# general
CONFIG_BLK_DEV_INITRD=y
CONFIG_CGROUPS=y
CONFIG_CRYPTO_XTS=y
CONFIG_DEVTMPFS=y
CONFIG_DM_CRYPT=m
CONFIG_INPUT_EVDEV=y
CONFIG_SYSVIPC=y
CONFIG_TMPFS_POSIX_ACL=y
CONFIG_VT=y
CONFIG_BPF_SYSCALL=y
CONFIG_CGROUP_BPF=y
CONFIG_USB_CONFIGFS_NCM=y
CONFIG_BINFMT_ELF=y
CONFIG_BINFMT_SCRIPT=y
CONFIG_UEVENT_HELPER=y
CONFIG_USER_NS=y
CONFIG_DEVPTS_MULTIPLE_INSTANCES=y
CONFIG_SAMSUNG_TUI=n
CONFIG_TZDEV=n

# filesystems
CONFIG_BTRFS_FS=m
CONFIG_EXFAT_FS=m
CONFIG_EXT4_FS=m
CONFIG_F2FS_FS=m
CONFIG_NLS_ASCII=y

# FDE
CONFIG_MD=y
CONFIG_CRYPTO_SHA256=y # TODO: make this module
CONFIG_CRYPTO_AES=y # TODO: make this module

# nftables
CONFIG_NETFILTER=y
CONFIG_NF_CONNTRACK=m
CONFIG_NF_TABLES=m
CONFIG_NF_TABLES_INET=y
CONFIG_NFT_CT=m
CONFIG_NFT_LOG=m
CONFIG_NFT_LIMIT=m
CONFIG_NFT_MASQ=m
CONFIG_NFT_NAT=m
CONFIG_NFT_REJECT=m
CONFIG_NF_TABLES_IPV4=y
CONFIG_NF_REJECT_IPV4=m
CONFIG_IP_NF_IPTABLES=m
CONFIG_IP_NF_FILTER=m
CONFIG_IP_NF_TARGET_REJECT=m
CONFIG_IP_NF_NAT=m
CONFIG_NF_TABLES_IPV6=y
CONFIG_NF_REJECT_IPV6=m
CONFIG_IP6_NF_IPTABLES=m
CONFIG_IP6_NF_FILTER=m
CONFIG_IP6_NF_TARGET_REJECT=m
CONFIG_IP6_NF_NAT=m

# wireguard
CONFIG_WIREGUARD=m
CONFIG_IP_ADVANCED_ROUTER=y
CONFIG_IP_MULTIPLE_TABLES=y
CONFIG_IPV6_MULTIPLE_TABLES=y
CONFIG_NF_TABLES=m
CONFIG_NF_TABLES_IPV4=y
CONFIG_NF_TABLES_IPV6=y
CONFIG_NFT_CT=m
CONFIG_NFT_FIB_IPV4=m
CONFIG_NFT_FIB_IPV6=m
CONFIG_NF_CONNTRACK_MARK=y

# waydroid
CONFIG_ANDROID_BINDERFS=n
CONFIG_ANDROID_BINDER_DEVICES="binder,hwbinder,vndbinder"
CONFIG_ANDROID_BINDER_IPC=y
CONFIG_ANDROID_BINDER_IPC_SELFTEST=n
CONFIG_BLK_DEV_LOOP=m
CONFIG_BPF_SYSCALL=y
CONFIG_BRIDGE=m
CONFIG_BRIDGE_VLAN_FILTERING=y
CONFIG_CGROUP_BPF=y
CONFIG_FUSE_FS=m
CONFIG_IP_NF_MANGLE=m
CONFIG_NETFILTER_XTABLES=m
CONFIG_NETFILTER_XT_MATCH_COMMENT=m
CONFIG_SQUASHFS=m
CONFIG_SQUASHFS_XATTR=y
CONFIG_SQUASHFS_XZ=y
CONFIG_TMPFS_XATTR=y
CONFIG_TUN=m
CONFIG_VETH=m
CONFIG_VLAN_8021Q=m # prerequisite for bridge

CONFIG_CROSS_MEMORY_ATTACH=y
CONFIG_PSI=y
CONFIG_PSI_DEFAULT_DISABLED=n

# iwd
CONFIG_ASYMMETRIC_KEY_TYPE=y
CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y
CONFIG_CRYPTO_AES=y # TODO: make this module
CONFIG_CRYPTO_CBC=y # TODO: make this module
CONFIG_CRYPTO_CMAC=y # TODO: make this module
CONFIG_CRYPTO_DES=y # TODO: make this module
CONFIG_CRYPTO_ECB=y # TODO: make this module
CONFIG_CRYPTO_HMAC=y
CONFIG_CRYPTO_MD5=y # TODO: make this module
CONFIG_CRYPTO_SHA1=y # TODO: make this module
CONFIG_CRYPTO_SHA256=y # TODO: make this module
CONFIG_CRYPTO_SHA512=y # TODO: make this module
CONFIG_CRYPTO_USER_API_HASH=m
CONFIG_CRYPTO_USER_API_SKCIPHER=m
CONFIG_KEYS=y
CONFIG_KEY_DH_OPERATIONS=y
CONFIG_PKCS7_MESSAGE_PARSER=y
CONFIG_PKCS8_PRIVATE_KEY_PARSER=m
CONFIG_X509_CERTIFICATE_PARSER=y
CONFIG_RFKILL=m

# containers (lxc, Docker)
CONFIG_NAMESPACES=y
CONFIG_NET_NS=y
CONFIG_PID_NS=y
CONFIG_IPC_NS=y
CONFIG_UTS_NS=y
CONFIG_CGROUPS=y
CONFIG_CGROUP_CPUACCT=y
CONFIG_CGROUP_DEVICE=y
CONFIG_CGROUP_FREEZER=y
CONFIG_CGROUP_SCHED=y
CONFIG_CPUSETS=y
CONFIG_KEYS=y
CONFIG_VETH=m
CONFIG_BRIDGE=m
CONFIG_BRIDGE_NETFILTER=m
CONFIG_IP_NF_FILTER=m
CONFIG_IP_NF_TARGET_MASQUERADE=m
CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
CONFIG_NETFILTER_XT_MATCH_IPVS=m
CONFIG_NETFILTER_XT_MARK=m
CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m # needed for lxc
CONFIG_IP_NF_NAT=m
CONFIG_NF_NAT=m
CONFIG_POSIX_MQUEUE=y
CONFIG_BLK_DEV_DM=m # Storage Drivers
CONFIG_DUMMY=m # Network Drivers
CONFIG_USER_NS=y
CONFIG_BLK_CGROUP=y # Optional section
CONFIG_BLK_DEV_THROTTLING=y # Optional section
CONFIG_CGROUP_PERF=y # Optional section
CONFIG_NET_CLS_CGROUP=m # Optional section
CONFIG_NET_SCHED=y # Optional section
CONFIG_FAIR_GROUP_SCHED=y # Optional section
CONFIG_RT_GROUP_SCHED=y # Optional section
CONFIG_IP_NF_TARGET_REDIRECT=m # Optional section
CONFIG_IP_VS=m # Optional section
CONFIG_IP_VS_NFCT=y # Optional section
CONFIG_IP_VS_PROTO_TCP=y # Optional section
CONFIG_IP_VS_PROTO_UDP=y # Optional section
CONFIG_IP_VS_RR=m # Optional section
CONFIG_EXT4_FS=m
CONFIG_EXT4_FS_POSIX_ACL=y # Optional section
CONFIG_EXT4_FS_SECURITY=y # Optional section
CONFIG_CFS_BANDWIDTH=y # Optional section
CONFIG_CHECKPOINT_RESTORE=y # Needed for lxc
CONFIG_MEMCG=y
CONFIG_DM_THIN_PROVISIONING=m # Storage Drivers
CONFIG_SWAP=y
CONFIG_VXLAN=m # Network Drivers
CONFIG_IP6_NF_TARGET_MASQUERADE=m # Needed for lxc
CONFIG_BRIDGE_VLAN_FILTERING=y # This is already enabled
CONFIG_MACVLAN=m # Network Drivers
CONFIG_CGROUP_NET_PRIO=y # Optional section
CONFIG_OVERLAY_FS=m # Storage Drivers
CONFIG_IPVLAN=m # Network Drivers
CONFIG_SECCOMP=y # Optional section
CONFIG_CGROUP_PIDS=y # Optional section

# zram
CONFIG_ZRAM=m
CONFIG_ZSMALLOC=m
CONFIG_ZSMALLOC_STAT=y
CONFIG_ZRAM_MEMORY_TRACKING=y
CONFIG_CRYPTO_LZ4=m
CONFIG_LZ4_COMPRESS=m
CONFIG_SWAP=y

# usb gadgets
# disable legacy gadgets
CONFIG_USB_ETH=n
CONFIG_USB_FUNCTIONFS=n
CONFIG_USB_MASS_STORAGE=n
CONFIG_USB_G_SERIAL=n
# enable configfs gadgets
CONFIG_USB_CONFIGFS_NCM=y
CONFIG_USB_CONFIGFS_RNDIS=y

# other
CONFIG_BLK_DEV_NBD=y # netboot
CONFIG_INPUT_UINPUT=m # fbkeyboard, buffyboard
CONFIG_LEDS_TRIGGER_TIMER=m # hfd-service
CONFIG_NETFILTER_XT_MATCH_TCPMSS=m # change MTU, e.g. for Wireguard
CONFIG_NETFILTER_XT_TARGET_TCPMSS=m # change MTU, e.g. for Wireguard

# EFI
CONFIG_EFI_STUB=y
CONFIG_EFI=y
CONFIG_DMI=y
CONFIG_EFI_ESRT=y
CONFIG_PSTORE=y # dependency of CONFIG_EFI_VARS_PSTORE
CONFIG_EFI_VARS_PSTORE=y
CONFIG_EFI_PARAMS_FROM_FDT=y
CONFIG_EFI_RUNTIME_WRAPPERS=y
CONFIG_EFI_GENERIC_STUB=y

CONFIG_EFI_ZBOOT=y

# Compress modules
CONFIG_HAVE_KERNEL_ZSTD=y
# Doesn't seem to be working correctly
#CONFIG_MODULE_COMPRESS_ZSTD=y
CONFIG_ZSTD_COMMON=y
CONFIG_ZSTD_COMPRESS=y
CONFIG_ZSTD_DECOMPRESS=y
CONFIG_DECOMPRESS_ZSTD=y

# Enable dynamic debug
CONFIG_DYNAMIC_DEBUG=y