79 lines
1.9 KiB
Nix
79 lines
1.9 KiB
Nix
|
{ lib, pkgs, config, ... }:
|
||
|
|
|
||
|
|
let
|
||
|
|
# you find this device using `ifconfig -a` or `ip link`
|
||
|
|
wifi = "wlp3s0";
|
||
|
|
ipAddress = "10.23.45.1";
|
||
|
|
prefixLength = 24;
|
||
|
|
servedAddressRange = "10.23.45.2,10.23.45.150,12h";
|
||
|
|
ssid = "home/wifi";
|
||
|
|
in
|
||
|
|
{
|
||
|
|
|
||
|
|
# todo only open needed ports
|
||
|
|
networking.firewall.trustedInterfaces = [ wifi ];
|
||
|
|
|
||
|
|
networking.networkmanager.unmanaged = [ wifi ];
|
||
|
|
networking.dhcpcd.denyInterfaces = [ wifi ];
|
||
|
|
|
||
|
|
networking.interfaces."${wifi}".ipv4.addresses = [{
|
||
|
|
address = ipAddress;
|
||
|
|
prefixLength = prefixLength;
|
||
|
|
}];
|
||
|
|
|
||
|
|
systemd.services.hostapd = {
|
||
|
|
description = "hostapd wireless AP";
|
||
|
|
path = [ pkgs.hostapd ];
|
||
|
|
wantedBy = [ "network.target" ];
|
||
|
|
|
||
|
|
after = [
|
||
|
|
"${wifi}-cfg.service"
|
||
|
|
"nat.service"
|
||
|
|
"bind.service"
|
||
|
|
"dhcpd.service"
|
||
|
|
"sys-subsystem-net-devices-${wifi}.device"
|
||
|
|
];
|
||
|
|
|
||
|
|
serviceConfig = {
|
||
|
|
ExecStart = "${pkgs.hostapd}/bin/hostapd ${
|
||
|
|
pkgs.writeText "hostapd.conf" ''
|
||
|
|
interface=${wifi}
|
||
|
|
hw_mode=g
|
||
|
|
channel=10
|
||
|
|
ieee80211d=1
|
||
|
|
country_code=DE
|
||
|
|
ieee80211n=1
|
||
|
|
wmm_enabled=1
|
||
|
|
|
||
|
|
ssid=${ssid}
|
||
|
|
auth_algs=1
|
||
|
|
wpa=2
|
||
|
|
wpa_key_mgmt=WPA-PSK
|
||
|
|
rsn_pairwise=CCMP
|
||
|
|
wpa_psk_file=${config.sops.secrets.hostapd_wpa_psk.path}
|
||
|
|
''
|
||
|
|
}";
|
||
|
|
Restart = "always";
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
sops.secrets.hostapd_wpa_psk = { };
|
||
|
|
|
||
|
|
services.dnsmasq = {
|
||
|
|
enable = true;
|
||
|
|
extraConfig = ''
|
||
|
|
# Only listen to routers' LAN NIC. Doing so opens up tcp/udp port 53 to
|
||
|
|
# localhost and udp port 67 to world:
|
||
|
|
interface=${wifi}
|
||
|
|
|
||
|
|
# Explicitly specify the address to listen on
|
||
|
|
listen-address=${ipAddress}
|
||
|
|
|
||
|
|
# Dynamic range of IPs to make available to LAN PC and the lease time.
|
||
|
|
# Ideally set the lease time to 5m only at first to test everything works okay before you set long-lasting records.
|
||
|
|
dhcp-range=${servedAddressRange}
|
||
|
|
'';
|
||
|
|
};
|
||
|
|
|
||
|
|
}
|