networking.wireless.networks.<name>.extraConfig

[dotlambda]

This is just a proposal:
I think it would be nice to have an extraConfig option for each network in networking.wireless.networks, which simply adds a string to the file generated in wpa_supplicant.nix.
Maybe, one should also have an option to neither set a psk nor set key_mgmt=NONE.
This could for example be useful to declaratively specify an eduroam network used by universities. This is an example configuration:

network={
    ssid="eduroam"
    key_mgmt=WPA-EAP
    eap=TTLS
    identity="[email protected]"
    subject_match="radius.lrz.de"
    anonymous_identity="[email protected]"
    password="XXXXX"
    ca_cert="/etc/ssl/certs/dtag_root.crt"
    phase2="auth=PAP"
}

(taken from #8332)

Another possibility is to allow networking.wireless.networks.<name> to be a string which is inserted without modification in a network={ ... } block.

[rnhmjoj]

See #22401

[rnhmjoj]

I'm trying to add this option but I'm unsure on the implementation.
This really looks like an attribute set but some options are an enumeration (i.e. unquoted) so it can't be simply types.attrsOf types.str.

[rnhmjoj]

This is what I came up in the meantime.

diff --git a/nixos/modules/services/networking/wpa_supplicant.nix b/nixos/modules/services/networking/wpa_supplicant.nix
index c91ba91fcb..fe35e07603 100644
--- a/nixos/modules/services/networking/wpa_supplicant.nix
+++ b/nixos/modules/services/networking/wpa_supplicant.nix
@@ -8,17 +8,21 @@ let
     ${optionalString cfg.userControlled.enable ''
       ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=${cfg.userControlled.group}
       update_config=1''}
-    ${concatStringsSep "\n" (mapAttrsToList (ssid: networkConfig: let
-      psk = if networkConfig.psk != null
-        then ''"${networkConfig.psk}"''
-        else networkConfig.pskRaw;
-      priority = networkConfig.priority;
+    ${concatStringsSep "\n" (mapAttrsToList (ssid: config: with config; let
+      key = if psk != null
+        then ''"${psk}"''
+        else pskRaw;
+      baseAuth = ''
+        ${optionalString (psk != null) ''psk=${key}''}
+        ${optionalString (psk == null) ''key_mgmt=NONE''}
+      '';
     in ''
       network={
         ssid="${ssid}"
-        ${optionalString (psk != null) ''psk=${psk}''}
-        ${optionalString (psk == null) ''key_mgmt=NONE''}
         ${optionalString (priority != null) ''priority=${toString priority}''}
+        ${optionalString hidden "scan_ssid=1"}
+        ${if (auth != null) then auth else baseAuth}
+        ${extraConfig}
       }
     '') cfg.networks)}
   '' else "/etc/wpa_supplicant.conf";
@@ -70,6 +74,32 @@ in {
                 Mutually exclusive with <varname>psk</varname>.
               '';
             };
+
+            auth = mkOption {
+              type = types.nullOr types.str;
+              default = null;
+              example = ''
+                key_mgmt=WPA-EAP
+                eap=PEAP
+                identity="[email protected]"
+                password="secret"
+              '';
+              description = ''
+                Use this option to configure advanced authentication methods like EAP.
+                See wpa_supplicant.conf(5) for example configurations.
+
+                Mutually exclusive with <varname>psk</varname> and <varname>pskRaw</varname>.
+              '';
+            };
+
+            hidden = mkOption {
+              type = types.bool;
+              default = false;
+              description = ''
+                Set this to <literal>true</literal> if the SSID of the network is hidden.
+              '';
+            };
+
             priority = mkOption {
               type = types.nullOr types.int;
               default = null;
@@ -83,6 +113,19 @@ in {
                 policy, signal strength, etc.
               '';
             };
+
+            extraConfig = mkOption {
+              type = types.str;
+              default = "";
+              example = ''
+                bssid_blacklist=02:11:22:33:44:55 02:22:aa:44:55:66
+              '';
+              description = ''
+                Extra configuration lines appended to the network block.
+                See wpa_supplicant.conf(5) for available options.
+              '';
+            };
+
           };
         });
         description = ''

[c0bw3b]

@dotlambda PR #30516 has been merged so manual wireless config should now be possible.

[fpletz]

Should be fixed by #30516.

[dotlambda]

Thanks a lot @rnhmjoj!