talexander/machine_setup
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Merge branch 'wpa_supplicant' into nix

Browse Source
This commit is contained in:
Tom Alexander
2026-10-25 16:49:14 -04:00
parent 17bf9a2120 c80f520393
commit 51222cc74c
8 changed files with 189 additions and 116 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
nix/configuration/configuration.nix
View File

@@ -281,6 +281,7 @@ in
(disableOptimizationsPython3 "zopfli") # /nix/store/idjhlmljrapzm3i1svl5x9mdwfxxj51v-pytest-check-hook/nix-support/setup-hook: line 23: 280 Segmentation fault (core dumped) /nix/store/87l6i0czch42nzv39ydwld5hnhcq0b65-python3-3.14.7/bin/python3.14 "${flagsArray[@]}"
(disableOptimizations "zopfli")
(disableOptimizations "nototools") # Needs to use the same version of python as the zopfli package
(disableOptimizations "lib2geom") # Tests failing: ellipse-test, elliptical-arc-test, line-test, polynomial-test
];
hardware.firmware =

1
nix/configuration/hosts/neelix/default.nix
View File

@@ -52,6 +52,7 @@
me.lvfs.enable = true;
me.memtest.enable = true;
me.network.enable = true;
me.network.flavor = "iwd";
me.nvme.enable = true;
me.sound.enable = true;
me.ssh.enable = true;

1
nix/configuration/hosts/odo/default.nix
View File

@@ -121,6 +121,7 @@
me.mitmproxy.enable = true;
me.moonlight.enable = true;
me.network.enable = true;
me.network.flavor = "wpa_supplicant";
me.nix_index.enable = true;
me.nix_repl.enable = true;
me.nixdev.enable = true;

1
nix/configuration/hosts/odowork/default.nix
View File

@@ -118,6 +118,7 @@
me.media.enable = true;
me.memtest.enable = true;
me.network.enable = true;
me.network.flavor = "iwd";
me.nix_index.enable = true;
me.nix_repl.enable = true;
me.nixdev.enable = true;

1
nix/configuration/hosts/quark/default.nix
View File

@@ -113,6 +113,7 @@
me.memtest.enable = true;
me.mitmproxy.enable = true;
me.network.enable = true;
me.network.flavor = "wpa_supplicant";
me.nix_index.enable = true;
me.nix_repl.enable = true;
me.nix_worker.enable = true;

1
nix/configuration/roles/minimal_base/default.nix
View File

@@ -21,6 +21,7 @@
me.doas.enable = true;
me.kernel.enable = true;
me.network.enable = true;
me.network.flavor = "iwd";
me.nvme.enable = true;
me.ssh.enable = true;
me.sshd.enable = true;

294
nix/configuration/roles/network/default.nix
View File

@@ -32,126 +32,190 @@ in
{
imports = [ ];
options.me = {
network.enable = lib.mkOption {
options.me.network = {
enable = lib.mkOption {
type = lib.types.bool;
default = false;
example = true;
description = "Whether we want to install network.";
};
};
config = lib.mkIf config.me.network.enable {
networking.dhcpcd.enable = lib.mkDefault false;
networking.useDHCP = lib.mkDefault false;
networking.nameservers = [
"9.9.9.10#dns10.quad9.net"
"149.112.112.10#dns10.quad9.net"
"2620:fe::10#dns10.quad9.net"
"2620:fe::fe:10#dns10.quad9.net"
];
services.resolved = {
enable = true;
# dnssec = "true";
settings.Resolve.Domains = [ "~." ];
settings.Resolve.FallbackDNS = [ ];
settings.Resolve.DNSOverTLS = "true";
};
# Without this, systemd-resolved will send DNS requests for <X>.home.arpa to the per-link DNS server (172.16.0.1) which does not support DNS-over-TLS. This leads to the connection hanging and timing out. This causes firefox startup to take an extra 10+ seconds.
#
# Test with: drill @127.0.0.53 odo.home.arpa
# TODO: The 127.0.0.1 address should probably be moved to a host-specific file.
networking.extraHosts = ''
127.0.0.1 ${config.networking.hostName}.home.arpa
127.0.0.3 metadata.google.internal
10.216.1.32 homeserver
fdfd:5e8a:ee2d::1:32 homeserver
10.216.1.6 media
10.216.1.12 odo
fdfd:5e8a:ee2d::1:2 odo
10.216.1.14 neelix
10.216.1.15 quark
fdfd:5e8a:ee2d::1:3 quark
10.217.1.1 drmario
10.217.2.1 mrmanager
fdfd:5e8a:ee2d::2:2 mrmanager
172.16.16.1 unifi
172.16.16.231 plug1
172.16.16.232 plug2
172.16.16.233 plug3
172.16.16.234 plug4
172.16.16.235 temperature1
172.16.16.236 temperature2
172.16.16.245 turtle
172.16.16.250 sauna
172.16.16.251 stream
'';
networking.wireless.iwd = {
enable = true;
settings = {
General = {
EnableNetworkConfiguration = true;
AddressRandomization = "network";
};
# Rank = {
# BandModifier2_4GHz = 1.0;
# BandModifier5GHz = 1.0;
# BandModifier6GHz = 1.0;
# };
DriverQuirks = {
PowerSaveDisable = "*";
# ath12k_pci
};
# Scan = {
# DisablePeriodicScan = true;
# DisableRoamingScan = true;
# };
};
};
environment.systemPackages = with pkgs; [
iw
iwd
ldns # for drill
arp-scan # To find devices on the network
wavemon
dhcpcd # For Android USB tethering.
next_hop
];
boot.extraModprobeConfig = ''
# Set wifi to US
options cfg80211 ieee80211_regdom=US
'';
boot.kernel.sysctl = {
# Enable TCP packetization-layer PMTUD when an ICMP black hole is detected.
"net.ipv4.tcp_mtu_probing" = 1;
# Switch to bbr tcp congestion control which should be better on lossy connections like bad wifi.
# We set this in the kernel config, but include this here for unoptimized builds.
"net.ipv4.tcp_congestion_control" = "bbr";
# Don't do a slow start after a connection has been idle for a single RTO.
"net.ipv4.tcp_slow_start_after_idle" = 0;
# 3x time to accumulate filesystem changes before flushing to disk.
"vm.dirty_writeback_centisecs" = 1500;
# Adjust ttl
"net.ipv4.ip_default_ttl" = 65;
"net.ipv6.conf.all.hop_limit" = 65;
"net.ipv6.conf.default.hop_limit" = 65;
# Enable IPv6 Privacy Extensions
"net.ipv6.conf.all.use_tempaddr" = 2;
# Enable IPv6 Privacy Extensions
# This is enabled by default in nixos.
# "net.ipv6.conf.default.use_tempaddr" = 2;
};
environment.persistence."/persist" = lib.mkIf (config.me.mountPersistence) {
hideMounts = true;
directories = [
"/var/lib/iwd" # Wifi settings
];
flavor = lib.mkOption {
type = lib.types.nullOr (
lib.types.enum [
"iwd"
"wpa_supplicant"
]
);
default = null;
example = "wpa_supplicant";
description = "What flavor of network to set up.";
};
};
config = lib.mkIf config.me.network.enable (
lib.mkMerge [
(lib.mkIf (config.me.network.flavor == "iwd") {
networking.dhcpcd.enable = lib.mkDefault false;
networking.useDHCP = lib.mkDefault false;
networking.wireless.iwd = {
enable = true;
settings = {
General = {
EnableNetworkConfiguration = true;
AddressRandomization = "network";
};
# Rank = {
# BandModifier2_4GHz = 1.0;
# BandModifier5GHz = 1.0;
# BandModifier6GHz = 1.0;
# };
DriverQuirks = {
PowerSaveDisable = "*";
# ath12k_pci
};
# Scan = {
# DisablePeriodicScan = true;
# DisableRoamingScan = true;
# };
};
};
environment.systemPackages = with pkgs; [
iwd
];
environment.persistence."/persist" = lib.mkIf (config.me.mountPersistence) {
hideMounts = true;
directories = [
"/var/lib/iwd" # Wifi settings
];
};
})
(lib.mkIf (config.me.network.flavor == "wpa_supplicant") {
networking.wireless.enable = true;
networking.wireless.userControlled = true;
networking.dhcpcd.enable = lib.mkDefault true;
networking.useDHCP = lib.mkDefault true;
networking.wireless.fallbackToWPA2 = false;
networking.wireless.allowAuxiliaryImperativeNetworks = true;
environment.persistence."/persist" = lib.mkIf (config.me.mountPersistence) {
hideMounts = true;
files = [
{
# Wifi settings
file = "/etc/wpa_supplicant/imperative.conf";
# mode = "0664";
# user = "wpa_supplicant";
# group = "wpa_supplicant";
parentDirectory = {
user = "wpa_supplicant";
group = "wpa_supplicant";
mode = "0755";
};
}
];
};
# nixpkgs.overlays = [
# (final: prev: {
# wpa_supplicant = prev.wpa_supplicant.overrideAttrs (oldAttrs: rec {
# extraConfig = oldAttrs.extraConfig + ''
# CONFIG_WEP=y
# '';
# });
# })
# ];
})
(lib.mkIf (config.me.network.flavor == "wpa_supplicant" && config.me.graphical) {
environment.systemPackages = with pkgs; [
wpa_supplicant_gui
];
})
{
networking.nameservers = [
"9.9.9.10#dns10.quad9.net"
"149.112.112.10#dns10.quad9.net"
"2620:fe::10#dns10.quad9.net"
"2620:fe::fe:10#dns10.quad9.net"
];
services.resolved = {
enable = true;
# dnssec = "true";
settings.Resolve.Domains = [ "~." ];
settings.Resolve.FallbackDNS = [ ];
settings.Resolve.DNSOverTLS = "true";
};
# Without this, systemd-resolved will send DNS requests for <X>.home.arpa to the per-link DNS server (172.16.0.1) which does not support DNS-over-TLS. This leads to the connection hanging and timing out. This causes firefox startup to take an extra 10+ seconds.
#
# Test with: drill @127.0.0.53 odo.home.arpa
# TODO: The 127.0.0.1 address should probably be moved to a host-specific file.
networking.extraHosts = ''
127.0.0.1 ${config.networking.hostName}.home.arpa
127.0.0.3 metadata.google.internal
10.216.1.32 homeserver
fdfd:5e8a:ee2d::1:32 homeserver
10.216.1.6 media
10.216.1.12 odo
fdfd:5e8a:ee2d::1:2 odo
10.216.1.14 neelix
10.216.1.15 quark
fdfd:5e8a:ee2d::1:3 quark
10.217.1.1 drmario
10.217.2.1 mrmanager
fdfd:5e8a:ee2d::2:2 mrmanager
172.16.16.1 unifi
172.16.16.231 plug1
172.16.16.232 plug2
172.16.16.233 plug3
172.16.16.234 plug4
172.16.16.235 temperature1
172.16.16.236 temperature2
172.16.16.245 turtle
172.16.16.250 sauna
172.16.16.251 stream
'';
environment.systemPackages = with pkgs; [
iw
ldns # for drill
arp-scan # To find devices on the network
wavemon
dhcpcd # For Android USB tethering.
next_hop
];
boot.extraModprobeConfig = ''
# Set wifi to US
options cfg80211 ieee80211_regdom=US
'';
boot.kernel.sysctl = {
# Enable TCP packetization-layer PMTUD when an ICMP black hole is detected.
"net.ipv4.tcp_mtu_probing" = 1;
# Switch to bbr tcp congestion control which should be better on lossy connections like bad wifi.
# We set this in the kernel config, but include this here for unoptimized builds.
"net.ipv4.tcp_congestion_control" = "bbr";
# Don't do a slow start after a connection has been idle for a single RTO.
"net.ipv4.tcp_slow_start_after_idle" = 0;
# 3x time to accumulate filesystem changes before flushing to disk.
"vm.dirty_writeback_centisecs" = 1500;
# Adjust ttl
"net.ipv4.ip_default_ttl" = 65;
"net.ipv6.conf.all.hop_limit" = 65;
"net.ipv6.conf.default.hop_limit" = 65;
# Enable IPv6 Privacy Extensions
"net.ipv6.conf.all.use_tempaddr" = 2;
# Enable IPv6 Privacy Extensions
# This is enabled by default in nixos.
# "net.ipv6.conf.default.use_tempaddr" = 2;
};
}
]
);
}

5
nix/configuration/roles/user/default.nix
View File

@@ -27,7 +27,10 @@
isNormalUser = true;
createHome = true; # https://github.com/NixOS/nixpkgs/issues/6481
group = "talexander";
extraGroups = [ "wheel" ];
extraGroups = [
"wheel"
"wpa_supplicant"
];
uid = 11235;
packages = with pkgs; [
tree