{ hostRegistry, config, pkgs, lib, ... }:
{
  boot = {
    loader.raspberryPi = {
      enable = true;
      version = 4;
      firmwareConfig = lib.mkDefault ''
        gpu_mem=256
        dtparam=audio=on
      '';
    };
    # linuxPackages_latest doesn't boot
    # FIXME: needs u-boot or .dtb?
    kernelPackages = pkgs.linuxPackages_rpi4;
    kernelParams = [
      "verbose" "shell_on_fail"
      "elevator=deadline"
    ];
    initrd = {
      network = {
        enable = true;
        flushBeforeStage2 = false;
      };
      supportedFilesystems = lib.mkForce [
        "nfs"
      ];
      # keyboard support for debugging
      availableKernelModules = [ "usb_storage" "usbhid" ];
    };

    tmpOnTmpfs = true;
  };

  fileSystems."/nix/store" = {
    device = "${hostRegistry.hosts.nix-build.ip4}:/nix/store";
    fsType = "nfs";
    options = [ "nfsvers=3" "proto=tcp" "nolock" "hard" "async" "ro" ];
    neededForBoot = true;
  };

  # don't build .dtb files as long as we don't use them
  hardware.deviceTree.enable = false;

  environment.systemPackages = with pkgs; [
    libraspberrypi
    raspberrypi-eeprom
  ];
  systemd = {
    # r/o /nix/store
    services.nix-daemon.enable = false;
    sockets.nix-daemon.enable = false;
    services.nix-gc.enable = false;
  };
  nix.gc.automatic = lib.mkForce false;
  services.journald.extraConfig = ''
    Storage=volatile
  '';

  system.build.tftproot = pkgs.runCommand "tftproot-${config.networking.hostName}" {} ''
    mkdir -p $out
    cp -rs ${pkgs.raspberrypifw}/share/raspberrypi/boot/* $out/
    rm -f $out/kernel8.img $out/initrd.img
    ln -s ${config.system.build.kernel}/Image $out/kernel8.img
    ln -s ${config.system.build.initialRamdisk}/initrd $out/initrd.img
    cat << EOF > $out/config.txt
    kernel=kernel8.img
    initramfs initrd.img followkernel
    arm_64bit=1
    ${toString config.boot.loader.raspberryPi.firmwareConfig}
    EOF
    echo "dwc_otg.lpm_enable=0 console=ttyAMA0,115200 kgdboc=ttyAMA0,115200 console=tty1 verbose init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams}" > $out/cmdline.txt
  '';
}