refactor network config, add wireguard connection to vps

6 files changed, 100 insertions, 95 deletions

diff --git a/modules/system/nixos/networking/default.nix b/modules/system/nixos/networking/default.nix
index f063036..04cd1c3 100644
--- a/modules/system/nixos/networking/default.nix
+++ b/modules/system/nixos/networking/default.nix
@@ -1,14 +1,22 @@
 {
   imports = [
-    ./iwd.nix
-    ./networkmanager.nix
-    ./networkd.nix
     ./resolved.nix
+
+    ./networkd.nix
+    ./iwd.nix
+    ./wpasupplicant.nix
   ];
 
-  networking.firewall = {
-    enable = true;
-    checkReversePath = "loose";
+  networking = {
+    firewall = {
+      enable = true;
+      checkReversePath = "loose";
+    };
+
+    # Disable default networking stuff
+    dhcpcd.enable = false;
+    useDHCP = false;
+    networkmanager.enable = false;
   };
 
   # disable all ipv6
diff --git a/modules/system/nixos/networking/iwd.nix b/modules/system/nixos/networking/iwd.nix
index eea35d8..0c5bdfa 100644
--- a/modules/system/nixos/networking/iwd.nix
+++ b/modules/system/nixos/networking/iwd.nix
@@ -3,25 +3,21 @@
   config,
   ...
 }: let
-  cfg = config.collinux.system.network.iwd;
+  cfg = config.collinux.system.network;
+  enabled = cfg.wireless.dynamic;
 in
-  lib.mkIf cfg.enable {
+  lib.mkIf enabled {
     networking = {
       wireless.iwd = {
         enable = true;
         settings = {
           General = {
-            EnableNetworkConfiguration = !config.collinux.system.network.networkd.enable;
+            EnableNetworkConfiguration = false; # always let networkd handle this
             AddressRandomization = "once";
             AddressRandomizationRange = "full";
           };
           Network.NameResolvingService = "systemd"; # either systemd or resolvconf
         };
       };
-
-      # Disable default networking stuff
-      dhcpcd.enable = false;
-      useDHCP = false;
-      networkmanager.enable = false;
     };
   }
diff --git a/modules/system/nixos/networking/networkd.nix b/modules/system/nixos/networking/networkd.nix
index d0e9eed..2c7f580 100644
--- a/modules/system/nixos/networking/networkd.nix
+++ b/modules/system/nixos/networking/networkd.nix
@@ -1,56 +1,44 @@
 {
-  lib,
+  # lib,
   config,
   ...
 }: let
-  cfg = config.collinux.system.network.networkd;
-
+  cfg = config.collinux.system.network;
   dhcp_enabled = cfg.static == null;
-in
-  lib.mkIf cfg.enable {
-    networking = {
-      wireless =
-        if !config.collinux.system.network.iwd.enable
-        then {
-          enable = true;
-          networks.${cfg.ssid}.pskRaw = "ext:psk";
-          secretsFile = cfg.pskFile;
-        }
-        else {};
-
-      useNetworkd = true;
 
-      # Disable default networking stuff
-      dhcpcd.enable = false;
-      useDHCP = false;
-      networkmanager.enable = false;
-    };
+  device =
+    if (cfg.wireless == null)
+    then "eth0"
+    else "wl*";
+in {
+  networking.useNetworkd = true;
+  systemd.network = {
+    enable = true;
 
-    systemd.network = {
+    wait-online = {
       enable = true;
+      ignoredInterfaces = ["docker0"];
+      anyInterface = true;
+    };
 
-      wait-online = {
-        enable = true;
-        ignoredInterfaces = ["docker0"];
-        anyInterface = true;
-      };
-
-      networks."11-lan" = {
-        name = "wl*";
-
-        networkConfig = (
-          if dhcp_enabled
-          then {DHCP = "yes";}
-          else {
-            Address = cfg.static.ip;
-            Gateway = cfg.static.gateway;
-            DHCP = "no";
-            # DNS is managed by systemd-resolved (not specified here)
-          }
-        );
+    networks."11-default" =
+      if dhcp_enabled
+      then {
+        name = device;
+        networkConfig.DHCP = "yes";
 
+        # never accept dhcp dns
         dhcpV4Config.UseDNS = "no";
         dhcpV6Config.UseDNS = "no";
+      }
+      else {
+        name = device;
+        networkConfig = {
+          Address = cfg.static.ip;
+          Gateway = cfg.static.gateway;
+          DHCP = "no";
+          # DNS is managed by systemd-resolved (not specified here)
+        };
       };
-    };
-  }
+  };
+}
diff --git a/modules/system/nixos/networking/networkmanager.nix b/modules/system/nixos/networking/networkmanager.nix
deleted file mode 100644
index c2d6dd1..0000000
--- a/modules/system/nixos/networking/networkmanager.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-  lib,
-  config,
-  ...
-}: let
-  cfg = config.collinux.system.network.networkmanager;
-in
-  lib.mkIf cfg.enable {
-    networking = {
-      networkmanager = {
-        enable = true;
-        dns = "systemd-resolved";
-        dhcp = "internal";
-      };
-
-      dhcpcd.enable = false;
-    };
-  }
diff --git a/modules/system/nixos/networking/wpasupplicant.nix b/modules/system/nixos/networking/wpasupplicant.nix
new file mode 100644
index 0000000..8314095
--- /dev/null
+++ b/modules/system/nixos/networking/wpasupplicant.nix
@@ -0,0 +1,15 @@
+{
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.collinux.system.network.wireless;
+  enabled = cfg.static != null;
+in
+  lib.mkIf enabled {
+    networking.wireless = {
+      enable = true;
+      networks.${cfg.static.ssid}.pskRaw = "ext:psk";
+      secretsFile = cfg.static.pskFile;
+    };
+  }
diff --git a/modules/system/options.nix b/modules/system/options.nix
index 72d0392..d827387 100644
--- a/modules/system/options.nix
+++ b/modules/system/options.nix
@@ -27,36 +27,42 @@ in {
     };
 
     network = {
-      iwd.enable = mkEnableOption "lightweight wifi daemon";
-      networkmanager.enable = mkEnableOption "heavier wifi daemon";
-      networkd = {
-        enable = mkEnableOption "use systemd-networkd";
-        ssid = mkOption {
-          description = "SSID for this network";
-          type = lib.types.str;
-        };
-        pskFile = mkOption {
-          description = "Absolute path to a file containing the pre-shared key for this network in the form `psk:<wifi psk>`";
-          type = lib.types.str;
-          example = "/run/secrets.d/wifi-psk";
-        };
+      static = lib.mkOption {
+        description = "Set a static IP address for this device on this network. Leave unset to use DHCP";
+        type = lib.types.nullOr (lib.types.submodule {
+          options = {
+            ip = mkOption {
+              description = "IP address";
+              type = ipAddrCidr;
+            };
+            gateway = mkOption {
+              description = "default gateway";
+              type = ipAddr;
+            };
+          };
+        });
+        default = null;
+      };
 
+      wireless = {
         static = lib.mkOption {
-          description = "Set a static IP address for this device on this network. Leave unset to use DHCP";
+          description = "Set a preconfigured SSID and PSK for the wireless config";
           type = lib.types.nullOr (lib.types.submodule {
             options = {
-              ip = mkOption {
-                description = "IP address";
-                type = ipAddrCidr;
+              ssid = mkOption {
+                description = "SSID for this network";
+                type = lib.types.str;
               };
-              gateway = mkOption {
-                description = "default gateway";
-                type = ipAddr;
+              pskFile = mkOption {
+                description = "Absolute path to a file containing the pre-shared key for this network in the form `psk:<wifi psk>`";
+                type = lib.types.str;
+                example = "/run/secrets.d/wifi-psk";
               };
             };
           });
           default = null;
         };
+        dynamic = lib.mkEnableOption "Enable dynamically joining wireless networks with iwd";
       };
 
       tailscale.enable = mkEnableOption "tailscale";
@@ -65,4 +71,14 @@ in {
     audio.enable = mkEnableOption "pipewire and wireplumber";
     bluetooth.enable = mkEnableOption "bluetooth";
   };
+
+  config.assertions = [
+    {
+      assertion = let
+        cfg = config.collinux.system.network.wireless;
+      in
+        !(cfg.static != null && cfg.dynamic);
+      message = "Configure a static wireless connection or a dynamic one; not both.";
+    }
+  ];
 }