I'm not sure the package changes are going into the correct direction, in fact the package should probably reduce the config options to those that actually differ from upstream, instead of piling on more and more options.

In that case I can of course rebase the config for wpa_supplicant and hostapd on their current upstream defaults. Altoutgh this might have to be done periodically (e.g. when CONFIG_IEEE80211AX will become a default in the next years) to keep a clean diff.

Finally, my worries about the module as a whole is that it is a whopping 1000 lines long now. It exposes a lot of options explicitly, which will likely require a lot of maintenance going forward. This is the reason for RFC42 and settings approach, in that it allows to specify a limited set of important option, while at same time providing an escape hatch by allowing custom key/value pairs at any place.

I very briefly addressed that in the PR description, the issue is that the hostapd config is parsed by a custom C parser. The format is mostly key=value pairs, but doesn't follow this rule strictly. I opted against using settings style for now because there are several caveats that I don't know how to work around. For example:

• sae_password is an option that can be repeated
• The whole config is order dependent. If you write bss=wlan0_a you enter a new context which allows most (not all) options to be respecified for that sub-configuration

There are several cases of such inconveniences, and I have no idea how that could be mapped to RFC 42 without severely limiting generality. For now I just exposed some of the available options which are actually useful for AP setup.

Instead of your helper functions (L28+), you could use apply in mkOption to integrate the mapping logic more tightly.

Done.

@NinjaTrappeur @gloaming @rardiol Could you also have a look at this? Your opinions would be much appreciated.

I've added preliminary support for multiple BSS definitions per radio. I decided to do this since it is impossible to do that manually using extraConfig and in order to prevent another breaking change in the future. It is working, but I'm still ironing out some details and thus I put this back into draft mode for now. I'll update here once finished.

Awesome work! I wish I discovered this a bit sooner before I delved into hostapd.

OpenWRT has some pretty nice auto configure scripts to automatically set the capabilities and calculates the center frequency. Without those extra values openwrt calculates and adds to the hostapd config, I wasn't able to get high speeds. I did make an ugly script that amends the hostapd configuration to add these capabilities by querying the hardware at service start but it is incomplete and definitely not ready to show off. I think a cool follow up to this PR might be to add some auto configure magic. :)

I do have a question about the configuration format. Here's an example:

{
    services.hostapd = {
      enable = true;
      radios = {
        wlan1 = {
          hwMode = "a";
          countryCode = "US";
          networks.wlan1 = {
            ssid = "tower";
            authentication.saePasswords = [{ password = "pass"; }]; 
          };
        };
      };
    };
}

It seems a bit odd to me that wlan1 is specified twice. Hostapd's config format is... terrible so maybe there's a need for it but otherwise I see maybe an alternative or two. Some other ideas that don't repeat the wireless interface.

{
    services.hostapd = {
      enable = true;
      radios = {
        wlan1 = {
          hwMode = "a";
          countryCode = "US";
          networks = [  # use an array
            {
              ssid = "tower";
              authentication.saePasswords = [{ password = "pass"; }]; 
            }
          ];
        };
      };
    };
}

{
    services.hostapd = {
      enable = true;
      radios = {
        wlan1 = {
          hwMode = "a";
          countryCode = "US";
          networks.tower = { # the SSID is the key;  I assume all networks *must* have an SSID right?
            authentication.saePasswords = [{ password = "pass"; }]; 
          };
        };
      };
    };
}

Thanks for the suggestions, I've now changed the following things:

• Introduced a package option to be able to override the hostapd package
• Removed default definitions for SSIDs
• Moved all the runtime config generation logic to a new dynamicConfigScripts attrset, where new scripts can be added if necessary. One set per radio and one per network BSS of course. The module pre-fills some bss specific stuff to generate the mac allow/deny lists and to add passwords from files.

Awesome! I really like how this looks (and I hope I haven't annoyed you too much asking you to change all this stuff)

Not at all, I'm glad for the feedback! I believe this way the PR has come a long way from the initial draft.

Another thing I'd like to see is being able to customize config generation at runtime, like what you're doing right now for e.g. passwordFile but in an externally extensible way. This would allow NixOS configurations (or other modules) to add something such as automatically detecting ht_capab based on what the adapter says (something that OpenWrt does and I potentially wanted to try getting to work in NixOS), without having to use a nixpkgs fork.

I've also thought about that, but after seeing the amount of edge-case handling in OpenWrt I dismissed the thought for now. If you manage to do that generically this would be awesome to have in NixOS.

I've also thought about that, but after seeing the amount of edge-case handling in OpenWrt I dismissed the thought for now. If you manage to do that generically this would be awesome to have in NixOS.

Yeeeah, when I first took a look I kinda bailed out when seeing the two ~1.5k line shell scripts to generate this stuff, using lots of OpenWrt specific programs and other scripts. I'd still like to do it at some point though because it would be really cool to not have to worry about adapter configuration (for drivers that behave).

@oddlama Can you fix the conflicts please?

@oddlama Can you fix the conflicts please?

Done :)

Latest commit changes the RFC42 settings such that they show an error when redefining non-list symbols with different values, instead of silently making a list of them.

Replaced hwMode in favor of band to make configuration experience better (we follow OpenWRT here). Also added assertion that ensures HT40- is not used with ACS (unsupported by hostapd).

Wow! Thanks for all of the work @oddlama !

This is a huge improvement over the massive string of opaque hostapd options I currently use for multi-ap.