From 161a228bd53c827555b91747d55f73aed6b62bd0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?L=C3=A9ana=20=E6=B1=9F?= <leana.jiang+git@icloud.com>
Date: Sat, 13 Dec 2025 21:40:39 +0800
Subject: [PATCH] networks: fix ordering and add new network

---
 nix/networks/list.nix                  |   7 ++++
 nix/networks/wpa_supplicant-compat.nix |  46 ++++++++++++++-----------
 nix/secrets/wpa_password.age           | Bin 971 -> 952 bytes
 3 files changed, 32 insertions(+), 21 deletions(-)

diff --git a/nix/networks/list.nix b/nix/networks/list.nix
index aaeb1560..30401b42 100644
--- a/nix/networks/list.nix
+++ b/nix/networks/list.nix
@@ -81,6 +81,13 @@ in
     hasPassword = true;
     randomizeMac = true;
   }
+  {
+    ssid = "LouisaCoffee";
+    bssid = "fa:92:bf:62:7c:19";
+    priority = privatePriority;
+    hasPassword = true;
+    randomizeMac = true;
+  }
   {
     ssid = "MetroTaipei x Louisa"; # 大安
     priority = privatePriority;
diff --git a/nix/networks/wpa_supplicant-compat.nix b/nix/networks/wpa_supplicant-compat.nix
index 84f59504..2f57b267 100644
--- a/nix/networks/wpa_supplicant-compat.nix
+++ b/nix/networks/wpa_supplicant-compat.nix
@@ -20,28 +20,32 @@ let
       randomizeMac ? false,
       ...
     }:
-    let
-      uniqueKey = "${ssid}${lib.optionalString (bssid != null) bssid}";
-    in
     {
-      ${uniqueKey} # we use a unique key here to make sure no "same ssid different bssid" networks collide in key.
-        =
-          lib.mkMerge [
-            (builtins.removeAttrs networkArgs [
-              "hasPassword"
-              "scanOnLowSignal"
-              "randomizeMac"
-            ])
-            (lib.optionalAttrs hasPassword {
-              pskRaw = "ext:${escapePwdKey uniqueKey}"; # this implies changing the external password key if you set a bssid!
-            })
-            {
-              extraConfig = ''
-                ${lib.optionalString scanOnLowSignal "bgscan=\"simple:30:-70:3600\""}
-                ${lib.optionalString randomizeMac "mac_addr=1"}
-              '';
-            }
-          ];
+      ${
+        # We use a unique key here to make sure no "same ssid different bssid" networks collide in key.
+        # This is ordered, we still show "null" so that it would come after hex characters [a-z0-9].
+        # The serialization is based on string order.
+        "${ssid},${if bssid != null then bssid else "null"}"
+      } =
+        lib.mkMerge [
+          (builtins.removeAttrs networkArgs [
+            "hasPassword"
+            "scanOnLowSignal"
+            "randomizeMac"
+          ])
+          (lib.optionalAttrs hasPassword {
+            pskRaw = "ext:${
+              # this implies changing the external password key if you set a bssid!
+              escapePwdKey (if bssid == null then ssid else "${ssid},${bssid}")
+            }";
+          })
+          {
+            extraConfig = ''
+              ${lib.optionalString scanOnLowSignal "bgscan=\"simple:30:-70:3600\""}
+              ${lib.optionalString randomizeMac "mac_addr=1"}
+            '';
+          }
+        ];
     };
 in
 ns: lib.mkMerge (map go ns)
diff --git a/nix/secrets/wpa_password.age b/nix/secrets/wpa_password.age
index 511c4742e7fc5182ddffe1887b03fe3ede23b115..3a79d0bc4412837153e42678205a6f65d6af9518 100644
GIT binary patch
delta 883
zcmV-(1C0F32e=22EPqx`N@Qn4bZBr?I6^aUdUHx<F-~_cadd1sVKZ(>GH6CCR8m)2
zZAD5&GzwE$Y+-URc~~!GL_{`1b97B<K`&}naCR|ILo|6sRA*XsLPbtmabiVFZwf6w
zAaiqQEoEdfH8n9gAZv3lYcN3|OL$9nD{yILK}%(Hb1!&oXht|oH#AXWWJgJ1Xmv+x
zVKq%gL1j;HGAn3z3PENxLQ-^XbyqKSOL%ZGbYyf<YG+zQctm(rLr->MbWAiiaW8K)
zaY0Z;k?|K-HhFqvc4jv>T32dHWOY_#Q&d?oMR_wYc4stDRW@`@Ic{lVc0^c4Y(Y&5
zO+`X?Z#Gn7Y)oN!N>OPwVM{c1cS%%gS2aU%c5Y`$bZ<{-Gf8$fH7iw<UjY|?XLN8^
zcy@74QCMPlH#1L6XKQR~STid|G-_yPF=KQqa5+z7RA+KjQdl$!T244ZGh#__Q*SUs
zNkMHxL31@ULr*qkWMpS^OjBWILqkP)aA{g<Xk$?dEj}Pldq8I`XL4m>b7de#d37Lq
z3UXB|Nmgu0bV)WxNj7s=aamJ;dTV!g3N0-yAbM~_R%<mza4=#xb#hX1NkLd|F=$P2
zRYfaQFl0$9F-b^lVRKe(XlFNX3fnIWe#<}!O}Fs{hl60T|43UIx-PFp+WTq!lB>~I
z9tT7WN1_QiicTFPCX;J7Y2Y9aIp)9cq#f#^W56H9hbwm)e(>n|S-47ne%s3Is9bdF
zP?t_6seTYxYuChaAg9GWT=<G03){n5x-*BHwU%L--iu?Zd+3v>qD2el6BUjWbllxB
zy3-YWjthZ3*Js3~8*N=a6bQ7G!P-3)=Ta-bZ~b;xy7azM=vqk?n@ATU>F1s&#quH6
zFveBkm5n+ly_>w{q~830EJ?OFtir~%O<IE$;AQCmSZGd^f+J-b&QddfxoaB{X-ppI
zN4B7h$FR><0zRS$xT&G9J#Tc8lO_w`)S*sr{)MP@*yt?;D>P%Z+_MTRn7=NTGql&k
za2-b{K;koC@9e-#QlJIpno?e(_zxve61enj9#orfh92@~o#?$rfCK2G<=|^4Xh1QH
zbo5>*encXsTteUAVR7r|OKiEnjbpbx>~`FAI^0MePcPzCzYGg)?mI#4n-CX8;sF10
Jo?KC36pI`dVqO3M

delta 902
zcmV;119|+o2g?VLEPr=eO;|WWM^a)<H)UsPd1+H|I5Rg`GiZ5IWJpL<YGH6yP+~$*
zF?CK>a|%;8R8w+Ed2v)hOnP)~a#CYLWLJ1KNKH>LXG1S|csN9ND_2r^acyF5V+t)k
zAaiqQEoEdfH8n9gAZv3lYcN3|PGWa<WNd6>Lq|0=Flb0gO-4a7L~n65Yhq7Rc2!C^
zWieH8bVY1+V@GOp3Q0?IYA<6^S8`EOcSUwIM=Mq@WlKhSLN`(~cu-9-Zfj6jab+|{
zSvY8Kk?|K-YF02aIW{?UHA`1ybxb!=WO7DiGgoqOW^HqKYDrNyM>9@UV>V+kWHLz#
zIB-N)IZ<k1cVb~MW<_~HW>+vaRdiEmVQoz^Rx(9HHBxj)D{N6%Gi*hZUjY|?FK}{G
zGd4;yOK@XRQ+6*aK~ritFg7bsbWuu6cWF>iQfhKkcv5I=FfmmMY&kb%d1X;gP<d7_
zYi>7YFhf&QT1#g!MR871Ry9INb7^R4D|JRtWmaPfEj}PRVlr%IEoX9NVRL05I$lOH
zAU0!qb0RV}WeR#`b7fOXM@VUZLP2a!Z(49kY)^AIQ%i3~ZF+DqRA)_OQ8-I!I9Ebx
zYBXecPH0(AQ*n4TOD}OkNqBT=T5&fDIAd@%N^43h3N0-yAZ2DUR%bJCVmMKGV>vQ-
zaaUALH8)meF;04KL~vwpWh+N(LQ64qHc@163V&`lo0Dgo=lI{_xDoDu`#B(H>x4M;
z%1Wo9&4V7jCM;6vq(j}Nyd}%l2IJ>~&|YIH@iQ?tm31ttydvpuoXG}!*NGB-NjWfW
zl^*cV0vad7*rNIiTt4kFQpY>DT=q;Jl!l$&F)en4pkLi?eBDHqFa1Z6KMJNUdt{A;
zAPoi;xm^VPL?QfCzIIf9;(Nz#6gzb`me|j5R+Rmoh&-zcbQuy>Ok`sl1*w@<t>r3i
zr6W;W6&+IMvBIqX*q1_7R|yJ$#M7Fk`Lg9tk|8Ef{0BA_QPCr8zFbk;vdk>YjAv^y
zLvHYP9it*hIViwu_CL5SbefJxVljfxE}t}3Fmbb<ML%#1W;QojACbkXIzP%0duDiE
z^d1yWD=mvv2FV#f&i54gJ3gdTRxa#F9UxxNG26hSAa-<mqF@nZw4{C=(t8ZSk&9E@
cO06$T7{KzMzo%3EdI^>heUveyeRz7%D)f(6MgRZ+