Add support for wpa_supplicant-based networking.

This is to experiment with T-DLS for better moonlight streaming.

nix/configuration/configuration.nix

@@ -281,6 +281,7 @@ in
         (disableOptimizationsPython3 "zopfli") # /nix/store/idjhlmljrapzm3i1svl5x9mdwfxxj51v-pytest-check-hook/nix-support/setup-hook: line 23:   280 Segmentation fault         (core dumped) /nix/store/87l6i0czch42nzv39ydwld5hnhcq0b65-python3-3.14.7/bin/python3.14 "${flagsArray[@]}"
         (disableOptimizations "zopfli")
         (disableOptimizations "nototools") # Needs to use the same version of python as the zopfli package
+        (disableOptimizations "lib2geom") # Tests failing: ellipse-test, elliptical-arc-test, line-test, polynomial-test
       ];
 
     hardware.firmware =

nix/configuration/hosts/neelix/default.nix

@@ -52,6 +52,7 @@
     me.lvfs.enable = true;
     me.memtest.enable = true;
     me.network.enable = true;
+    me.network.flavor = "iwd";
     me.nvme.enable = true;
     me.sound.enable = true;
     me.ssh.enable = true;

nix/configuration/hosts/odo/default.nix

@@ -121,6 +121,7 @@
     me.mitmproxy.enable = true;
     me.moonlight.enable = true;
     me.network.enable = true;
+    me.network.flavor = "iwd";
     me.nix_index.enable = true;
     me.nix_repl.enable = true;
     me.nixdev.enable = true;

nix/configuration/hosts/odowork/default.nix

@@ -118,6 +118,7 @@
     me.media.enable = true;
     me.memtest.enable = true;
     me.network.enable = true;
+    me.network.flavor = "iwd";
     me.nix_index.enable = true;
     me.nix_repl.enable = true;
     me.nixdev.enable = true;

nix/configuration/hosts/quark/default.nix

@@ -113,6 +113,7 @@
     me.memtest.enable = true;
     me.mitmproxy.enable = true;
     me.network.enable = true;
+    me.network.flavor = "iwd";
     me.nix_index.enable = true;
     me.nix_repl.enable = true;
     me.nix_worker.enable = true;

nix/configuration/roles/minimal_base/default.nix

@@ -21,6 +21,7 @@
     me.doas.enable = true;
     me.kernel.enable = true;
     me.network.enable = true;
+    me.network.flavor = "iwd";
     me.nvme.enable = true;
     me.ssh.enable = true;
     me.sshd.enable = true;

nix/configuration/roles/network/default.nix

@@ -32,126 +32,190 @@ in
 {
   imports = [ ];
 
-  options.me = {
+  options.me.network = {
-    network.enable = lib.mkOption {
+    enable = lib.mkOption {
       type = lib.types.bool;
       default = false;
       example = true;
       description = "Whether we want to install network.";
     };
-  };
+    flavor = lib.mkOption {
-
+      type = lib.types.nullOr (
-  config = lib.mkIf config.me.network.enable {
+        lib.types.enum [
-    networking.dhcpcd.enable = lib.mkDefault false;
+          "iwd"
-    networking.useDHCP = lib.mkDefault false;
+          "wpa_supplicant"
-    networking.nameservers = [
+        ]
-      "9.9.9.10#dns10.quad9.net"
+      );
-      "149.112.112.10#dns10.quad9.net"
+      default = null;
-      "2620:fe::10#dns10.quad9.net"
+      example = "wpa_supplicant";
-      "2620:fe::fe:10#dns10.quad9.net"
+      description = "What flavor of network to set up.";
-    ];
-    services.resolved = {
-      enable = true;
-      # dnssec = "true";
-      settings.Resolve.Domains = [ "~." ];
-      settings.Resolve.FallbackDNS = [ ];
-      settings.Resolve.DNSOverTLS = "true";
-    };
-
-    # Without this, systemd-resolved will send DNS requests for <X>.home.arpa to the per-link DNS server (172.16.0.1) which does not support DNS-over-TLS. This leads to the connection hanging and timing out. This causes firefox startup to take an extra 10+ seconds.
-    #
-    # Test with: drill @127.0.0.53 odo.home.arpa
-    # TODO: The 127.0.0.1 address should probably be moved to a host-specific file.
-    networking.extraHosts = ''
-      127.0.0.1 ${config.networking.hostName}.home.arpa
-      127.0.0.3 metadata.google.internal
-      10.216.1.32		homeserver
-      fdfd:5e8a:ee2d::1:32	homeserver
-      10.216.1.6		media
-      10.216.1.12		odo
-      fdfd:5e8a:ee2d::1:2	odo
-      10.216.1.14		neelix
-      10.216.1.15		quark
-      fdfd:5e8a:ee2d::1:3	quark
-      10.217.1.1		drmario
-      10.217.2.1		mrmanager
-      fdfd:5e8a:ee2d::2:2 mrmanager
-      172.16.16.1		unifi
-      172.16.16.231		plug1
-      172.16.16.232		plug2
-      172.16.16.233		plug3
-      172.16.16.234		plug4
-      172.16.16.235		temperature1
-      172.16.16.236		temperature2
-      172.16.16.245		turtle
-      172.16.16.250		sauna
-      172.16.16.251		stream
-    '';
-
-    networking.wireless.iwd = {
-      enable = true;
-
-      settings = {
-        General = {
-          EnableNetworkConfiguration = true;
-          AddressRandomization = "network";
-        };
-        # Rank = {
-        #   BandModifier2_4GHz = 1.0;
-        #   BandModifier5GHz = 1.0;
-        #   BandModifier6GHz = 1.0;
-        # };
-        DriverQuirks = {
-          PowerSaveDisable = "*";
-          # ath12k_pci
-        };
-        # Scan = {
-        #   DisablePeriodicScan = true;
-        #   DisableRoamingScan = true;
-        # };
-      };
-    };
-    environment.systemPackages = with pkgs; [
-      iw
-      iwd
-      ldns # for drill
-      arp-scan # To find devices on the network
-      wavemon
-      dhcpcd # For Android USB tethering.
-      next_hop
-    ];
-
-    boot.extraModprobeConfig = ''
-      # Set wifi to US
-      options cfg80211 ieee80211_regdom=US
-    '';
-
-    boot.kernel.sysctl = {
-      # Enable TCP packetization-layer PMTUD when an ICMP black hole is detected.
-      "net.ipv4.tcp_mtu_probing" = 1;
-      # Switch to bbr tcp congestion control which should be better on lossy connections like bad wifi.
-      # We set this in the kernel config, but include this here for unoptimized builds.
-      "net.ipv4.tcp_congestion_control" = "bbr";
-      # Don't do a slow start after a connection has been idle for a single RTO.
-      "net.ipv4.tcp_slow_start_after_idle" = 0;
-      # 3x time to accumulate filesystem changes before flushing to disk.
-      "vm.dirty_writeback_centisecs" = 1500;
-      # Adjust ttl
-      "net.ipv4.ip_default_ttl" = 65;
-      "net.ipv6.conf.all.hop_limit" = 65;
-      "net.ipv6.conf.default.hop_limit" = 65;
-      # Enable IPv6 Privacy Extensions
-      "net.ipv6.conf.all.use_tempaddr" = 2;
-      # Enable IPv6 Privacy Extensions
-      # This is enabled by default in nixos.
-      # "net.ipv6.conf.default.use_tempaddr" = 2;
-    };
-
-    environment.persistence."/persist" = lib.mkIf (config.me.mountPersistence) {
-      hideMounts = true;
-      directories = [
-        "/var/lib/iwd" # Wifi settings
-      ];
     };
   };
+
+  config = lib.mkIf config.me.network.enable (
+    lib.mkMerge [
+      (lib.mkIf (config.me.network.flavor == "iwd") {
+        networking.dhcpcd.enable = lib.mkDefault false;
+        networking.useDHCP = lib.mkDefault false;
+
+        networking.wireless.iwd = {
+          enable = true;
+
+          settings = {
+            General = {
+              EnableNetworkConfiguration = true;
+              AddressRandomization = "network";
+            };
+            # Rank = {
+            #   BandModifier2_4GHz = 1.0;
+            #   BandModifier5GHz = 1.0;
+            #   BandModifier6GHz = 1.0;
+            # };
+            DriverQuirks = {
+              PowerSaveDisable = "*";
+              # ath12k_pci
+            };
+            # Scan = {
+            #   DisablePeriodicScan = true;
+            #   DisableRoamingScan = true;
+            # };
+          };
+        };
+
+        environment.systemPackages = with pkgs; [
+          iwd
+        ];
+
+        environment.persistence."/persist" = lib.mkIf (config.me.mountPersistence) {
+          hideMounts = true;
+          directories = [
+            "/var/lib/iwd" # Wifi settings
+          ];
+        };
+      })
+      (lib.mkIf (config.me.network.flavor == "wpa_supplicant") {
+        networking.wireless.enable = true;
+        networking.wireless.userControlled = true;
+
+        networking.dhcpcd.enable = lib.mkDefault true;
+        networking.useDHCP = lib.mkDefault true;
+
+        networking.wireless.fallbackToWPA2 = false;
+        networking.wireless.allowAuxiliaryImperativeNetworks = true;
+
+        environment.persistence."/persist" = lib.mkIf (config.me.mountPersistence) {
+          hideMounts = true;
+          files = [
+            {
+              # Wifi settings
+              file = "/etc/wpa_supplicant/imperative.conf";
+              # mode = "0664";
+              # user = "wpa_supplicant";
+              # group = "wpa_supplicant";
+              parentDirectory = {
+                user = "wpa_supplicant";
+                group = "wpa_supplicant";
+                mode = "0755";
+              };
+            }
+          ];
+        };
+
+        # nixpkgs.overlays = [
+        #   (final: prev: {
+        #     wpa_supplicant = prev.wpa_supplicant.overrideAttrs (oldAttrs: rec {
+        #       extraConfig = oldAttrs.extraConfig + ''
+        #         	      CONFIG_WEP=y
+        #         	    '';
+        #     });
+        #   })
+        # ];
+      })
+      (lib.mkIf (config.me.network.flavor == "wpa_supplicant" && config.me.graphical) {
+        environment.systemPackages = with pkgs; [
+          wpa_supplicant_gui
+        ];
+      })
+      {
+        networking.nameservers = [
+          "9.9.9.10#dns10.quad9.net"
+          "149.112.112.10#dns10.quad9.net"
+          "2620:fe::10#dns10.quad9.net"
+          "2620:fe::fe:10#dns10.quad9.net"
+        ];
+        services.resolved = {
+          enable = true;
+          # dnssec = "true";
+          settings.Resolve.Domains = [ "~." ];
+          settings.Resolve.FallbackDNS = [ ];
+          settings.Resolve.DNSOverTLS = "true";
+        };
+
+        # Without this, systemd-resolved will send DNS requests for <X>.home.arpa to the per-link DNS server (172.16.0.1) which does not support DNS-over-TLS. This leads to the connection hanging and timing out. This causes firefox startup to take an extra 10+ seconds.
+        #
+        # Test with: drill @127.0.0.53 odo.home.arpa
+        # TODO: The 127.0.0.1 address should probably be moved to a host-specific file.
+        networking.extraHosts = ''
+          127.0.0.1 ${config.networking.hostName}.home.arpa
+          127.0.0.3 metadata.google.internal
+          10.216.1.32		homeserver
+          fdfd:5e8a:ee2d::1:32	homeserver
+          10.216.1.6		media
+          10.216.1.12		odo
+          fdfd:5e8a:ee2d::1:2	odo
+          10.216.1.14		neelix
+          10.216.1.15		quark
+          fdfd:5e8a:ee2d::1:3	quark
+          10.217.1.1		drmario
+          10.217.2.1		mrmanager
+          fdfd:5e8a:ee2d::2:2 mrmanager
+          172.16.16.1		unifi
+          172.16.16.231		plug1
+          172.16.16.232		plug2
+          172.16.16.233		plug3
+          172.16.16.234		plug4
+          172.16.16.235		temperature1
+          172.16.16.236		temperature2
+          172.16.16.245		turtle
+          172.16.16.250		sauna
+          172.16.16.251		stream
+        '';
+
+        environment.systemPackages = with pkgs; [
+          iw
+          ldns # for drill
+          arp-scan # To find devices on the network
+          wavemon
+          dhcpcd # For Android USB tethering.
+          next_hop
+        ];
+
+        boot.extraModprobeConfig = ''
+          # Set wifi to US
+          options cfg80211 ieee80211_regdom=US
+        '';
+
+        boot.kernel.sysctl = {
+          # Enable TCP packetization-layer PMTUD when an ICMP black hole is detected.
+          "net.ipv4.tcp_mtu_probing" = 1;
+          # Switch to bbr tcp congestion control which should be better on lossy connections like bad wifi.
+          # We set this in the kernel config, but include this here for unoptimized builds.
+          "net.ipv4.tcp_congestion_control" = "bbr";
+          # Don't do a slow start after a connection has been idle for a single RTO.
+          "net.ipv4.tcp_slow_start_after_idle" = 0;
+          # 3x time to accumulate filesystem changes before flushing to disk.
+          "vm.dirty_writeback_centisecs" = 1500;
+          # Adjust ttl
+          "net.ipv4.ip_default_ttl" = 65;
+          "net.ipv6.conf.all.hop_limit" = 65;
+          "net.ipv6.conf.default.hop_limit" = 65;
+          # Enable IPv6 Privacy Extensions
+          "net.ipv6.conf.all.use_tempaddr" = 2;
+          # Enable IPv6 Privacy Extensions
+          # This is enabled by default in nixos.
+          # "net.ipv6.conf.default.use_tempaddr" = 2;
+        };
+      }
+    ]
+  );
 }

nix/configuration/roles/user/default.nix

@@ -27,7 +27,10 @@
       isNormalUser = true;
       createHome = true; # https://github.com/NixOS/nixpkgs/issues/6481
       group = "talexander";
-      extraGroups = [ "wheel" ];
+      extraGroups = [
+        "wheel"
+        "wpa_supplicant"
+      ];
       uid = 11235;
       packages = with pkgs; [
         tree