.files/nix/configurations/iron/nixos/connectivity.nix

{
  config,
  lib,
  ...
}: {
  users.users.root.openssh.authorizedKeys.keys = let
    # TODO: put iron keys in identities
    ids = import ../../../identities.nix;
  in
    builtins.concatMap builtins.attrValues (builtins.attrValues ids);

  networking = {
    networkmanager.enable = lib.mkForce false;

    firewall.allowedTCPPorts = [
      8080

      # For 'localsend'
      # https://github.com/localsend/localsend?tab=readme-ov-file#setup
      53317
    ];

    # To enable roaming https://wiki.archlinux.org/title/Wpa_supplicant#Roaming
    wireless = {
      enable = true;
      userControlled.enable = true;
      secretsFile = config.age.secrets.wpa_password.path;
      scanOnLowSignal = false;
      networks = let
        # wpa_supplicant uses `strchr` to seek to the first `=`, so the only forbidden character is `=`.
        escapePwdKey = lib.replaceStrings ["="] ["_"];

        fromList = ns: let
          go = networkArgs @ {
            ssid,
            # Custom fields wrapping nixpkgs module options
            hasPassword ? false,
            scanOnLowSignal ? false,
            randomizeMac ? false,
            ...
          }: {
            ${ssid} = lib.mkMerge [
              (builtins.removeAttrs networkArgs ["ssid" "hasPassword" "scanOnLowSignal" "randomizeMac"])
              (lib.optionalAttrs hasPassword {
                pskRaw = "ext:${escapePwdKey ssid}";
              })
              (lib.optionalAttrs scanOnLowSignal {
                extraConfig = ''
                  bgscan="simple:30:-70:3600"
                '';
              })
              (lib.optionalAttrs randomizeMac {
                extraConfig = ''
                  mac_addr=1
                '';
              })
            ];
          };
        in
          lib.mkMerge (map go ns);
      in
        # TODO: move this upward like identities
        fromList (import ./connectivity/networks.nix);
    };
  };

  services.mullvad-vpn.enable = true;

  hardware.bluetooth.enable = true;
}