(define-module (pine64))
(use-modules (guix packages)
             (gnu)
             (gnu bootloader u-boot)
             (gnu system locale)
             (srfi srfi-1))
(use-service-modules
  linux
  networking
  ssh)
(use-package-modules
  certs
  connman
  linux)

(operating-system
  (host-name "pine64")
  (timezone "Asia/Jerusalem")
  (locale "en_US.UTF-8")
  (locale-definitions
    (list (locale-definition (source "en_US")
                             (name "en_US.UTF-8"))
          (locale-definition (source "he_IL")
                             (name "he_IL.UTF-8"))))

  (bootloader (bootloader-configuration
                (bootloader u-boot-pine64-plus-bootloader)
                (target "/dev/mmcblk0")))   ; SD card/eMMC (SD priority) storage

  (initrd-modules '())
  ;; The board fails to boot with stock linux-libre
  (kernel linux-libre-arm64-generic)

  (swap-devices (list "/swapfile"))

  (file-systems (cons* (file-system
                         (device (file-system-label "root"))
                         (mount-point "/")
                         (type "ext4"))
                       %base-file-systems))

  (users (cons (user-account
                (name "efraim")
                (comment "Efraim")
                (group "users")
                (supplementary-groups '("wheel"
                                        "netdev" "kvm"))
                (home-directory "/home/efraim"))
               %base-user-accounts))

  ;; This is where we specify system-wide packages.
  (packages (cons* nss-certs         ;for HTTPS access
                   %base-packages))

  (services (cons* (service guix-publish-service-type
                            (guix-publish-configuration
                              (host "0.0.0.0")
                              (port 3000)))

                   (service openssh-service-type
                            (openssh-configuration
                              (x11-forwarding? #t)
                              (extra-content "StreamLocalBindUnlink yes")))

                   (service tor-service-type)
                   (tor-hidden-service "ssh"
                                       '((22 "127.0.0.1:22")))
                   (tor-hidden-service "guix-publish"
                                       '((3000 "127.0.0.1:3000")))

                   (service openntpd-service-type
                            (openntpd-configuration
                              (listen-on '("127.0.0.1" "::1"))
                              ;; Prevent moving to year 2116.
                              (constraints-from '("https://www.google.com/"))))

                   (service connman-service-type)
                   (service wpa-supplicant-service-type)

                   ;; Needs no-manual version, depends on pandoc.
                   (service earlyoom-service-type
                            (earlyoom-configuration
                              (earlyoom
                                (let ((base earlyoom))
                                  (package
                                    (inherit base)
                                    (native-inputs
                                      (alist-delete "pandoc"
                                                    (package-native-inputs base))))))))

                   ;; Not supported by linux-libre-arm64-generic
                   ;(service zram-device-service-type
                   ;         (zram-device-configuration
                   ;           (size (* 2 (expt 2 30)))
                   ;           (compression-algorithm 'zstd)
                   ;           (priority 100)))

                   %base-services))

  ;; Allow resolution of '.local' host names with mDNS.
  (name-service-switch %mdns-host-lookup-nss))