From fc9ab65dd141543756f36e9180835afdd4404494 Mon Sep 17 00:00:00 2001
From: Gabriel Fontes <hi@m7.rs>
Date: Thu, 13 Aug 2026 15:56:38 -0300
Subject: [PATCH] fix(hosts/wireless): disable wpa_supplicant hardening

The sandbox binds secretsFile into the unit's namespace, so a secret that
can't be decrypted kills the daemon along with the control socket needed to
connect by hand and fix it. It also breaks wpa_gui (nixpkgs#475438).

Tradeoff: the daemon runs as root again, as it does on most distros.

Assisted-by: pi (claude-opus-5)
---
 hosts/wireless.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hosts/wireless.nix b/hosts/wireless.nix
index 87a3caaa..d77b53b1 100644
--- a/hosts/wireless.nix
+++ b/hosts/wireless.nix
@@ -8,6 +8,10 @@
   networking.wireless = {
     enable = true;
     fallbackToWPA2 = false;
+    # The sandbox binds secretsFile into the unit's namespace, so a secret that
+    # can't be decrypted kills the daemon (and the control socket needed to
+    # connect by hand and fix it). Also breaks wpa_gui.
+    enableHardening = false;
     # Declarative
     secretsFile = config.sops.secrets.wireless.path;
     networks = {