68 lines
1.8 KiB
Nix
68 lines
1.8 KiB
Nix
|
{lib, pkgs, ... }:
|
||
|
|
|
||
|
|
let
|
||
|
|
wifi = "wlp0s29u1u2";
|
||
|
|
ipAddress = "10.23.45.1";
|
||
|
|
prefixLength = 24;
|
||
|
|
servedAddressRange = "10.23.45.2,10.23.45.150,12h";
|
||
|
|
ssid="palosiot";
|
||
|
|
wifiPassword=lib.fileContents <secrets/iot_wifi>;
|
||
|
|
in
|
||
|
|
|
||
|
|
{
|
||
|
|
# todo only open needed ports
|
||
|
|
networking.firewall.trustedInterfaces = [ wifi ];
|
||
|
|
|
||
|
|
networking.networkmanager.unmanaged = [ wifi ];
|
||
|
|
networking.dhcpcd.denyInterfaces = [ wifi ];
|
||
|
|
|
||
|
|
networking.interfaces."${wifi}".ipv4.addresses = [ {
|
||
|
|
address = ipAddress; prefixLength = prefixLength;
|
||
|
|
}];
|
||
|
|
|
||
|
|
systemd.services.hostapd = {
|
||
|
|
description = "hostapd wireless AP";
|
||
|
|
path = [ pkgs.hostapd ];
|
||
|
|
wantedBy = [ "network.target" ];
|
||
|
|
|
||
|
|
after = [ "${wifi}-cfg.service" "nat.service" "bind.service" "dhcpd.service" "sys-subsystem-net-devices-${wifi}.device" ];
|
||
|
|
|
||
|
|
serviceConfig = {
|
||
|
|
ExecStart = "${pkgs.hostapd}/bin/hostapd ${pkgs.writeText "hostapd.conf" ''
|
||
|
|
interface=${wifi}
|
||
|
|
hw_mode=g
|
||
|
|
channel=10
|
||
|
|
ieee80211d=1
|
||
|
|
country_code=DE
|
||
|
|
ieee80211n=1
|
||
|
|
wmm_enabled=1
|
||
|
|
|
||
|
|
ssid=${ssid}
|
||
|
|
auth_algs=1
|
||
|
|
wpa=2
|
||
|
|
wpa_key_mgmt=WPA-PSK
|
||
|
|
rsn_pairwise=CCMP
|
||
|
|
wpa_passphrase=${wifiPassword}
|
||
|
|
''}";
|
||
|
|
Restart = "always";
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
services.dnsmasq = {
|
||
|
|
enable = true;
|
||
|
|
extraConfig = ''
|
||
|
|
# Only listen to routers' LAN NIC. Doing so opens up tcp/udp port 53 to
|
||
|
|
# localhost and udp port 67 to world:
|
||
|
|
interface=${wifi}
|
||
|
|
|
||
|
|
# Explicitly specify the address to listen on
|
||
|
|
listen-address=${ipAddress}
|
||
|
|
|
||
|
|
# Dynamic range of IPs to make available to LAN PC and the lease time.
|
||
|
|
# Ideally set the lease time to 5m only at first to test everything works okay before you set long-lasting records.
|
||
|
|
dhcp-range=${servedAddressRange}
|
||
|
|
'';
|
||
|
|
};
|
||
|
|
|
||
|
|
}
|