{
  config,
  pkgs,
  lib,
  nixos-hardware,
  mhs35-drm,
  ...
}:

{
  # correctly configure hardware in this pi server.
  imports = [
    nixos-hardware.nixosModules.raspberry-pi-4
    mhs35-drm.nixosModules.default
  ];

  # gpio display visualizing the goings-on on fourmi!
  # this is a weird offbrand ili9486 (maybe?) 3.5" spi panel
  # with an ads7846 touch screen which is not actually compatible
  # with the normal drm driver, so we have our own!
  # see the flake input and associated repo for more!
  hardware.mhs35.enable = true;

  # boot settings
  boot = {
    kernelPackages = lib.mkForce pkgs.linuxPackages_rpi4;

    loader = {
      grub.enable = false;
      generic-extlinux-compatible.enable = true;
    };

    plymouth.enable = true;
    kernelModules = [ ];
  };

  zramSwap = {
    enable = true;
    algorithm = "zstd";
    swapDevices = 1;
    memoryPercent = 100;
  };

  # apply rpi4-specific device tree from nixos-hardware.
  hardware = {
    raspberry-pi."4" = {
      # applied in our flake as per-machine overlay.
      apply-overlays-dtmerge.enable = false;
      fkms-3d.enable = true;
    };
    deviceTree = {
      enable = true;
      filter = "bcm2711-rpi-4*.dtb";
    };
  };

  age.secrets.wireless-secrets = {
    file = ../../secrets/wireless-secrets.age;
  };

  networking = {
    firewall.enable = lib.mkForce false;
    wireless = {
      enable = true;
      interfaces = [ "wlan0" ];
      secretsFile = config.age.secrets.wireless-secrets.path;
      networks."Das asoziale Netzwerk".pskRaw = "ext:psk_home";
    };
  };

  systemd.network = {
    networks = {
      "10-wired" = {
        name = "end0";
        DHCP = "yes";
        dhcpV4Config.RouteMetric = 100;
      };
      "20-wireless" = {
        name = "wlan0";
        DHCP = "yes";
        dhcpV4Config.RouteMetric = 600;
      };
    };
  };
}