hosts/aubergine/networking/wifi.nix

   1 { pkgs, lib, hostName, ... }:
   2 with (import ./names-and-numbers.nix);
   3 with (import ./names-and-numbers.nix.clear);
   4 {
   5   imports = [
   6     ../../../nixos/profiles/networking/wifi.nix
   7   ];
   8   systemd.network.networks = {
   9     "20-${wifiIface}" = {
  10       name = wifiIface;
  11       networkConfig = {
  12         Address = "${wifiIPv4}.1/24";
  13         DHCPServer = true;
  14       };
  15       dhcpServerConfig = {
  16         DNS = "${wifiIPv4}.1";
  17         EmitDNS = true;
  18         PoolOffset = 100;
  19         PoolSize = 20;
  20       };
  21       linkConfig = {
  22         RequiredForOnline = "no";
  23       };
  24       #routes = [
  25       #  {
  26       #    routeConfig = {
  27       #      Destination = "${wifiIPv4}.0/24";
  28       #      # FIXME: Not supported by nixos-23.11
  29       #      #TCPCongestionControlAlgorithm = "westwood";
  30       #    };
  31       #  }
  32       #];
  33     };
  34   };
  35   networking.networkmanager.unmanaged = [ wifiIface ];
  36
  37   networking.nftables.ruleset = lib.mkAfter ''
  38     table inet filter {
  39       chain input {
  40         iifname ${wifiIface} jump input-lan
  41         iifname ${wifiIface} log level warn prefix "input-lan: " counter drop
  42       }
  43       chain output {
  44         oifname ${wifiIface} jump output-lan
  45         oifname ${wifiIface} log level warn prefix "output-lan: " counter drop
  46       }
  47       chain forward-to-wifi {
  48         accept
  49       }
  50       chain forward-from-wifi {
  51         accept
  52       }
  53       chain forward {
  54         iifname { ${eth1Iface}, ${eth2Iface}, ${eth3Iface} } oifname ${wifiIface} goto forward-to-wifi
  55         iifname ${wifiIface} oifname { ${eth1Iface}, ${eth2Iface}, ${eth3Iface} } goto forward-from-wifi
  56       }
  57     }
  58   '';
  59
  60   # iw dev wlp5s0 station dump
  61   # DOC: https://w1.fi/cgit/hostap/plain/hostapd/hostapd.conf
  62   systemd.services.hostapd = {
  63     unitConfig.StartLimitIntervalSec = 5;
  64     serviceConfig.Restart = "always";
  65   };
  66   services.hostapd = {
  67     enable = true;
  68     radios = {
  69       ${wifiIface} = {
  70         band = "2g";
  71         countryCode = "FR";
  72         networks.${wifiIface} = {
  73           ssid = hostName;
  74           ignoreBroadcastSsid = "empty";
  75           authentication = {
  76             # FIXME: use wpa3-sae
  77             mode = "wpa2-sha256";
  78             # FIXME: use wpaPasswordFile or saePasswordsFile
  79             wpaPassword = wpaPassphrase;
  80           };
  81           logLevel = 2;
  82         };
  83         settings = {
  84           disassoc_low_ack = true;
  85         };
  86         wifi4 = {
  87           enable = true;
  88           # See per band "Capabilities:" section in `iw list`
  89           capabilities = [
  90             "DSSS_CCK-40"
  91             "HT40+"
  92             "MAX-AMSDU-3839"
  93             "SHORT-GI-40"
  94           ];
  95           require = false;
  96         };
  97       };
  98     };
  99     /*
 100       extraConfig = ''
 101       # WLAN
 102       beacon_int=100
 103       dtim_period=2 # DTIM (delivery trafic information message)
 104       preamble=1
 105       # limit the frequencies used to those allowed in the country
 106       ieee80211d=1
 107       ignore_broadcast_ssid=1
 108       macaddr_acl=0
 109       # 0 means the AP will search for the channel with the least interferences (ACS)
 110       channel=1
 111
 112       # WPA2
 113       #auth_algs=0 # 0=noauth, 1=wpa, 2=wep, 3=both
 114       wpa_key_mgmt=WPA-PSK
 115       wpa_pairwise=CCMP
 116       rsn_pairwise=CCMP
 117       # QoS support, also required for full speed on 802.11n/ac/ax
 118       wmm_enabled=1
 119       eap_reauth_period=360000
 120       wpa_group_rekey=600
 121       wpa_ptk_rekey=600
 122       wpa_gmk_rekey=86400
 123
 124       # N-WLAN
 125       ieee80211n=1
 126       # See per band "Capabilities:" section in iw list
 127       ht_capab=[HT40+][SHORT-GI-40][MAX-AMSDU-3839][DSSS_CCK-40]
 128       require_ht=1
 129       obss_interval=0
 130
 131       # 802.11ac support
 132       ieee80211ac=0
 133       '';
 134     */
 135   };
 136
 137 }