nyaan: switch to iwd with declarative config

1 files changed, 100 insertions, 39 deletions

diff --git a/hosts/nyaan/network.nix b/hosts/nyaan/network.nix
index ea5c278..703ad5d 100644
--- a/hosts/nyaan/network.nix
+++ b/hosts/nyaan/network.nix
@@ -1,6 +1,81 @@
-{ config, flakeRoot, ... }:
+{
+  config,
+  pkgs,
+  flakeRoot,
+  ...
+}:
 let
+  lib = pkgs.lib;
   secrets = config.sops.secrets;
+
+  networks = {
+    "KopsiNet-5" = {
+      type = "psk";
+      Security.Passphrase = "@KOPSINET_PSK@";
+    };
+    "Pixel_3139" = {
+      type = "psk";
+      Security.Passphrase = "@PHONE_HOTSPOT_PSK@";
+    };
+    "eduroam" = {
+      type = "8021x";
+      Security = {
+        EAP-Method = [
+          "TTLS"
+          "PEAP"
+          "TLS"
+        ];
+        EAP-Identity = "mbastaja@tvz.hr";
+        EAP-AnonymousIdentity = "anonymous@tvz.hr";
+        DomainSuffixMatch = "freeradius.tvz.hr";
+        EAP-TTLS-Phase2-Method = "Tunneled-PAP";
+      };
+    };
+    "Students-TVZ" = {
+      type = "8021x";
+      Secuirty = {
+        EAP-Method = "PAP";
+        EAP-Identity = "mbastaja@tvz.hr";
+        EAP-PEAP-Phase2-Method = "MSCHAPV2";
+        EAP-Password = "@EDUROAM_PASS@";
+      };
+    };
+  };
+
+  generators = lib.generators;
+  networkINIGenerator = generators.toINI {
+    mkKeyValue = generators.mkKeyValueDefault {
+      mkValueString =
+        v:
+        if v == true then
+          "true"
+        else if v == false then
+          "false"
+        else if builtins.isList v then
+          pkgs.lib.strings.concatStringsSep "," v
+        else if builtins.isString v then
+          "${v}"
+        else
+          generators.mkValueStringDefault { } v;
+    } "=";
+  };
+
+  networkTemplates = lib.attrsets.mapAttrs' (
+    k: v:
+    let
+      textContents = networkINIGenerator (builtins.removeAttrs v [ "type" ]);
+      name = "${k}.${v.type}";
+    in
+    {
+      inherit name;
+      value = pkgs.writeTextDir "share/${name}" textContents;
+    }
+  ) networks;
+
+  networkTemplateDir = pkgs.symlinkJoin {
+    name = "iwd-network-templates";
+    paths = builtins.attrValues networkTemplates;
+  };
 in
 {
   imports = [ (flakeRoot + /wireguard.nix) ];
@@ -9,8 +84,6 @@ in
     age.keyFile = "/var/lib/sops-nix/key.txt";
     secrets."wireless.env" = {
       sopsFile = ../../secrets/wireless.env;
-      owner = "wpa_supplicant";
-      group = "wpa_supplicant";
       format = "dotenv";
     };
   };
@@ -64,42 +137,30 @@ in
         '';
       };
     };
-    wireless = {
-      enable = true;
-      secretsFile = secrets."wireless.env".path;
-      userControlled = true;
-      networks = {
-        "KopsiNet-5".pskRaw = "ext:kopsinet_psk";
-        "Pixel_3139" = {
-          pskRaw = "ext:phone_hotspot_psk";
-        };
-        "eduroam" = {
-          authProtocols = [ "WPA-EAP" ];
-          auth = ''
-            pairwise=CCMP TKIP
-            eap=TTLS PEAP TLS
-            group=CCMP TKIP
-            identity="mbastaja@tvz.hr"
-            altsubject_match="DNS:freeradius.tvz.hr"
-            phase1="peaplabel=0"
-            phase2="auth=PAP"
-            password="ext:eduroam_pass"
-            anonymous_identity="anonymous@tvz.hr"
-          '';
-        };
-        "Students-TVZ" = {
-          authProtocols = [ "WPA-EAP" ];
-          auth = ''
-            pairwise=CCMP TKIP
-            eap=PEAP
-            group=CCMP TKIP
-            identity="mbastaja@tvz.hr"
-            phase1="peaplabel=0"
-            phase2="auth=MSCHAPV2"
-            password="ext:eduroam_pass"
-          '';
-        };
-      };
+  };
+
+  networking.wireless.iwd.enable = true;
+  systemd.services."prepopulate-iwd-netowks" = {
+    enable = true;
+    enableStrictShellChecks = true;
+    description = "Pre-populates network configs for iwd";
+    before = [ "iwd.service" ];
+    wantedBy = [ "iwd.service" ];
+
+    serviceConfig = {
+      EnvironmentFile = "${secrets."wireless.env".path}";
     };
+
+    path = [ pkgs.envsubst ];
+    script = ''
+      rm -r /var/lib/iwd
+      mkdir -p /var/lib/iwd
+
+      for f in ${networkTemplateDir}/share/*; do
+        cat "$f" |
+          sed -E 's/@([A-Za-z_][A-Za-z0-9_]*)@/$\{\1}/g' |
+          envsubst > "/var/lib/iwd/$(basename "$f")"
+      done
+    '';
   };
 }