|
|
|
|
@@ -78,14 +78,17 @@ in
|
|
|
|
|
|
|
|
|
|
(lib.mkIf cfg.enabled {
|
|
|
|
|
# add to systemd.packages so we get the service file it ships, then override what we need to customize (taken from nixpkgs)
|
|
|
|
|
systemd.packages = [ cfg.package ];
|
|
|
|
|
# systemd.packages = [ cfg.package ];
|
|
|
|
|
networking.networkmanager.enable = true;
|
|
|
|
|
networking.networkmanager.enableDefaultPlugins = false;
|
|
|
|
|
networking.networkmanager.package = cfg.package;
|
|
|
|
|
systemd.services.NetworkManager = {
|
|
|
|
|
wantedBy = [ "network.target" ];
|
|
|
|
|
# wantedBy = [ "network.target" ];
|
|
|
|
|
aliases = [ "dbus-org.freedesktop.NetworkManager.service" ];
|
|
|
|
|
|
|
|
|
|
path = [ "/run/current-system/sw" ]; #< so it can find `sanebox`
|
|
|
|
|
serviceConfig.RuntimeDirectory = "NetworkManager"; #< tells systemd to create /run/NetworkManager
|
|
|
|
|
serviceConfig.StateDirectory = "NetworkManager"; #< tells systemd to create /var/lib/NetworkManager
|
|
|
|
|
# serviceConfig.StateDirectory = "NetworkManager"; #< tells systemd to create /var/lib/NetworkManager
|
|
|
|
|
serviceConfig.User = "networkmanager";
|
|
|
|
|
serviceConfig.Group = "networkmanager";
|
|
|
|
|
serviceConfig.AmbientCapabilities = [
|
|
|
|
|
@@ -101,13 +104,13 @@ in
|
|
|
|
|
|
|
|
|
|
systemd.services.NetworkManager-wait-online = {
|
|
|
|
|
path = [ "/run/current-system/sw" ]; #< so `nm-online` can find `sanebox`
|
|
|
|
|
wantedBy = [ "network-online.target" ];
|
|
|
|
|
# wantedBy = [ "network-online.target" ];
|
|
|
|
|
serviceConfig.User = "networkmanager";
|
|
|
|
|
serviceConfig.Group = "networkmanager";
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
systemd.services.NetworkManager-dispatcher = {
|
|
|
|
|
wantedBy = [ "NetworkManager.service" ];
|
|
|
|
|
# wantedBy = [ "NetworkManager.service" ];
|
|
|
|
|
after = [ "trust-dns-localhost.service" ]; #< so that /var/lib/trust-dns will exist
|
|
|
|
|
path = [ "/run/current-system/sw" ]; #< so it can find `sanebox`
|
|
|
|
|
# to debug, add NM_DISPATCHER_DEBUG_LOG=1
|
|
|
|
|
@@ -121,88 +124,106 @@ in
|
|
|
|
|
serviceConfig.Group = "networkmanager";
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
environment.etc = {
|
|
|
|
|
"NetworkManager/system-connections".source = "/var/lib/NetworkManager/system-connections";
|
|
|
|
|
"NetworkManager/NetworkManager.conf".text = ''
|
|
|
|
|
[device]
|
|
|
|
|
# wifi.backend: wpa_supplicant or iwd
|
|
|
|
|
wifi.backend=wpa_supplicant
|
|
|
|
|
wifi.scan-rand-mac-address=true
|
|
|
|
|
networking.networkmanager.settings = {
|
|
|
|
|
# wifi.backend = "wpa_supplicant";
|
|
|
|
|
# wifi.scan-rand-mac-address = true;
|
|
|
|
|
|
|
|
|
|
[logging]
|
|
|
|
|
audit=false
|
|
|
|
|
# level: TRACE, DEBUG, INFO, WARN, ERR, OFF
|
|
|
|
|
level=INFO
|
|
|
|
|
# domain=...
|
|
|
|
|
# logging.audit = false;
|
|
|
|
|
logging.level = "INFO";
|
|
|
|
|
|
|
|
|
|
[main]
|
|
|
|
|
# dhcp:
|
|
|
|
|
# - `internal` (default)
|
|
|
|
|
# - `dhclient` (requires dhclient to be installed)
|
|
|
|
|
# - `dhcpcd` (requires dhcpcd to be installed)
|
|
|
|
|
dhcp=internal
|
|
|
|
|
# dns:
|
|
|
|
|
# - `default`: update /etc/resolv.conf with nameservers provided by the active connection
|
|
|
|
|
# - `none`: NM won't update /etc/resolv.conf
|
|
|
|
|
# - `systemd-resolved`: push DNS config to systemd-resolved
|
|
|
|
|
# - `dnsmasq`: run a local caching nameserver
|
|
|
|
|
dns=${if config.services.resolved.enable then
|
|
|
|
|
"systemd-resolved"
|
|
|
|
|
else if config.sane.services.trust-dns.enable && config.sane.services.trust-dns.asSystemResolver then
|
|
|
|
|
"none"
|
|
|
|
|
else
|
|
|
|
|
"internal"
|
|
|
|
|
}
|
|
|
|
|
plugins=keyfile
|
|
|
|
|
# rc-manager: how NM should write to /etc/resolv.conf
|
|
|
|
|
# - regardless of this setting, NM will write /var/lib/NetworkManager/resolv.conf
|
|
|
|
|
rc-manager=unmanaged
|
|
|
|
|
# systemd-resolved: send DNS config to systemd-resolved?
|
|
|
|
|
# this setting has no effect if dns="systemd-resolved"; it's supplementary, not absolute.
|
|
|
|
|
systemd-resolved=false
|
|
|
|
|
# debug=... (see also: NM_DEBUG env var)
|
|
|
|
|
'';
|
|
|
|
|
# main.dhcp = "internal";
|
|
|
|
|
main.dns = if config.services.resolved.enable then
|
|
|
|
|
"systemd-resolved"
|
|
|
|
|
else if config.sane.services.trust-dns.enable && config.sane.services.trust-dns.asSystemResolver then
|
|
|
|
|
"none"
|
|
|
|
|
else
|
|
|
|
|
"internal"
|
|
|
|
|
;
|
|
|
|
|
main.systemd-resolved = false;
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
hardware.wirelessRegulatoryDatabase = true;
|
|
|
|
|
networking.useDHCP = false;
|
|
|
|
|
services.udev.packages = [ cfg.package ];
|
|
|
|
|
security.polkit.enable = lib.mkDefault true;
|
|
|
|
|
environment.etc = {
|
|
|
|
|
"NetworkManager/system-connections".source = "/var/lib/NetworkManager/system-connections";
|
|
|
|
|
# "NetworkManager/NetworkManager.conf".text = ''
|
|
|
|
|
# [device]
|
|
|
|
|
# # wifi.backend: wpa_supplicant or iwd
|
|
|
|
|
# wifi.backend=wpa_supplicant
|
|
|
|
|
# wifi.scan-rand-mac-address=true
|
|
|
|
|
|
|
|
|
|
security.polkit.extraConfig = lib.concatStringsSep "\n" [
|
|
|
|
|
# allow networkmanager unbounded control over modemmanager.
|
|
|
|
|
# i believe this was sourced from the default nixpkgs config.
|
|
|
|
|
''
|
|
|
|
|
polkit.addRule(function(action, subject) {
|
|
|
|
|
if (subject.isInGroup("networkmanager")
|
|
|
|
|
&& (
|
|
|
|
|
action.id.indexOf("org.freedesktop.NetworkManager.") == 0
|
|
|
|
|
|| action.id.indexOf("org.freedesktop.ModemManager") == 0
|
|
|
|
|
)
|
|
|
|
|
) {
|
|
|
|
|
return polkit.Result.YES;
|
|
|
|
|
}
|
|
|
|
|
});
|
|
|
|
|
''
|
|
|
|
|
# allow networkmanager to control systemd-resolved,
|
|
|
|
|
# which it needs to do to apply new DNS settings when using systemd-resolved.
|
|
|
|
|
''
|
|
|
|
|
polkit.addRule(function(action, subject) {
|
|
|
|
|
if (subject.isInGroup("networkmanager") && action.id.indexOf("org.freedesktop.resolve1.") == 0) {
|
|
|
|
|
return polkit.Result.YES;
|
|
|
|
|
}
|
|
|
|
|
});
|
|
|
|
|
''
|
|
|
|
|
];
|
|
|
|
|
# [logging]
|
|
|
|
|
# audit=false
|
|
|
|
|
# # level: TRACE, DEBUG, INFO, WARN, ERR, OFF
|
|
|
|
|
# level=INFO
|
|
|
|
|
# # domain=...
|
|
|
|
|
|
|
|
|
|
users.groups.networkmanager.gid = config.ids.gids.networkmanager;
|
|
|
|
|
# [main]
|
|
|
|
|
# # dhcp:
|
|
|
|
|
# # - `internal` (default)
|
|
|
|
|
# # - `dhclient` (requires dhclient to be installed)
|
|
|
|
|
# # - `dhcpcd` (requires dhcpcd to be installed)
|
|
|
|
|
# dhcp=internal
|
|
|
|
|
# # dns:
|
|
|
|
|
# # - `default`: update /etc/resolv.conf with nameservers provided by the active connection
|
|
|
|
|
# # - `none`: NM won't update /etc/resolv.conf
|
|
|
|
|
# # - `systemd-resolved`: push DNS config to systemd-resolved
|
|
|
|
|
# # - `dnsmasq`: run a local caching nameserver
|
|
|
|
|
# dns=${if config.services.resolved.enable then
|
|
|
|
|
# "systemd-resolved"
|
|
|
|
|
# else if config.sane.services.trust-dns.enable && config.sane.services.trust-dns.asSystemResolver then
|
|
|
|
|
# "none"
|
|
|
|
|
# else
|
|
|
|
|
# "internal"
|
|
|
|
|
# }
|
|
|
|
|
# plugins=keyfile
|
|
|
|
|
# # rc-manager: how NM should write to /etc/resolv.conf
|
|
|
|
|
# # - regardless of this setting, NM will write /var/lib/NetworkManager/resolv.conf
|
|
|
|
|
# rc-manager=unmanaged
|
|
|
|
|
# # systemd-resolved: send DNS config to systemd-resolved?
|
|
|
|
|
# # this setting has no effect if dns="systemd-resolved"; it's supplementary, not absolute.
|
|
|
|
|
# systemd-resolved=false
|
|
|
|
|
# # debug=... (see also: NM_DEBUG env var)
|
|
|
|
|
# '';
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
# hardware.wirelessRegulatoryDatabase = true;
|
|
|
|
|
# networking.useDHCP = false;
|
|
|
|
|
# services.udev.packages = [ cfg.package ];
|
|
|
|
|
# security.polkit.enable = lib.mkDefault true;
|
|
|
|
|
|
|
|
|
|
# security.polkit.extraConfig = lib.concatStringsSep "\n" [
|
|
|
|
|
# # allow networkmanager unbounded control over modemmanager.
|
|
|
|
|
# # i believe this was sourced from the default nixpkgs config.
|
|
|
|
|
# ''
|
|
|
|
|
# polkit.addRule(function(action, subject) {
|
|
|
|
|
# if (subject.isInGroup("networkmanager")
|
|
|
|
|
# && (
|
|
|
|
|
# action.id.indexOf("org.freedesktop.NetworkManager.") == 0
|
|
|
|
|
# || action.id.indexOf("org.freedesktop.ModemManager") == 0
|
|
|
|
|
# )
|
|
|
|
|
# ) {
|
|
|
|
|
# return polkit.Result.YES;
|
|
|
|
|
# }
|
|
|
|
|
# });
|
|
|
|
|
# ''
|
|
|
|
|
|
|
|
|
|
# allow networkmanager to control systemd-resolved,
|
|
|
|
|
# which it needs to do to apply new DNS settings when using systemd-resolved.
|
|
|
|
|
security.polkit.extraConfig = ''
|
|
|
|
|
polkit.addRule(function(action, subject) {
|
|
|
|
|
if (subject.isInGroup("networkmanager") && action.id.indexOf("org.freedesktop.resolve1.") == 0) {
|
|
|
|
|
return polkit.Result.YES;
|
|
|
|
|
}
|
|
|
|
|
});
|
|
|
|
|
'';
|
|
|
|
|
|
|
|
|
|
# users.groups.networkmanager.gid = config.ids.gids.networkmanager;
|
|
|
|
|
users.users.networkmanager = {
|
|
|
|
|
isSystemUser = true;
|
|
|
|
|
group = "networkmanager";
|
|
|
|
|
extraGroups = [ "trust-dns" ];
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
boot.kernelModules = [ "ctr" ]; #< TODO: needed (what even is this)?
|
|
|
|
|
# boot.kernelModules = [ "ctr" ]; #< TODO: needed (what even is this)?
|
|
|
|
|
# TODO: NetworkManager-ensure-profiles?
|
|
|
|
|
})
|
|
|
|
|
];
|
|
|
|
|
|
