mirror of
https://github.com/Misterio77/Foundry.git
synced 2026-08-28 02:24:12 -05:00
Gabriel Fontes
c19ed9a3a7
Its control socket never gets ctrl_interface_group applied (upstream never copies the field when creating the P2P device), so with the daemon running as root the socket is root-only. wpa_gui scans the directory, hits p2p-dev-* first and gives up before reaching the real interface. Assisted-by: pi (claude-opus-5)
66 lines
1.9 KiB
Nix
66 lines
1.9 KiB
Nix
{config, ...}: {
|
|
sops.secrets.wireless = {
|
|
sopsFile = ./secrets.yaml;
|
|
owner = config.users.users.wpa_supplicant.name;
|
|
group = config.users.users.wpa_supplicant.group;
|
|
};
|
|
|
|
networking.wireless = {
|
|
enable = true;
|
|
fallbackToWPA2 = false;
|
|
# The sandbox binds secretsFile into the unit's namespace, so a secret that
|
|
# can't be decrypted kills the daemon (and the control socket needed to
|
|
# connect by hand and fix it). Also breaks wpa_gui.
|
|
enableHardening = false;
|
|
# The P2P device's control socket never gets ctrl_interface_group applied
|
|
# (upstream doesn't copy the field when creating that interface), so with
|
|
# the daemon running as root it ends up root-only. wpa_gui scans the socket
|
|
# directory, hits p2p-dev-* first and gives up before reaching the real
|
|
# interface. We don't use Wi-Fi Direct anyway.
|
|
extraConfig = "p2p_disabled=1";
|
|
# Declarative
|
|
secretsFile = config.sops.secrets.wireless.path;
|
|
networks = {
|
|
"CAT_HOUSE" = {
|
|
pskRaw = "ext:cat_house";
|
|
};
|
|
"Marcos_2.4Ghz" = {
|
|
pskRaw = "ext:marcos_24";
|
|
};
|
|
"Marcos_5Ghz" = {
|
|
pskRaw = "ext:marcos_50";
|
|
};
|
|
"Misterio" = {
|
|
pskRaw = "ext:misterio";
|
|
authProtocols = ["WPA-PSK"];
|
|
# extraConfig = ''
|
|
# mesh_fwding=1
|
|
# '';
|
|
};
|
|
"VIVOFIBRA-FC41-5G" = {
|
|
pskRaw = "ext:marcos_santos_5g";
|
|
};
|
|
"Nijland" = {
|
|
pskRaw = "ext:nijland";
|
|
};
|
|
"eduroam" = {
|
|
authProtocols = ["WPA-EAP"];
|
|
auth = ''
|
|
pairwise=CCMP
|
|
group=CCMP TKIP
|
|
eap=TTLS
|
|
domain_suffix_match="semfio.usp.br"
|
|
ca_cert="${./eduroam-cert.pem}"
|
|
identity="10856803@usp.br"
|
|
password=ext:eduroam
|
|
phase2="auth=MSCHAPV2"
|
|
'';
|
|
};
|
|
};
|
|
|
|
# Imperative
|
|
allowAuxiliaryImperativeNetworks = true;
|
|
userControlled = true;
|
|
};
|
|
}
|