From 14621e7ad50f0ed42bc0ba2929e783f5b798af11 Mon Sep 17 00:00:00 2001
From: beatzaplenty <wayne.bennett@live.com>
Date: Tue, 21 Jul 2026 23:42:22 +0000
Subject: [PATCH] Prestage a declarative wifi connection on the gui host
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds modules/networking/wifi.nix using NetworkManager's ensureProfiles
mechanism so the gui host associates to a known SSID on first boot with
no manual nmtui step. Credentials are placeholders in variables.nix
(wifiSsid/wifiPassword, both empty) to be filled in once the bare-metal
hardware profile is wired up — the module is a no-op until then.
---
 hosts/nixos/host.nix        |  4 ++++
 modules/networking/wifi.nix | 26 ++++++++++++++++++++++++++
 variables.nix               |  7 +++++++
 3 files changed, 37 insertions(+)
 create mode 100644 modules/networking/wifi.nix

diff --git a/hosts/nixos/host.nix b/hosts/nixos/host.nix
index c0529dc..a1d7ffb 100644
--- a/hosts/nixos/host.nix
+++ b/hosts/nixos/host.nix
@@ -1,6 +1,10 @@
 _:
 
 {
+  imports = [
+    ../../modules/networking/wifi.nix
+  ];
+
   networking.hostName = "nixos";
 
   # Preserved from the pre-refactor `nixos` target — stateVersion must never
diff --git a/modules/networking/wifi.nix b/modules/networking/wifi.nix
new file mode 100644
index 0000000..2765d0c
--- /dev/null
+++ b/modules/networking/wifi.nix
@@ -0,0 +1,26 @@
+{ lib, vars, ... }:
+
+{
+  # Prestages a NetworkManager connection profile for vars.wifiSsid/
+  # wifiPassword so the host associates on first boot with no manual
+  # nmtui/nmcli step. Guarded on a non-empty SSID so leaving the
+  # placeholders blank in variables.nix is a no-op rather than an empty,
+  # broken profile — fill both in once the bare-metal hardware profile is
+  # wired up.
+  networking.networkmanager.ensureProfiles.profiles = lib.mkIf (vars.wifiSsid != "") {
+    ${vars.wifiSsid} = {
+      connection = {
+        id = vars.wifiSsid;
+        type = "wifi";
+      };
+      wifi = {
+        mode = "infrastructure";
+        ssid = vars.wifiSsid;
+      };
+      wifi-security = {
+        key-mgmt = "wpa-psk";
+        psk = vars.wifiPassword;
+      };
+    };
+  };
+}
diff --git a/variables.nix b/variables.nix
index 231d93c..36fd232 100644
--- a/variables.nix
+++ b/variables.nix
@@ -45,6 +45,13 @@
   # the installer image's nixos/root users.
   adminSshKey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCq/Q5LvIXlZwO2kdeAN5nLGZ59nZB7JHYMEszHxmNtGMzv1lM31jiPNsr0z2EKVZhE7OOfa2IF9rhWYD7JUA9G0yzdZ4WTXFNGVVOJoOVH6vAF3XCxoVilOEwTc7h2Wiy+rzd0B28/3spffzQQWJhY6GRQVa8j+6xAGF60Fcvl1vLosYT9Bn2ZbK4TCWOwAn2jqXIieGpZdn/UNZbGOeKRiCvhktDfMAzuQzN/9jMu/oF4pkPn2X1UrsQdNlvp0Ci8md612MozIpncQJyAF1ADhunr3sMx0isUXiqD29R5DS4TftpekqLNLak+zcxFa8N7DcRNp3DcKfJvyTkwQrR4r+b7lFLYOLHLagSso9CzeW/paAS2q9I5SBm/2DtE1diLLg2jZikYcstsu/G5RgvbzbKqjiaMwTdXC3AMvDxQrs7U5pDRZFzoofG3cpODbTm+uy3m0kP70z0M1K45UbDG0p+itnTu9x40JbQEgefbx38AItNvAIx1A8HO4I1VX28= wayne@stream";
 
+  # Prestaged wifi credentials for the gui host's NetworkManager profile
+  # (modules/networking/wifi.nix). Leave blank until the bare-metal
+  # hardware profile is wired up — an empty ssid disables the profile
+  # rather than creating a broken empty one.
+  wifiSsid = "";
+  wifiPassword = "";
+
   # System
   timeZone = "Australia/Brisbane";