{ pkgs, lib, ... }:

{
  boot.loader.systemd-boot.enable = true;
  # Raspberry Pi has no NVRAM.
  boot.loader.efi.canTouchEfiVariables = false;

  boot.kernelPackages = pkgs.linuxPackages_rpi4;
  # https://github.com/NixOS/nixpkgs/issues/122130#issuecomment-1568815007
  # It's unclear if these are strictly necessary with the downstream kernel,
  # but let's leave them in to keep working with mainline.
  boot.initrd.availableKernelModules = [ "uas" "pcie-brcmstb" "reset-raspberrypi" ];

  networking.hostName = "weebnix";
  networking.domain = "mou.fo";
  # TODO secrets management or switch to wired
  networking.wireless = {
    enable = true;
    networks."oldschool".psk = builtins.readFile /var/lib/secrets/oldschool.wpa-psk;
  };

  systemd.network.enable = true;
  networking.dhcpcd.enable = false;
  networking.tempAddresses = "disabled";

  systemd.network.networks = let
    default = {
      networkConfig = {
        DHCP = "yes";
        MulticastDNS = "yes";
      };
      ipv6AcceptRAConfig.Token = "prefixstable";  # RFC 7217
    };
  in {
    "10-wlan" = lib.recursiveUpdate default {
      matchConfig.Name = "wlan0";
    };
    "10-eth" = lib.recursiveUpdate default {
      matchConfig.Name = "end0";
      linkConfig.RequiredForOnline = "no";
    };
  };

  # Problematic when the clock is unreliable (Pi has no RTC).
  services.resolved.dnssec = "false";

  time.timeZone = "America/New_York";
}