me like nix
1{ config, pkgs, ... }:
2
3{
4 # Pre-generated SSH host key for agenix decryption (shared across all Pis)
5 services.openssh.hostKeys = [
6 {
7 path = "/etc/ssh/ssh_host_ed25519_key";
8 type = "ed25519";
9 }
10 ];
11
12 environment.etc."ssh/ssh_host_ed25519_key" = {
13 source = /home/sean/nixos-config/secrets/pi_host_key;
14 mode = "0600";
15 };
16
17 # Agenix configuration - use Nix store path directly so the key is available
18 # before the etc activation script runs (agenix activates before etc)
19 age.identityPaths = [ "${/home/sean/nixos-config/secrets/pi_host_key}" ];
20 age.secrets.wifi = {
21 file = ../../secrets/wifi.age;
22 mode = "0444";
23 };
24
25 # WiFi configuration using wpa_supplicant with agenix credentials
26 networking.wireless = {
27 enable = true;
28 secretsFile = config.age.secrets.wifi.path;
29 networks."GL-MT6000-6a6" = {
30 pskRaw = "ext:WIFI_PSK";
31 extraConfig = ''
32 freq_list=5180 5200 5220 5240 5260 5280 5300 5320 5500 5520 5540 5560 5580 5600 5620 5640 5660 5680 5700 5720 5745 5765 5785 5805 5825
33 '';
34 };
35 };
36
37 # Disable WiFi power save to prevent brcmfmac firmware hangs
38 systemd.services.wifi-powersave-off = {
39 description = "Disable WiFi power save";
40 after = [ "network.target" ];
41 wantedBy = [ "multi-user.target" ];
42 serviceConfig = {
43 Type = "oneshot";
44 ExecStart = "${pkgs.iw}/bin/iw dev wlan0 set power_save off";
45 RemainAfterExit = true;
46 };
47 };
48}