From 4cb52f325e5b2025ff6ae19b1185f9b50218a5d5 Mon Sep 17 00:00:00 2001 From: Isabella Bastaja Date: Sun, 7 Jun 2026 19:34:38 +0200 Subject: nyaan: switch to iwd with declarative config --- hosts/nyaan/default.nix | 1 + hosts/nyaan/network.nix | 139 ++++++++++++++++++++++++++++++++++-------------- secrets/wireless.env | 7 ++- 3 files changed, 106 insertions(+), 41 deletions(-) diff --git a/hosts/nyaan/default.nix b/hosts/nyaan/default.nix index 67de583..2b670d2 100644 --- a/hosts/nyaan/default.nix +++ b/hosts/nyaan/default.nix @@ -108,6 +108,7 @@ "network" "podman" ]; + initialPassword = "waow"; uid = 1000; }; }; diff --git a/hosts/nyaan/network.nix b/hosts/nyaan/network.nix index ea5c278..703ad5d 100644 --- a/hosts/nyaan/network.nix +++ b/hosts/nyaan/network.nix @@ -1,6 +1,81 @@ -{ config, flakeRoot, ... }: +{ + config, + pkgs, + flakeRoot, + ... +}: let + lib = pkgs.lib; secrets = config.sops.secrets; + + networks = { + "KopsiNet-5" = { + type = "psk"; + Security.Passphrase = "@KOPSINET_PSK@"; + }; + "Pixel_3139" = { + type = "psk"; + Security.Passphrase = "@PHONE_HOTSPOT_PSK@"; + }; + "eduroam" = { + type = "8021x"; + Security = { + EAP-Method = [ + "TTLS" + "PEAP" + "TLS" + ]; + EAP-Identity = "mbastaja@tvz.hr"; + EAP-AnonymousIdentity = "anonymous@tvz.hr"; + DomainSuffixMatch = "freeradius.tvz.hr"; + EAP-TTLS-Phase2-Method = "Tunneled-PAP"; + }; + }; + "Students-TVZ" = { + type = "8021x"; + Secuirty = { + EAP-Method = "PAP"; + EAP-Identity = "mbastaja@tvz.hr"; + EAP-PEAP-Phase2-Method = "MSCHAPV2"; + EAP-Password = "@EDUROAM_PASS@"; + }; + }; + }; + + generators = lib.generators; + networkINIGenerator = generators.toINI { + mkKeyValue = generators.mkKeyValueDefault { + mkValueString = + v: + if v == true then + "true" + else if v == false then + "false" + else if builtins.isList v then + pkgs.lib.strings.concatStringsSep "," v + else if builtins.isString v then + "${v}" + else + generators.mkValueStringDefault { } v; + } "="; + }; + + networkTemplates = lib.attrsets.mapAttrs' ( + k: v: + let + textContents = networkINIGenerator (builtins.removeAttrs v [ "type" ]); + name = "${k}.${v.type}"; + in + { + inherit name; + value = pkgs.writeTextDir "share/${name}" textContents; + } + ) networks; + + networkTemplateDir = pkgs.symlinkJoin { + name = "iwd-network-templates"; + paths = builtins.attrValues networkTemplates; + }; in { imports = [ (flakeRoot + /wireguard.nix) ]; @@ -9,8 +84,6 @@ in age.keyFile = "/var/lib/sops-nix/key.txt"; secrets."wireless.env" = { sopsFile = ../../secrets/wireless.env; - owner = "wpa_supplicant"; - group = "wpa_supplicant"; format = "dotenv"; }; }; @@ -64,42 +137,30 @@ in ''; }; }; - wireless = { - enable = true; - secretsFile = secrets."wireless.env".path; - userControlled = true; - networks = { - "KopsiNet-5".pskRaw = "ext:kopsinet_psk"; - "Pixel_3139" = { - pskRaw = "ext:phone_hotspot_psk"; - }; - "eduroam" = { - authProtocols = [ "WPA-EAP" ]; - auth = '' - pairwise=CCMP TKIP - eap=TTLS PEAP TLS - group=CCMP TKIP - identity="mbastaja@tvz.hr" - altsubject_match="DNS:freeradius.tvz.hr" - phase1="peaplabel=0" - phase2="auth=PAP" - password="ext:eduroam_pass" - anonymous_identity="anonymous@tvz.hr" - ''; - }; - "Students-TVZ" = { - authProtocols = [ "WPA-EAP" ]; - auth = '' - pairwise=CCMP TKIP - eap=PEAP - group=CCMP TKIP - identity="mbastaja@tvz.hr" - phase1="peaplabel=0" - phase2="auth=MSCHAPV2" - password="ext:eduroam_pass" - ''; - }; - }; + }; + + networking.wireless.iwd.enable = true; + systemd.services."prepopulate-iwd-netowks" = { + enable = true; + enableStrictShellChecks = true; + description = "Pre-populates network configs for iwd"; + before = [ "iwd.service" ]; + wantedBy = [ "iwd.service" ]; + + serviceConfig = { + EnvironmentFile = "${secrets."wireless.env".path}"; }; + + path = [ pkgs.envsubst ]; + script = '' + rm -r /var/lib/iwd + mkdir -p /var/lib/iwd + + for f in ${networkTemplateDir}/share/*; do + cat "$f" | + sed -E 's/@([A-Za-z_][A-Za-z0-9_]*)@/$\{\1}/g' | + envsubst > "/var/lib/iwd/$(basename "$f")" + done + ''; }; } diff --git a/secrets/wireless.env b/secrets/wireless.env index e5fdb06..e4b1b7f 100644 --- a/secrets/wireless.env +++ b/secrets/wireless.env @@ -1,6 +1,9 @@ kopsinet_psk=ENC[AES256_GCM,data:f/iEwzRmGDs2,iv:xeMGBa1/IqbCQXfTeJy+3SM3kYmEn3rXPOjcbFoeAQw=,tag:VtmskqeCq2FK1BYCZw7KhA==,type:str] phone_hotspot_psk=ENC[AES256_GCM,data:5ObnVP5gJnYZ3wf992Z6,iv:jYI20suGpLb6SW3+YA5hW6ericlVBBgobk78Hwq6Gfc=,tag:A30jiTrvFYqbDvCBsXqdsw==,type:str] eduroam_pass=ENC[AES256_GCM,data:w2SckV1rLNM=,iv:TWkHKh2t20kdhjNpPMFfJ+bsDU53QxxtW0nWCltTzvo=,tag:jFMyrwVbJvLLHCfdmRzX+Q==,type:str] +KOPSINET_PSK=ENC[AES256_GCM,data:MS9p5rN5M1bb,iv:2aZQQK8v6gakf27ERdJgYCzsrnGTlqY0nojMuFW0Sco=,tag:WRZeNyF7yumZkFQswxKILw==,type:str] +PHONE_HOTSPOT_PSK=ENC[AES256_GCM,data:d/XtulKcvRnHxncORRsk,iv:Udjc/XTCXT049IpRRj5GijWRyVJEfDsF1w282gJQKLI=,tag:bV/VqNv2CYBhWm1EoRHiHQ==,type:str] +EDUROAM_PASS=ENC[AES256_GCM,data:/231WsDzN10=,iv:C6vEX9QL8H/pgOhwCALw0cDi8Nq6fsWXKcKTpkBAemY=,tag:5JMTWoV43vqE3J+vN8rMHg==,type:str] sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2WHpJUEtJdHFiVEdiMlNz\nZmYwdGtxZmRJZlpab1dVNEw2ZldvVHhaMlNnCkJnYmkxSEJLY1JBZFNPcVpGNyt4\nbjJ3dVFhcjdhWkVJVHNaWWorRldZK0kKLS0tIEVTMlo2Qjg2M29PMEtrMEZGRGkx\ncmdxMWtjT09DQktQaVFQZXF3Wm5KbXcKtDK2i2AtzqOXPbiO1EW4e+ZzgKYD9SsE\nq4AKu2VQZaTw3Ex+66k7geso9A7LCp2T++/z2FgfGxpUYJW9nhnesQ==\n-----END AGE ENCRYPTED FILE-----\n sops_age__list_0__map_recipient=age1l088h7umwuxp0sw8wk0stfup0empdnldczxvrhueu7n0vxd0c57q9zvwsk sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMUDhGVmUxbUJEaXgwcnQr\nNkRQTW1jSW4yWHU2MFBMelhNTnhLSG5TNjNnCkhlWHAxSThhOGN2RFEyWVcvYlN4\nbWlHdEhoTWNGNEVWQ0xGYytoWEI5QzQKLS0tIE5oVDBESndYQkFQTW5qMW1tQ2pv\nbElLRFVvSVozaXp0K1ZpR2x5UnZFR3cK92cYZrUzqtBH8JiS0u+MiCbcxtfSaYqQ\nZUCKHv5TX0Ck5mj+P+jHIUQtP+tM55DFO01C3OaaMl7LqGJD10g5Xw==\n-----END AGE ENCRYPTED FILE-----\n @@ -9,7 +12,7 @@ sops_age__list_2__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb2 sops_age__list_2__map_recipient=age1jmpdssn7555g0pht7zwqq2dvrvzxyu65w6cf2su8pp2fz0zvaykq0jgern sops_age__list_3__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvNGZuWjVtbUpYS1RIbVNN\nSUdNb3lFYXBSZW5zRklQeTVqTTFxcUFVQkY4ClNZQlVKaGxiTUk5OFA1RnprVGtN\nUjhEY3A4UGdZcjdsekh0Q29BVnhBZmMKLS0tIDFzY1MyTUV2dThUS3RpOU41WXVl\nMTg1OXNLSk53c2F6NEU2a0crYlltSzAK+Ur555UsinV368DYgSeJvyU+ZZ0Qi3+w\n1zAi3buJ+P+wbf/j1Tuit1YkJdp3N4w5MilDdxc0laD+7/PSReAYZQ==\n-----END AGE ENCRYPTED FILE-----\n sops_age__list_3__map_recipient=age1sffhunmeqmeey29lnvuds59mn74jfpctd3wm0t6svca0fztgvd4qnretc6 -sops_lastmodified=2026-05-23T20:48:56Z -sops_mac=ENC[AES256_GCM,data:eZIlr8kRPC/HOWRrXc2o1uv8WrZkUZV2eVOioAjPecXukxLKajMTHsRIaNICce579RIeMAZwBk2lpXcYru+J4xxAR86oBvloy6BVhbz7oAKzHIzaLZSBjkdFyKv80o21yas64w6M5p1lyJTpmmaoYxjDeFLKd8SgTwi3un/HuIg=,iv:jCNCgWHeoXsw68X/aQWAGeaAsS2gnHhmFP0XMsdq0Z0=,tag:9PHtYfdKGINEdM3o8Togfw==,type:str] +sops_lastmodified=2026-06-07T23:22:17Z +sops_mac=ENC[AES256_GCM,data:NZK9QJF2YY4UvSpTKN/+wqaPRYuFeQ/wXoaGRv84GjCKiS1/zXRZmTbM+dVqUlfzeNI0jUrGFML6mcSzGo5yJDyW9L/kc5dAiFRJoG4ipL0p2GsJ9t7n5yJlwNbZc3Kt8ZDM3Lf/M+Y3c+4s6ix0CgPWSEN+D97f+mv9aTzNUjE=,iv:2lWB/cyoPa/cyqhCXuHjlWqC0QQ+VeUNhcgchPjUDh0=,tag:wcow3LtxQ9wKRm0tv2w7hw==,type:str] sops_unencrypted_suffix=_unencrypted sops_version=3.13.1 -- cgit v1.3.1