diff --git a/nix/configuration/configuration.nix b/nix/configuration/configuration.nix index 3614b41..5e874d7 100644 --- a/nix/configuration/configuration.nix +++ b/nix/configuration/configuration.nix @@ -281,6 +281,7 @@ in (disableOptimizationsPython3 "zopfli") # /nix/store/idjhlmljrapzm3i1svl5x9mdwfxxj51v-pytest-check-hook/nix-support/setup-hook: line 23: 280 Segmentation fault (core dumped) /nix/store/87l6i0czch42nzv39ydwld5hnhcq0b65-python3-3.14.7/bin/python3.14 "${flagsArray[@]}" (disableOptimizations "zopfli") (disableOptimizations "nototools") # Needs to use the same version of python as the zopfli package + (disableOptimizations "lib2geom") # Tests failing: ellipse-test, elliptical-arc-test, line-test, polynomial-test ]; hardware.firmware = diff --git a/nix/configuration/hosts/neelix/default.nix b/nix/configuration/hosts/neelix/default.nix index 00fbece..6f61b4a 100644 --- a/nix/configuration/hosts/neelix/default.nix +++ b/nix/configuration/hosts/neelix/default.nix @@ -52,6 +52,7 @@ me.lvfs.enable = true; me.memtest.enable = true; me.network.enable = true; + me.network.flavor = "iwd"; me.nvme.enable = true; me.sound.enable = true; me.ssh.enable = true; diff --git a/nix/configuration/hosts/odo/default.nix b/nix/configuration/hosts/odo/default.nix index 6789136..4cc7b9d 100644 --- a/nix/configuration/hosts/odo/default.nix +++ b/nix/configuration/hosts/odo/default.nix @@ -121,6 +121,7 @@ me.mitmproxy.enable = true; me.moonlight.enable = true; me.network.enable = true; + me.network.flavor = "wpa_supplicant"; me.nix_index.enable = true; me.nix_repl.enable = true; me.nixdev.enable = true; diff --git a/nix/configuration/hosts/odowork/default.nix b/nix/configuration/hosts/odowork/default.nix index eef8503..a662055 100644 --- a/nix/configuration/hosts/odowork/default.nix +++ b/nix/configuration/hosts/odowork/default.nix @@ -118,6 +118,7 @@ me.media.enable = true; me.memtest.enable = true; me.network.enable = true; + me.network.flavor = "iwd"; me.nix_index.enable = true; me.nix_repl.enable = true; me.nixdev.enable = true; diff --git a/nix/configuration/hosts/quark/default.nix b/nix/configuration/hosts/quark/default.nix index 48cb822..b476e6d 100644 --- a/nix/configuration/hosts/quark/default.nix +++ b/nix/configuration/hosts/quark/default.nix @@ -113,6 +113,7 @@ me.memtest.enable = true; me.mitmproxy.enable = true; me.network.enable = true; + me.network.flavor = "wpa_supplicant"; me.nix_index.enable = true; me.nix_repl.enable = true; me.nix_worker.enable = true; diff --git a/nix/configuration/roles/minimal_base/default.nix b/nix/configuration/roles/minimal_base/default.nix index 076d82d..b221f99 100644 --- a/nix/configuration/roles/minimal_base/default.nix +++ b/nix/configuration/roles/minimal_base/default.nix @@ -21,6 +21,7 @@ me.doas.enable = true; me.kernel.enable = true; me.network.enable = true; + me.network.flavor = "iwd"; me.nvme.enable = true; me.ssh.enable = true; me.sshd.enable = true; diff --git a/nix/configuration/roles/network/default.nix b/nix/configuration/roles/network/default.nix index 45b69e2..da21cc5 100644 --- a/nix/configuration/roles/network/default.nix +++ b/nix/configuration/roles/network/default.nix @@ -32,126 +32,190 @@ in { imports = [ ]; - options.me = { - network.enable = lib.mkOption { + options.me.network = { + enable = lib.mkOption { type = lib.types.bool; default = false; example = true; description = "Whether we want to install network."; }; - }; - - config = lib.mkIf config.me.network.enable { - networking.dhcpcd.enable = lib.mkDefault false; - networking.useDHCP = lib.mkDefault false; - networking.nameservers = [ - "9.9.9.10#dns10.quad9.net" - "149.112.112.10#dns10.quad9.net" - "2620:fe::10#dns10.quad9.net" - "2620:fe::fe:10#dns10.quad9.net" - ]; - services.resolved = { - enable = true; - # dnssec = "true"; - settings.Resolve.Domains = [ "~." ]; - settings.Resolve.FallbackDNS = [ ]; - settings.Resolve.DNSOverTLS = "true"; - }; - - # Without this, systemd-resolved will send DNS requests for .home.arpa to the per-link DNS server (172.16.0.1) which does not support DNS-over-TLS. This leads to the connection hanging and timing out. This causes firefox startup to take an extra 10+ seconds. - # - # Test with: drill @127.0.0.53 odo.home.arpa - # TODO: The 127.0.0.1 address should probably be moved to a host-specific file. - networking.extraHosts = '' - 127.0.0.1 ${config.networking.hostName}.home.arpa - 127.0.0.3 metadata.google.internal - 10.216.1.32 homeserver - fdfd:5e8a:ee2d::1:32 homeserver - 10.216.1.6 media - 10.216.1.12 odo - fdfd:5e8a:ee2d::1:2 odo - 10.216.1.14 neelix - 10.216.1.15 quark - fdfd:5e8a:ee2d::1:3 quark - 10.217.1.1 drmario - 10.217.2.1 mrmanager - fdfd:5e8a:ee2d::2:2 mrmanager - 172.16.16.1 unifi - 172.16.16.231 plug1 - 172.16.16.232 plug2 - 172.16.16.233 plug3 - 172.16.16.234 plug4 - 172.16.16.235 temperature1 - 172.16.16.236 temperature2 - 172.16.16.245 turtle - 172.16.16.250 sauna - 172.16.16.251 stream - ''; - - networking.wireless.iwd = { - enable = true; - - settings = { - General = { - EnableNetworkConfiguration = true; - AddressRandomization = "network"; - }; - # Rank = { - # BandModifier2_4GHz = 1.0; - # BandModifier5GHz = 1.0; - # BandModifier6GHz = 1.0; - # }; - DriverQuirks = { - PowerSaveDisable = "*"; - # ath12k_pci - }; - # Scan = { - # DisablePeriodicScan = true; - # DisableRoamingScan = true; - # }; - }; - }; - environment.systemPackages = with pkgs; [ - iw - iwd - ldns # for drill - arp-scan # To find devices on the network - wavemon - dhcpcd # For Android USB tethering. - next_hop - ]; - - boot.extraModprobeConfig = '' - # Set wifi to US - options cfg80211 ieee80211_regdom=US - ''; - - boot.kernel.sysctl = { - # Enable TCP packetization-layer PMTUD when an ICMP black hole is detected. - "net.ipv4.tcp_mtu_probing" = 1; - # Switch to bbr tcp congestion control which should be better on lossy connections like bad wifi. - # We set this in the kernel config, but include this here for unoptimized builds. - "net.ipv4.tcp_congestion_control" = "bbr"; - # Don't do a slow start after a connection has been idle for a single RTO. - "net.ipv4.tcp_slow_start_after_idle" = 0; - # 3x time to accumulate filesystem changes before flushing to disk. - "vm.dirty_writeback_centisecs" = 1500; - # Adjust ttl - "net.ipv4.ip_default_ttl" = 65; - "net.ipv6.conf.all.hop_limit" = 65; - "net.ipv6.conf.default.hop_limit" = 65; - # Enable IPv6 Privacy Extensions - "net.ipv6.conf.all.use_tempaddr" = 2; - # Enable IPv6 Privacy Extensions - # This is enabled by default in nixos. - # "net.ipv6.conf.default.use_tempaddr" = 2; - }; - - environment.persistence."/persist" = lib.mkIf (config.me.mountPersistence) { - hideMounts = true; - directories = [ - "/var/lib/iwd" # Wifi settings - ]; + flavor = lib.mkOption { + type = lib.types.nullOr ( + lib.types.enum [ + "iwd" + "wpa_supplicant" + ] + ); + default = null; + example = "wpa_supplicant"; + description = "What flavor of network to set up."; }; }; + + config = lib.mkIf config.me.network.enable ( + lib.mkMerge [ + (lib.mkIf (config.me.network.flavor == "iwd") { + networking.dhcpcd.enable = lib.mkDefault false; + networking.useDHCP = lib.mkDefault false; + + networking.wireless.iwd = { + enable = true; + + settings = { + General = { + EnableNetworkConfiguration = true; + AddressRandomization = "network"; + }; + # Rank = { + # BandModifier2_4GHz = 1.0; + # BandModifier5GHz = 1.0; + # BandModifier6GHz = 1.0; + # }; + DriverQuirks = { + PowerSaveDisable = "*"; + # ath12k_pci + }; + # Scan = { + # DisablePeriodicScan = true; + # DisableRoamingScan = true; + # }; + }; + }; + + environment.systemPackages = with pkgs; [ + iwd + ]; + + environment.persistence."/persist" = lib.mkIf (config.me.mountPersistence) { + hideMounts = true; + directories = [ + "/var/lib/iwd" # Wifi settings + ]; + }; + }) + (lib.mkIf (config.me.network.flavor == "wpa_supplicant") { + networking.wireless.enable = true; + networking.wireless.userControlled = true; + + networking.dhcpcd.enable = lib.mkDefault true; + networking.useDHCP = lib.mkDefault true; + + networking.wireless.fallbackToWPA2 = false; + networking.wireless.allowAuxiliaryImperativeNetworks = true; + + environment.persistence."/persist" = lib.mkIf (config.me.mountPersistence) { + hideMounts = true; + files = [ + { + # Wifi settings + file = "/etc/wpa_supplicant/imperative.conf"; + # mode = "0664"; + # user = "wpa_supplicant"; + # group = "wpa_supplicant"; + parentDirectory = { + user = "wpa_supplicant"; + group = "wpa_supplicant"; + mode = "0755"; + }; + } + ]; + }; + + # nixpkgs.overlays = [ + # (final: prev: { + # wpa_supplicant = prev.wpa_supplicant.overrideAttrs (oldAttrs: rec { + # extraConfig = oldAttrs.extraConfig + '' + # CONFIG_WEP=y + # ''; + # }); + # }) + # ]; + }) + (lib.mkIf (config.me.network.flavor == "wpa_supplicant" && config.me.graphical) { + environment.systemPackages = with pkgs; [ + wpa_supplicant_gui + ]; + }) + { + networking.nameservers = [ + "9.9.9.10#dns10.quad9.net" + "149.112.112.10#dns10.quad9.net" + "2620:fe::10#dns10.quad9.net" + "2620:fe::fe:10#dns10.quad9.net" + ]; + services.resolved = { + enable = true; + # dnssec = "true"; + settings.Resolve.Domains = [ "~." ]; + settings.Resolve.FallbackDNS = [ ]; + settings.Resolve.DNSOverTLS = "true"; + }; + + # Without this, systemd-resolved will send DNS requests for .home.arpa to the per-link DNS server (172.16.0.1) which does not support DNS-over-TLS. This leads to the connection hanging and timing out. This causes firefox startup to take an extra 10+ seconds. + # + # Test with: drill @127.0.0.53 odo.home.arpa + # TODO: The 127.0.0.1 address should probably be moved to a host-specific file. + networking.extraHosts = '' + 127.0.0.1 ${config.networking.hostName}.home.arpa + 127.0.0.3 metadata.google.internal + 10.216.1.32 homeserver + fdfd:5e8a:ee2d::1:32 homeserver + 10.216.1.6 media + 10.216.1.12 odo + fdfd:5e8a:ee2d::1:2 odo + 10.216.1.14 neelix + 10.216.1.15 quark + fdfd:5e8a:ee2d::1:3 quark + 10.217.1.1 drmario + 10.217.2.1 mrmanager + fdfd:5e8a:ee2d::2:2 mrmanager + 172.16.16.1 unifi + 172.16.16.231 plug1 + 172.16.16.232 plug2 + 172.16.16.233 plug3 + 172.16.16.234 plug4 + 172.16.16.235 temperature1 + 172.16.16.236 temperature2 + 172.16.16.245 turtle + 172.16.16.250 sauna + 172.16.16.251 stream + ''; + + environment.systemPackages = with pkgs; [ + iw + ldns # for drill + arp-scan # To find devices on the network + wavemon + dhcpcd # For Android USB tethering. + next_hop + ]; + + boot.extraModprobeConfig = '' + # Set wifi to US + options cfg80211 ieee80211_regdom=US + ''; + + boot.kernel.sysctl = { + # Enable TCP packetization-layer PMTUD when an ICMP black hole is detected. + "net.ipv4.tcp_mtu_probing" = 1; + # Switch to bbr tcp congestion control which should be better on lossy connections like bad wifi. + # We set this in the kernel config, but include this here for unoptimized builds. + "net.ipv4.tcp_congestion_control" = "bbr"; + # Don't do a slow start after a connection has been idle for a single RTO. + "net.ipv4.tcp_slow_start_after_idle" = 0; + # 3x time to accumulate filesystem changes before flushing to disk. + "vm.dirty_writeback_centisecs" = 1500; + # Adjust ttl + "net.ipv4.ip_default_ttl" = 65; + "net.ipv6.conf.all.hop_limit" = 65; + "net.ipv6.conf.default.hop_limit" = 65; + # Enable IPv6 Privacy Extensions + "net.ipv6.conf.all.use_tempaddr" = 2; + # Enable IPv6 Privacy Extensions + # This is enabled by default in nixos. + # "net.ipv6.conf.default.use_tempaddr" = 2; + }; + } + ] + ); } diff --git a/nix/configuration/roles/user/default.nix b/nix/configuration/roles/user/default.nix index 4d7d45d..9441d65 100644 --- a/nix/configuration/roles/user/default.nix +++ b/nix/configuration/roles/user/default.nix @@ -27,7 +27,10 @@ isNormalUser = true; createHome = true; # https://github.com/NixOS/nixpkgs/issues/6481 group = "talexander"; - extraGroups = [ "wheel" ]; + extraGroups = [ + "wheel" + "wpa_supplicant" + ]; uid = 11235; packages = with pkgs; [ tree