cfg.user.email else null;
-        defaultText = ''<première lettre de prénom><nom de famille> tronqué à 32 caractères'';
+        defaultText = "<première lettre de prénom><nom de famille> tronqué à 32 caractères";
         description = ''
           Nom d'utilisateur de la session PAM, dérivé par l'email en calculant:
 
@@ -154,6 +154,10 @@ in
         description = "Numéro d'inventaire du système";
         example = 123456;
       };
+      inventoryID = mkOption {
+        type = types.nullOr types.int;
+        default = null;
+      };
 
       hardwareSKU = mkOption {
         type = types.enum [
@@ -165,6 +169,7 @@ in
           "e14-g7"
           "x13-20ug"
           "qemu-vm"
+          "galaxybook6-pvap"
         ];
         description = "Identifiant de configuration du matériel";
         example = "x280";
diff --git a/modules/vpn/default.nix b/modules/vpn/default.nix
index 71eb3ec4..ee604dd4 100644
--- a/modules/vpn/default.nix
+++ b/modules/vpn/default.nix
@@ -1,11 +1,15 @@
 # SPDX-FileCopyrightText: 2025 Ryan Lahfa <ryan.lahfa.ext@numerique.gouv.fr>
 #
 # SPDX-License-Identifier: MIT
+{ lib, ... }: {
 
-{
   imports = [
     ./ipsec
     ./netbird
     ./wireguard
   ];
+  options.securix.vpn.enable = lib.mkOption {
+    type = lib.types.bool;
+    default = false;
+  };
 }