559 lines
18 KiB
Nix
559 lines
18 KiB
Nix
{ config, lib, pkgs, ... }:
|
||
|
||
with lib;
|
||
|
||
let
|
||
cfg = config.networking.networkmanager;
|
||
|
||
delegateWireless = config.networking.wireless.enable == true && cfg.unmanaged != [ ];
|
||
|
||
enableIwd = cfg.wifi.backend == "iwd";
|
||
|
||
mkValue = v:
|
||
if v == true then "yes"
|
||
else if v == false then "no"
|
||
else if lib.isInt v then toString v
|
||
else v;
|
||
|
||
mkSection = name: attrs: ''
|
||
[${name}]
|
||
${
|
||
lib.concatStringsSep "\n"
|
||
(lib.mapAttrsToList
|
||
(k: v: "${k}=${mkValue v}")
|
||
(lib.filterAttrs
|
||
(k: v: v != null)
|
||
attrs))
|
||
}
|
||
'';
|
||
|
||
configFile = pkgs.writeText "NetworkManager.conf" (lib.concatStringsSep "\n" [
|
||
(mkSection "main" {
|
||
plugins = "keyfile";
|
||
inherit (cfg) dhcp dns;
|
||
# If resolvconf is disabled that means that resolv.conf is managed by some other module.
|
||
rc-manager =
|
||
if config.networking.resolvconf.enable then "resolvconf"
|
||
else "unmanaged";
|
||
})
|
||
(mkSection "keyfile" {
|
||
unmanaged-devices =
|
||
if cfg.unmanaged == [ ] then null
|
||
else lib.concatStringsSep ";" cfg.unmanaged;
|
||
})
|
||
(mkSection "logging" {
|
||
audit = config.security.audit.enable;
|
||
level = cfg.logLevel;
|
||
})
|
||
(mkSection "connection" cfg.connectionConfig)
|
||
(mkSection "device" {
|
||
"wifi.scan-rand-mac-address" = cfg.wifi.scanRandMacAddress;
|
||
"wifi.backend" = cfg.wifi.backend;
|
||
})
|
||
cfg.extraConfig
|
||
]);
|
||
|
||
/*
|
||
[network-manager]
|
||
Identity=unix-group:networkmanager
|
||
Action=org.freedesktop.NetworkManager.*
|
||
ResultAny=yes
|
||
ResultInactive=no
|
||
ResultActive=yes
|
||
|
||
[modem-manager]
|
||
Identity=unix-group:networkmanager
|
||
Action=org.freedesktop.ModemManager*
|
||
ResultAny=yes
|
||
ResultInactive=no
|
||
ResultActive=yes
|
||
*/
|
||
polkitConf = ''
|
||
polkit.addRule(function(action, subject) {
|
||
if (
|
||
subject.isInGroup("networkmanager")
|
||
&& (action.id.indexOf("org.freedesktop.NetworkManager.") == 0
|
||
|| action.id.indexOf("org.freedesktop.ModemManager") == 0
|
||
))
|
||
{ return polkit.Result.YES; }
|
||
});
|
||
'';
|
||
|
||
ns = xs: pkgs.writeText "nameservers" (
|
||
concatStrings (map (s: "nameserver ${s}\n") xs)
|
||
);
|
||
|
||
overrideNameserversScript = pkgs.writeScript "02overridedns" ''
|
||
#!/bin/sh
|
||
PATH=${with pkgs; makeBinPath [ gnused gnugrep coreutils ]}
|
||
tmp=$(mktemp)
|
||
sed '/nameserver /d' /etc/resolv.conf > $tmp
|
||
grep 'nameserver ' /etc/resolv.conf | \
|
||
grep -vf ${ns (cfg.appendNameservers ++ cfg.insertNameservers)} > $tmp.ns
|
||
cat $tmp ${ns cfg.insertNameservers} $tmp.ns ${ns cfg.appendNameservers} > /etc/resolv.conf
|
||
rm -f $tmp $tmp.ns
|
||
'';
|
||
|
||
dispatcherTypesSubdirMap = {
|
||
basic = "";
|
||
pre-up = "pre-up.d/";
|
||
pre-down = "pre-down.d/";
|
||
};
|
||
|
||
macAddressOpt = mkOption {
|
||
type = types.either types.str (types.enum [ "permanent" "preserve" "random" "stable" ]);
|
||
default = "preserve";
|
||
example = "00:11:22:33:44:55";
|
||
description = lib.mdDoc ''
|
||
Set the MAC address of the interface.
|
||
|
||
- `"XX:XX:XX:XX:XX:XX"`: MAC address of the interface
|
||
- `"permanent"`: Use the permanent MAC address of the device
|
||
- `"preserve"`: Don’t change the MAC address of the device upon activation
|
||
- `"random"`: Generate a randomized value upon each connect
|
||
- `"stable"`: Generate a stable, hashed MAC address
|
||
'';
|
||
};
|
||
|
||
packages = [
|
||
pkgs.modemmanager
|
||
pkgs.networkmanager
|
||
]
|
||
++ cfg.plugins
|
||
++ lib.optionals (!delegateWireless && !enableIwd) [
|
||
pkgs.wpa_supplicant
|
||
];
|
||
|
||
in
|
||
{
|
||
|
||
meta = {
|
||
maintainers = teams.freedesktop.members;
|
||
};
|
||
|
||
###### interface
|
||
|
||
options = {
|
||
|
||
networking.networkmanager = {
|
||
|
||
enable = mkOption {
|
||
type = types.bool;
|
||
default = false;
|
||
description = lib.mdDoc ''
|
||
Whether to use NetworkManager to obtain an IP address and other
|
||
configuration for all network interfaces that are not manually
|
||
configured. If enabled, a group `networkmanager`
|
||
will be created. Add all users that should have permission
|
||
to change network settings to this group.
|
||
'';
|
||
};
|
||
|
||
connectionConfig = mkOption {
|
||
type = with types; attrsOf (nullOr (oneOf [
|
||
bool
|
||
int
|
||
str
|
||
]));
|
||
default = { };
|
||
description = lib.mdDoc ''
|
||
Configuration for the [connection] section of NetworkManager.conf.
|
||
Refer to
|
||
[
|
||
https://developer.gnome.org/NetworkManager/stable/NetworkManager.conf.html#id-1.2.3.11
|
||
](https://developer.gnome.org/NetworkManager/stable/NetworkManager.conf.html)
|
||
or
|
||
{manpage}`NetworkManager.conf(5)`
|
||
for more information.
|
||
'';
|
||
};
|
||
|
||
extraConfig = mkOption {
|
||
type = types.lines;
|
||
default = "";
|
||
description = lib.mdDoc ''
|
||
Configuration appended to the generated NetworkManager.conf.
|
||
Refer to
|
||
[
|
||
https://developer.gnome.org/NetworkManager/stable/NetworkManager.conf.html
|
||
](https://developer.gnome.org/NetworkManager/stable/NetworkManager.conf.html)
|
||
or
|
||
{manpage}`NetworkManager.conf(5)`
|
||
for more information.
|
||
'';
|
||
};
|
||
|
||
unmanaged = mkOption {
|
||
type = types.listOf types.str;
|
||
default = [ ];
|
||
description = lib.mdDoc ''
|
||
List of interfaces that will not be managed by NetworkManager.
|
||
Interface name can be specified here, but if you need more fidelity,
|
||
refer to
|
||
[
|
||
https://developer.gnome.org/NetworkManager/stable/NetworkManager.conf.html#device-spec
|
||
](https://developer.gnome.org/NetworkManager/stable/NetworkManager.conf.html#device-spec)
|
||
or the "Device List Format" Appendix of
|
||
{manpage}`NetworkManager.conf(5)`.
|
||
'';
|
||
};
|
||
|
||
plugins = mkOption {
|
||
type =
|
||
let
|
||
networkManagerPluginPackage = types.package // {
|
||
description = "NetworkManager plug-in";
|
||
check =
|
||
p:
|
||
lib.assertMsg
|
||
(types.package.check p
|
||
&& p ? networkManagerPlugin
|
||
&& lib.isString p.networkManagerPlugin)
|
||
''
|
||
Package ‘${p.name}’, is not a NetworkManager plug-in.
|
||
Those need to have a ‘networkManagerPlugin’ attribute.
|
||
'';
|
||
};
|
||
in
|
||
types.listOf networkManagerPluginPackage;
|
||
default = [ ];
|
||
description = lib.mdDoc ''
|
||
List of NetworkManager plug-ins to enable.
|
||
Some plug-ins are enabled by the NetworkManager module by default.
|
||
'';
|
||
};
|
||
|
||
dhcp = mkOption {
|
||
type = types.enum [ "dhcpcd" "internal" ];
|
||
default = "internal";
|
||
description = lib.mdDoc ''
|
||
Which program (or internal library) should be used for DHCP.
|
||
'';
|
||
};
|
||
|
||
logLevel = mkOption {
|
||
type = types.enum [ "OFF" "ERR" "WARN" "INFO" "DEBUG" "TRACE" ];
|
||
default = "WARN";
|
||
description = lib.mdDoc ''
|
||
Set the default logging verbosity level.
|
||
'';
|
||
};
|
||
|
||
appendNameservers = mkOption {
|
||
type = types.listOf types.str;
|
||
default = [ ];
|
||
description = lib.mdDoc ''
|
||
A list of name servers that should be appended
|
||
to the ones configured in NetworkManager or received by DHCP.
|
||
'';
|
||
};
|
||
|
||
insertNameservers = mkOption {
|
||
type = types.listOf types.str;
|
||
default = [ ];
|
||
description = lib.mdDoc ''
|
||
A list of name servers that should be inserted before
|
||
the ones configured in NetworkManager or received by DHCP.
|
||
'';
|
||
};
|
||
|
||
ethernet.macAddress = macAddressOpt;
|
||
|
||
wifi = {
|
||
macAddress = macAddressOpt;
|
||
|
||
backend = mkOption {
|
||
type = types.enum [ "wpa_supplicant" "iwd" ];
|
||
default = "wpa_supplicant";
|
||
description = lib.mdDoc ''
|
||
Specify the Wi-Fi backend used for the device.
|
||
Currently supported are {option}`wpa_supplicant` or {option}`iwd` (experimental).
|
||
'';
|
||
};
|
||
|
||
powersave = mkOption {
|
||
type = types.nullOr types.bool;
|
||
default = null;
|
||
description = lib.mdDoc ''
|
||
Whether to enable Wi-Fi power saving.
|
||
'';
|
||
};
|
||
|
||
scanRandMacAddress = mkOption {
|
||
type = types.bool;
|
||
default = true;
|
||
description = lib.mdDoc ''
|
||
Whether to enable MAC address randomization of a Wi-Fi device
|
||
during scanning.
|
||
'';
|
||
};
|
||
};
|
||
|
||
dns = mkOption {
|
||
type = types.enum [ "default" "dnsmasq" "unbound" "systemd-resolved" "none" ];
|
||
default = "default";
|
||
description = lib.mdDoc ''
|
||
Set the DNS (`resolv.conf`) processing mode.
|
||
|
||
A description of these modes can be found in the main section of
|
||
[
|
||
https://developer.gnome.org/NetworkManager/stable/NetworkManager.conf.html
|
||
](https://developer.gnome.org/NetworkManager/stable/NetworkManager.conf.html)
|
||
or in
|
||
{manpage}`NetworkManager.conf(5)`.
|
||
'';
|
||
};
|
||
|
||
dispatcherScripts = mkOption {
|
||
type = types.listOf (types.submodule {
|
||
options = {
|
||
source = mkOption {
|
||
type = types.path;
|
||
description = lib.mdDoc ''
|
||
Path to the hook script.
|
||
'';
|
||
};
|
||
|
||
type = mkOption {
|
||
type = types.enum (attrNames dispatcherTypesSubdirMap);
|
||
default = "basic";
|
||
description = lib.mdDoc ''
|
||
Dispatcher hook type. Look up the hooks described at
|
||
[https://developer.gnome.org/NetworkManager/stable/NetworkManager.html](https://developer.gnome.org/NetworkManager/stable/NetworkManager.html)
|
||
and choose the type depending on the output folder.
|
||
You should then filter the event type (e.g., "up"/"down") from within your script.
|
||
'';
|
||
};
|
||
};
|
||
});
|
||
default = [ ];
|
||
example = literalExpression ''
|
||
[ {
|
||
source = pkgs.writeText "upHook" '''
|
||
if [ "$2" != "up" ]; then
|
||
logger "exit: event $2 != up"
|
||
exit
|
||
fi
|
||
|
||
# coreutils and iproute are in PATH too
|
||
logger "Device $DEVICE_IFACE coming up"
|
||
''';
|
||
type = "basic";
|
||
} ]
|
||
'';
|
||
description = lib.mdDoc ''
|
||
A list of scripts which will be executed in response to network events.
|
||
'';
|
||
};
|
||
|
||
enableStrongSwan = mkOption {
|
||
type = types.bool;
|
||
default = false;
|
||
description = lib.mdDoc ''
|
||
Enable the StrongSwan plugin.
|
||
|
||
If you enable this option the
|
||
`networkmanager_strongswan` plugin will be added to
|
||
the {option}`networking.networkmanager.plugins` option
|
||
so you don't need to do that yourself.
|
||
'';
|
||
};
|
||
|
||
fccUnlockScripts = mkOption {
|
||
type = types.listOf (types.submodule {
|
||
options = {
|
||
id = mkOption {
|
||
type = types.str;
|
||
description = lib.mdDoc "vid:pid of either the PCI or USB vendor and product ID";
|
||
};
|
||
path = mkOption {
|
||
type = types.path;
|
||
description = lib.mdDoc "Path to the unlock script";
|
||
};
|
||
};
|
||
});
|
||
default = [ ];
|
||
example = literalExpression ''[{ name = "03f0:4e1d"; script = "''${pkgs.modemmanager}/share/ModemManager/fcc-unlock.available.d/03f0:4e1d"; }]'';
|
||
description = lib.mdDoc ''
|
||
List of FCC unlock scripts to enable on the system, behaving as described in
|
||
https://modemmanager.org/docs/modemmanager/fcc-unlock/#integration-with-third-party-fcc-unlock-tools.
|
||
'';
|
||
};
|
||
};
|
||
};
|
||
|
||
imports = [
|
||
(mkRenamedOptionModule
|
||
[ "networking" "networkmanager" "packages" ]
|
||
[ "networking" "networkmanager" "plugins" ])
|
||
(mkRenamedOptionModule [ "networking" "networkmanager" "useDnsmasq" ] [ "networking" "networkmanager" "dns" ])
|
||
(mkRemovedOptionModule [ "networking" "networkmanager" "enableFccUnlock" ] ''
|
||
This option was removed, because using bundled FCC unlock scripts is risky,
|
||
might conflict with vendor-provided unlock scripts, and should
|
||
be a conscious decision on a per-device basis.
|
||
Instead it's recommended to use the
|
||
`networking.networkmanager.fccUnlockScripts` option.
|
||
'')
|
||
(mkRemovedOptionModule [ "networking" "networkmanager" "dynamicHosts" ] ''
|
||
This option was removed because allowing (multiple) regular users to
|
||
override host entries affecting the whole system opens up a huge attack
|
||
vector. There seem to be very rare cases where this might be useful.
|
||
Consider setting system-wide host entries using networking.hosts, provide
|
||
them via the DNS server in your network, or use environment.etc
|
||
to add a file into /etc/NetworkManager/dnsmasq.d reconfiguring hostsdir.
|
||
'')
|
||
(mkRemovedOptionModule [ "networking" "networkmanager" "firewallBackend" ] ''
|
||
This option was removed as NixOS is now using iptables-nftables-compat even when using iptables, therefore Networkmanager now uses the nftables backend unconditionally.
|
||
'')
|
||
];
|
||
|
||
|
||
###### implementation
|
||
|
||
config = mkIf cfg.enable {
|
||
|
||
assertions = [
|
||
{
|
||
assertion = config.networking.wireless.enable == true -> cfg.unmanaged != [ ];
|
||
message = ''
|
||
You can not use networking.networkmanager with networking.wireless.
|
||
Except if you mark some interfaces as <literal>unmanaged</literal> by NetworkManager.
|
||
'';
|
||
}
|
||
];
|
||
|
||
hardware.wirelessRegulatoryDatabase = true;
|
||
|
||
environment.etc = {
|
||
"NetworkManager/NetworkManager.conf".source = configFile;
|
||
}
|
||
// builtins.listToAttrs (map
|
||
(pkg: nameValuePair "NetworkManager/${pkg.networkManagerPlugin}" {
|
||
source = "${pkg}/lib/NetworkManager/${pkg.networkManagerPlugin}";
|
||
})
|
||
cfg.plugins)
|
||
// builtins.listToAttrs (map
|
||
(e: nameValuePair "ModemManager/fcc-unlock.d/${e.id}" {
|
||
source = e.path;
|
||
})
|
||
cfg.fccUnlockScripts)
|
||
// optionalAttrs (cfg.appendNameservers != [ ] || cfg.insertNameservers != [ ])
|
||
{
|
||
"NetworkManager/dispatcher.d/02overridedns".source = overrideNameserversScript;
|
||
}
|
||
// listToAttrs (lib.imap1
|
||
(i: s:
|
||
{
|
||
name = "NetworkManager/dispatcher.d/${dispatcherTypesSubdirMap.${s.type}}03userscript${lib.fixedWidthNumber 4 i}";
|
||
value = { mode = "0544"; inherit (s) source; };
|
||
})
|
||
cfg.dispatcherScripts);
|
||
|
||
environment.systemPackages = packages;
|
||
|
||
users.groups = {
|
||
networkmanager.gid = config.ids.gids.networkmanager;
|
||
nm-openvpn.gid = config.ids.gids.nm-openvpn;
|
||
};
|
||
|
||
users.users = {
|
||
nm-openvpn = {
|
||
uid = config.ids.uids.nm-openvpn;
|
||
group = "nm-openvpn";
|
||
extraGroups = [ "networkmanager" ];
|
||
};
|
||
nm-iodine = {
|
||
isSystemUser = true;
|
||
group = "networkmanager";
|
||
};
|
||
};
|
||
|
||
systemd.packages = packages;
|
||
|
||
systemd.tmpfiles.rules = [
|
||
"d /etc/NetworkManager/system-connections 0700 root root -"
|
||
"d /etc/ipsec.d 0700 root root -"
|
||
"d /var/lib/NetworkManager-fortisslvpn 0700 root root -"
|
||
|
||
"d /var/lib/misc 0755 root root -" # for dnsmasq.leases
|
||
# ppp isn't able to mkdir that directory at runtime
|
||
"d /run/pppd/lock 0700 root root -"
|
||
];
|
||
|
||
systemd.services.NetworkManager = {
|
||
wantedBy = [ "network.target" ];
|
||
restartTriggers = [ configFile ];
|
||
|
||
aliases = [ "dbus-org.freedesktop.NetworkManager.service" ];
|
||
|
||
serviceConfig = {
|
||
StateDirectory = "NetworkManager";
|
||
StateDirectoryMode = 755; # not sure if this really needs to be 755
|
||
};
|
||
};
|
||
|
||
systemd.services.NetworkManager-wait-online = {
|
||
wantedBy = [ "network-online.target" ];
|
||
};
|
||
|
||
systemd.services.ModemManager.aliases = [ "dbus-org.freedesktop.ModemManager1.service" ];
|
||
|
||
systemd.services.NetworkManager-dispatcher = {
|
||
wantedBy = [ "network.target" ];
|
||
restartTriggers = [ configFile overrideNameserversScript ];
|
||
|
||
# useful binaries for user-specified hooks
|
||
path = [ pkgs.iproute2 pkgs.util-linux pkgs.coreutils ];
|
||
aliases = [ "dbus-org.freedesktop.nm-dispatcher.service" ];
|
||
};
|
||
|
||
# Turn off NixOS' network management when networking is managed entirely by NetworkManager
|
||
networking = mkMerge [
|
||
(mkIf (!delegateWireless) {
|
||
useDHCP = false;
|
||
})
|
||
|
||
{
|
||
networkmanager.plugins = with pkgs; [
|
||
networkmanager-fortisslvpn
|
||
networkmanager-iodine
|
||
networkmanager-l2tp
|
||
networkmanager-openconnect
|
||
networkmanager-openvpn
|
||
networkmanager-vpnc
|
||
networkmanager-sstp
|
||
];
|
||
}
|
||
|
||
(mkIf cfg.enableStrongSwan {
|
||
networkmanager.plugins = [ pkgs.networkmanager_strongswan ];
|
||
})
|
||
|
||
(mkIf enableIwd {
|
||
wireless.iwd.enable = true;
|
||
})
|
||
|
||
{
|
||
networkmanager.connectionConfig = {
|
||
"ethernet.cloned-mac-address" = cfg.ethernet.macAddress;
|
||
"wifi.cloned-mac-address" = cfg.wifi.macAddress;
|
||
"wifi.powersave" =
|
||
if cfg.wifi.powersave == null then null
|
||
else if cfg.wifi.powersave then 3
|
||
else 2;
|
||
};
|
||
}
|
||
];
|
||
|
||
boot.kernelModules = [ "ctr" ];
|
||
|
||
security.polkit.enable = true;
|
||
security.polkit.extraConfig = polkitConf;
|
||
|
||
services.dbus.packages = packages
|
||
++ optional cfg.enableStrongSwan pkgs.strongswanNM
|
||
++ optional (cfg.dns == "dnsmasq") pkgs.dnsmasq;
|
||
|
||
services.udev.packages = packages;
|
||
};
|
||
}
|