swaync-service-dispatcher: add `-b` to block on service state query, to avoid incorrect responses when run in parallel

hosts/by-name/moby/default.nix

@@ -116,14 +116,6 @@
   # enable rotation sensor
   hardware.sensor.iio.enable = true;
 
-  # TODO: move elsewhere...
-  systemd.services.ModemManager.serviceConfig = {
-    # N.B.: the extra "" in ExecStart serves to force upstream ExecStart to be ignored
-    ExecStart = [ "" "${pkgs.modemmanager}/bin/ModemManager --debug" ];
-    # --debug sets DEBUG level logging: so reset
-    ExecStartPost = [ "${pkgs.modemmanager}/bin/mmcli --set-logging=INFO" ];
-  };
-
   services.udev.extraRules = let
     chmod = "${pkgs.coreutils}/bin/chmod";
     chown = "${pkgs.coreutils}/bin/chown";
@@ -134,8 +126,5 @@
 
     # make Pinephone front LEDs writable by user.
     SUBSYSTEM=="leds", DEVPATH=="*/*:indicator", RUN+="${chmod} g+w /sys%p/brightness", RUN+="${chown} :video /sys%p/brightness"
-
-    # make Modem controllable by user
-    DRIVER=="modem-power", RUN+="${chmod} g+w /sys%p/powered", RUN+="${chown} :networkmanager /sys%p/powered"
   '';
 }

hosts/common/programs/default.nix

@@ -74,11 +74,13 @@
     ./megapixels.nix
     ./mepo.nix
     ./mimeo
+    ./modemmanager.nix
     ./mopidy.nix
     ./mpv
     ./msmtp.nix
     ./nautilus.nix
     ./neovim.nix
+    ./networkmanager.nix
     ./newsflash.nix
     ./nheko.nix
     ./nicotine-plus.nix
@@ -130,6 +132,7 @@
     ./wine.nix
     ./wireplumber.nix
     ./wireshark.nix
+    ./wpa_supplicant.nix
     ./wvkbd.nix
     ./xarchiver.nix
     ./xdg-desktop-portal.nix

hosts/common/programs/eg25-control.nix

@@ -1,9 +1,11 @@
-{ config, lib, ... }:
+{ config, lib, pkgs, ... }:
 let
   cfg = config.sane.programs.eg25-control;
 in
 {
   sane.programs.eg25-control = {
+    suggestedPrograms = [ "modemmanager" ];
+
     services.eg25-control-powered = {
       description = "eg25-control-powered: power to the Qualcomm eg25 modem used by PinePhone";
       startCommand = "eg25-control --power-on --verbose";
@@ -45,6 +47,7 @@ in
     requires = [ "network-online.target" ];
     # wantedBy = [ "network-online.target" ]; # auto-start immediately after boot
   };
+
   users = lib.mkIf cfg.enabled {
     groups.eg25-control = {};
     users.eg25-control = {
@@ -61,4 +64,11 @@ in
     # to persist agps data, i think.
     { user = "eg25-control"; group = "eg25-control"; path = "/var/lib/eg25-control"; }
   ];
+  services.udev.extraRules = let
+    chmod = "${pkgs.coreutils}/bin/chmod";
+    chown = "${pkgs.coreutils}/bin/chown";
+  in ''
+    # make Modem controllable by user
+    DRIVER=="modem-power", RUN+="${chmod} g+w /sys%p/powered", RUN+="${chown} :networkmanager /sys%p/powered"
+  '';
 }

hosts/common/programs/modemmanager.nix

@@ -0,0 +1,38 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.sane.programs.modemmanager;
+in
+{
+  sane.programs.modemmanager = {
+    # mmcli needs /run/current-system/sw/share/dbus-1 files to function
+    enableFor.system = lib.mkIf (builtins.any (en: en) (builtins.attrValues cfg.enableFor.user)) true;
+  };
+
+  systemd.services.ModemManager = lib.mkIf cfg.enabled {
+    aliases = [ "dbus-org.freedesktop.ModemManager1.service" ];
+    after = [ "polkit.service" ];
+    requires = [ "polkit.service" ];
+    wantedBy = [ "network.target" ];
+    serviceConfig = {
+      Type = "dbus";
+      BusName = "org.freedesktop.ModemManager1";
+      # only if started with `--debug` does mmcli let us issue AT commands like
+      # `mmcli --modem any --command=<AT_CMD>`
+      ExecStart = "${cfg.package}/bin/ModemManager --debug";
+      # --debug sets DEBUG level logging: so reset
+      ExecStartPost = "${cfg.package}/bin/mmcli --set-logging=INFO";
+
+      Restart = "on-abort";
+      StandardError = "null";
+      CapabilityBoundingSet = "CAP_SYS_ADMIN CAP_NET_ADMIN";
+      ProtectSystem = true;
+      ProtectHome = true;
+      PrivateTmp = true;
+      RestrictAddressFamilies = "AF_NETLINK AF_UNIX AF_QIPCRTR";
+      NoNewPrivileges = true;
+    };
+  };
+
+  # so that ModemManager can discover when the modem appears
+  services.udev.packages = lib.mkIf cfg.enabled [ cfg.package ];
+}

hosts/common/programs/networkmanager.nix

@@ -0,0 +1,80 @@
+# Network Manager:
+# i manage this myself because the nixos service is not flexible enough.
+# - it unconditionally puts modemmanager onto the system path, preventing me from patching modemmanager's service file (without an overlay).
+#
+# XXX: it's normal to see error messages on an ethernet-only host, even when using nixos' official networkmanager service:
+# - `Couldn't initialize supplicant interface: Failed to D-Bus activate wpa_supplicant service`
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.sane.programs.networkmanager;
+in
+{
+  sane.programs.networkmanager = {
+    suggestedPrograms = [ "wpa_supplicant" ];
+    enableFor.system = lib.mkIf (builtins.any (en: en) (builtins.attrValues cfg.enableFor.user)) true;
+  };
+
+  # add to systemd.packages so we get the service file it ships, then override what we need to customize (taken from nixpkgs)
+  systemd.packages = lib.mkIf cfg.enabled [ cfg.package ];
+  systemd.services.NetworkManager = lib.mkIf cfg.enabled {
+    wantedBy = [ "network.target" ];
+    aliases = [ "dbus-org.freedesktop.NetworkManager.service" ];
+
+    serviceConfig = {
+      StateDirectory = "NetworkManager";
+      StateDirectoryMode = 755; # not sure if this really needs to be 755
+    };
+  };
+
+  systemd.services.NetworkManager-wait-online = lib.mkIf cfg.enabled{
+    wantedBy = [ "network-online.target" ];
+  };
+
+  environment.etc."NetworkManager/NetworkManager.conf".text = lib.mkIf cfg.enabled ''
+    # TODO: much of this is likely not needed.
+    [connection]
+    ethernet.cloned-mac-address=preserve
+    wifi.cloned-mac-address=preserve
+    wifi.powersave=null
+
+    [device]
+    wifi.backend=wpa_supplicant
+    wifi.scan-rand-mac-address=true
+
+    [keyfile]
+    # keyfile.path: where to check for connection credentials
+    path=/var/lib/NetworkManager/system-connections
+    unmanaged-devices=null
+
+    [logging]
+    audit=false
+    level=WARN
+
+    [main]
+    dhcp=internal
+    dns=systemd-resolved
+    plugins=keyfile
+    rc-manager=unmanaged
+  '';
+  hardware.wirelessRegulatoryDatabase = lib.mkIf cfg.enabled true;
+  networking.useDHCP = lib.mkIf cfg.enabled false;
+  users.groups = lib.mkIf cfg.enabled {
+    networkmanager.gid = config.ids.gids.networkmanager;
+  };
+  services.udev.packages = lib.mkIf cfg.enabled [ cfg.package ];
+  security.polkit.enable = lib.mkIf cfg.enabled true;
+  security.polkit.extraConfig = ''
+    polkit.addRule(function(action, subject) {
+      if (
+        subject.isInGroup("networkmanager")
+        && (action.id.indexOf("org.freedesktop.NetworkManager.") == 0
+            || action.id.indexOf("org.freedesktop.ModemManager")  == 0
+        ))
+          { return polkit.Result.YES; }
+    });
+  '';
+
+  boot.kernelModules = [ "ctr" ];  #< TODO: needed (what even is this)?
+  # TODO: polkit?
+  # TODO: NetworkManager-ensure-profiles?
+}

hosts/common/programs/sway/default.nix

@@ -130,6 +130,7 @@ in
       "fontconfig"
       # "gnome.gnome-bluetooth"  # XXX(2023/05/14): broken
       # "gnome.gnome-control-center"  # XXX(2023/06/28): depends on webkitgtk4_1
+      "networkmanager"
       "pipewire"
       "playerctl"  # for waybar & particularly to have playerctld running
       "rofi"  # menu/launcher
@@ -258,7 +259,6 @@ in
 
 
   # TODO: this can go elsewhere
-  networking.networkmanager.enable = lib.mkIf cfg.enabled true;
   hardware.bluetooth.enable = lib.mkIf cfg.enabled true;
   services.blueman.enable = lib.mkIf cfg.enabled true;
 

hosts/common/programs/swaynotificationcenter/swaync-service-dispatcher

@@ -21,7 +21,9 @@ checkActive() {
       systemctl is-active "$service.service" > /dev/null && echo true || echo false
       ;;
     s6)
-      s6-svstat -o wantedup "$XDG_RUNTIME_DIR/s6/live/servicedirs/$service"
+      # simulate a dry-run start. if no actions would be performed, then the service is up.
+      # alternative is s6-svstat, but that doesn't support oneshots
+      test -z "$(s6-rc -n 0 -b start "$service")" && echo true || echo false
       ;;
   esac
 }
@@ -32,7 +34,7 @@ startService() {
       /run/wrappers/bin/sudo systemctl start "$service"
       ;;
     s6)
-      s6-rc start "$service"
+      s6-rc -b start "$service"
       ;;
   esac
 }
@@ -43,7 +45,7 @@ stopService() {
       /run/wrappers/bin/sudo systemctl stop "$service"
       ;;
     s6)
-      s6-rc stop "$service"
+      s6-rc -b stop "$service"
       ;;
   esac
 }

hosts/common/programs/wpa_supplicant.nix

@@ -0,0 +1,10 @@
+{ config, lib, ... }:
+let
+  cfg = config.sane.programs.wpa_supplicant;
+in
+{
+  sane.programs.wpa_supplicant = {};
+  services.udev.packages = lib.mkIf cfg.enabled [ cfg.package ];
+  # need to be on systemd.packages so we get its service file
+  systemd.packages = lib.mkIf cfg.enabled [ cfg.package ];
+}