machine_setup/nix/configuration/roles/network/default.nix

{
  config,
  lib,
  pkgs,
  ...
}:

# Alternative DNS servers:
# "194.242.2.2#doh.mullvad.net"
# "2a07:e340::2#doh.mullvad.net"
# "1.0.0.1#cloudflare-dns.com"
# "1.1.1.1#cloudflare-dns.com"
# "2606:4700:4700::1001#cloudflare-dns.com"
# "2606:4700:4700::1111#cloudflare-dns.com"
# "8.8.4.4#dns.google"
# "8.8.8.8#dns.google"
# "2001:4860:4860::8844#dns.google"
# "2001:4860:4860::8888#dns.google"
# "9.9.9.10#dns10.quad9.net"
# "149.112.112.10#dns10.quad9.net"
# "2620:fe::10#dns10.quad9.net"
# "2620:fe::fe:10#dns10.quad9.net"

let
  patchScriptBin =
    filename: contents:
    ((pkgs.writeScriptBin filename contents).overrideAttrs (old: {
      buildCommand = "${old.buildCommand}\n patchShebangs $out";
    }));
  next_hop = (patchScriptBin "next_hop" (builtins.readFile ./files/next_hop_linux.bash));
in
{
  imports = [ ];

  options.me.network = {
    enable = lib.mkOption {
      type = lib.types.bool;
      default = false;
      example = true;
      description = "Whether we want to install network.";
    };
    flavor = lib.mkOption {
      type = lib.types.nullOr (
        lib.types.enum [
          "iwd"
          "wpa_supplicant"
        ]
      );
      default = null;
      example = "wpa_supplicant";
      description = "What flavor of network to set up.";
    };
  };

  config = lib.mkIf config.me.network.enable (
    lib.mkMerge [
      (lib.mkIf (config.me.network.flavor == "iwd") {
        networking.dhcpcd.enable = lib.mkDefault false;
        networking.useDHCP = lib.mkDefault false;

        networking.wireless.iwd = {
          enable = true;

          settings = {
            General = {
              EnableNetworkConfiguration = true;
              AddressRandomization = "network";
            };
            # Rank = {
            #   BandModifier2_4GHz = 1.0;
            #   BandModifier5GHz = 1.0;
            #   BandModifier6GHz = 1.0;
            # };
            DriverQuirks = {
              PowerSaveDisable = "*";
              # ath12k_pci
            };
            # Scan = {
            #   DisablePeriodicScan = true;
            #   DisableRoamingScan = true;
            # };
          };
        };

        environment.systemPackages = with pkgs; [
          iwd
        ];

        environment.persistence."/persist" = lib.mkIf (config.me.mountPersistence) {
          hideMounts = true;
          directories = [
            "/var/lib/iwd" # Wifi settings
          ];
        };
      })
      (lib.mkIf (config.me.network.flavor == "wpa_supplicant") {
        networking.wireless.enable = true;
        networking.wireless.userControlled = true;

        networking.dhcpcd.enable = lib.mkDefault true;
        networking.useDHCP = lib.mkDefault true;

        networking.wireless.fallbackToWPA2 = false;
        networking.wireless.allowAuxiliaryImperativeNetworks = true;

        environment.persistence."/persist" = lib.mkIf (config.me.mountPersistence) {
          hideMounts = true;
          files = [
            {
              # Wifi settings
              file = "/etc/wpa_supplicant/imperative.conf";
              # mode = "0664";
              # user = "wpa_supplicant";
              # group = "wpa_supplicant";
              parentDirectory = {
                user = "wpa_supplicant";
                group = "wpa_supplicant";
                mode = "0755";
              };
            }
          ];
        };

        # nixpkgs.overlays = [
        #   (final: prev: {
        #     wpa_supplicant = prev.wpa_supplicant.overrideAttrs (oldAttrs: rec {
        #       extraConfig = oldAttrs.extraConfig + ''
        #         	      CONFIG_WEP=y
        #         	    '';
        #     });
        #   })
        # ];
      })
      (lib.mkIf (config.me.network.flavor == "wpa_supplicant" && config.me.graphical) {
        environment.systemPackages = with pkgs; [
          wpa_supplicant_gui
        ];
      })
      {
        networking.nameservers = [
          "9.9.9.10#dns10.quad9.net"
          "149.112.112.10#dns10.quad9.net"
          "2620:fe::10#dns10.quad9.net"
          "2620:fe::fe:10#dns10.quad9.net"
        ];
        services.resolved = {
          enable = true;
          # dnssec = "true";
          settings.Resolve.Domains = [ "~." ];
          settings.Resolve.FallbackDNS = [ ];
          settings.Resolve.DNSOverTLS = "true";
        };

        # Without this, systemd-resolved will send DNS requests for <X>.home.arpa to the per-link DNS server (172.16.0.1) which does not support DNS-over-TLS. This leads to the connection hanging and timing out. This causes firefox startup to take an extra 10+ seconds.
        #
        # Test with: drill @127.0.0.53 odo.home.arpa
        # TODO: The 127.0.0.1 address should probably be moved to a host-specific file.
        networking.extraHosts = ''
          127.0.0.1 ${config.networking.hostName}.home.arpa
          127.0.0.3 metadata.google.internal
          10.216.1.32		homeserver
          fdfd:5e8a:ee2d::1:32	homeserver
          10.216.1.6		media
          10.216.1.12		odo
          fdfd:5e8a:ee2d::1:2	odo
          10.216.1.14		neelix
          10.216.1.15		quark
          fdfd:5e8a:ee2d::1:3	quark
          10.217.1.1		drmario
          10.217.2.1		mrmanager
          fdfd:5e8a:ee2d::2:2 mrmanager
          172.16.16.1		unifi
          172.16.16.231		plug1
          172.16.16.232		plug2
          172.16.16.233		plug3
          172.16.16.234		plug4
          172.16.16.235		temperature1
          172.16.16.236		temperature2
          172.16.16.245		turtle
          172.16.16.250		sauna
          172.16.16.251		stream
        '';

        environment.systemPackages = with pkgs; [
          iw
          ldns # for drill
          arp-scan # To find devices on the network
          wavemon
          dhcpcd # For Android USB tethering.
          next_hop
        ];

        boot.extraModprobeConfig = ''
          # Set wifi to US
          options cfg80211 ieee80211_regdom=US
        '';

        boot.kernel.sysctl = {
          # Enable TCP packetization-layer PMTUD when an ICMP black hole is detected.
          "net.ipv4.tcp_mtu_probing" = 1;
          # Switch to bbr tcp congestion control which should be better on lossy connections like bad wifi.
          # We set this in the kernel config, but include this here for unoptimized builds.
          "net.ipv4.tcp_congestion_control" = "bbr";
          # Don't do a slow start after a connection has been idle for a single RTO.
          "net.ipv4.tcp_slow_start_after_idle" = 0;
          # 3x time to accumulate filesystem changes before flushing to disk.
          "vm.dirty_writeback_centisecs" = 1500;
          # Adjust ttl
          "net.ipv4.ip_default_ttl" = 65;
          "net.ipv6.conf.all.hop_limit" = 65;
          "net.ipv6.conf.default.hop_limit" = 65;
          # Enable IPv6 Privacy Extensions
          "net.ipv6.conf.all.use_tempaddr" = 2;
          # Enable IPv6 Privacy Extensions
          # This is enabled by default in nixos.
          # "net.ipv6.conf.default.use_tempaddr" = 2;
        };
      }
    ]
  );
}