hosts/aubergine/networking/wifi.nix

   1 {
   2   pkgs,
   3   lib,
   4   hostName,
   5   ...
   6 }:
   7 with (import ./names-and-numbers.nix);
   8 with (import ./names-and-numbers.nix.clear);
   9 {
  10   imports = [
  11     ../../../nixos/profiles/networking/wifi.nix
  12   ];
  13   systemd.network.networks = {
  14     "20-${wifiIface}" = {
  15       name = wifiIface;
  16       networkConfig = {
  17         Address = "${wifiIPv4}.1/24";
  18         DHCPServer = true;
  19       };
  20       dhcpServerConfig = {
  21         DNS = "${wifiIPv4}.1";
  22         EmitDNS = true;
  23         PoolOffset = 100;
  24         PoolSize = 20;
  25       };
  26       linkConfig = {
  27         RequiredForOnline = "no";
  28       };
  29       #routes = [
  30       #  {
  31       #    routeConfig = {
  32       #      Destination = "${wifiIPv4}.0/24";
  33       #      # FIXME: Not supported by nixos-23.11
  34       #      #TCPCongestionControlAlgorithm = "westwood";
  35       #    };
  36       #  }
  37       #];
  38     };
  39   };
  40   networking.networkmanager.unmanaged = [ wifiIface ];
  41
  42   networking.nftables.ruleset = lib.mkAfter ''
  43     table inet filter {
  44       chain input {
  45         iifname ${wifiIface} jump input-lan
  46         iifname ${wifiIface} log level warn prefix "input-lan: " counter drop
  47       }
  48       chain output {
  49         oifname ${wifiIface} jump output-lan
  50         oifname ${wifiIface} log level warn prefix "output-lan: " counter drop
  51       }
  52       chain forward-to-wifi {
  53         accept
  54       }
  55       chain forward-from-wifi {
  56         accept
  57       }
  58       chain forward {
  59         iifname { ${eth1Iface}, ${eth2Iface}, ${eth3Iface} } oifname ${wifiIface} goto forward-to-wifi
  60         iifname ${wifiIface} oifname { ${eth1Iface}, ${eth2Iface}, ${eth3Iface} } goto forward-from-wifi
  61       }
  62     }
  63   '';
  64
  65   # iw dev wlp5s0 station dump
  66   # DOC: https://w1.fi/cgit/hostap/plain/hostapd/hostapd.conf
  67   systemd.services.hostapd = {
  68     unitConfig.StartLimitIntervalSec = 5;
  69     serviceConfig.Restart = "always";
  70   };
  71   services.hostapd = {
  72     enable = true;
  73     radios = {
  74       ${wifiIface} = {
  75         band = "2g";
  76         countryCode = "FR";
  77         networks.${wifiIface} = {
  78           ssid = hostName;
  79           #ignoreBroadcastSsid = "clear";
  80           authentication = {
  81             # FIXME: use wpa3-sae
  82             mode = "wpa2-sha256";
  83             #mode = "none";
  84             # FIXME: use wpaPasswordFile or saePasswordsFile
  85             wpaPassword = wpaPassphrase;
  86           };
  87           logLevel = 2;
  88         };
  89         settings = {
  90           disassoc_low_ack = true;
  91         };
  92         wifi4 = {
  93           enable = true;
  94           # See per band "Capabilities:" section in `iw list`
  95           capabilities = [
  96             "DSSS_CCK-40"
  97             "HT40+"
  98             "MAX-AMSDU-3839"
  99             "SHORT-GI-40"
 100           ];
 101           require = false;
 102         };
 103       };
 104     };
 105     /*
 106       extraConfig = ''
 107       # WLAN
 108       beacon_int=100
 109       dtim_period=2 # DTIM (delivery trafic information message)
 110       preamble=1
 111       # limit the frequencies used to those allowed in the country
 112       ieee80211d=1
 113       ignore_broadcast_ssid=1
 114       macaddr_acl=0
 115       # 0 means the AP will search for the channel with the least interferences (ACS)
 116       channel=1
 117
 118       # WPA2
 119       #auth_algs=0 # 0=noauth, 1=wpa, 2=wep, 3=both
 120       wpa_key_mgmt=WPA-PSK
 121       wpa_pairwise=CCMP
 122       rsn_pairwise=CCMP
 123       # QoS support, also required for full speed on 802.11n/ac/ax
 124       wmm_enabled=1
 125       eap_reauth_period=360000
 126       wpa_group_rekey=600
 127       wpa_ptk_rekey=600
 128       wpa_gmk_rekey=86400
 129
 130       # N-WLAN
 131       ieee80211n=1
 132       # See per band "Capabilities:" section in iw list
 133       ht_capab=[HT40+][SHORT-GI-40][MAX-AMSDU-3839][DSSS_CCK-40]
 134       require_ht=1
 135       obss_interval=0
 136
 137       # 802.11ac support
 138       ieee80211ac=0
 139       '';
 140     */
 141   };
 142
 143 }