WiFi

WiFi credentials are kept in secrets/wifi.yaml; see the Secrets concept for the trust model behind them.

You can give a host its WiFi networks as a secret, one connection per entry. secrets/wifi.yaml holds a wifi list; both a home network and an enterprise one are supported:

secrets/wifi.yaml

wifi:
- ssid: Home
  password: a-good-passphrase
- ssid: eduroam
  eap: peap
  identity: alice@example.edu
  password: her-account-password
  domain_suffix_match: example.edu

WPA-EAP servers are validated against the system CA trust store by default; set domain_suffix_match to pin the RADIUS server, or carry a ca_cert in the secret to validate against a specific CA.

The secret is the only source of truth. A connection whose settings drifted from its entry, because it was edited by hand or predates the secret, is recreated on the next run.

To make a host provision these networks, point wifi.secrets at the file in its configuration:

hosts/example/default.nix

wifi.secrets = ../../secrets/wifi.yaml;