Desktop networking configuration

{
  lib,
  config,
  ...
}:
let
  cfg = config.mjm.desktop;
in
{
  config = lib.mkIf cfg.enable {
    <<config>>
  };

  _class = "nixos";
}

This module sets up networking for workstations, which generally has different needs than servers.

networking.networkmanager.enable = lib.mkDefault true;

By default, workstations use NetworkManager instead of networkd to configure network interfaces. networkd is great for machines that stay in one place and always use the same network setup. A workstation might be a laptop that moves to different places, needs to join different WiFi networks, maybe occasionally plug in to Ethernet directly. An imperative mechanism for managing that makes more sense.

networking.networkmanager.wifi.backend = "iwd";

I use the iwd backend instead of wpa_supplicant, because I think it just works better. It might also be the only one that works on Apple Silicon, but I could be wrong about that.

networking.networkmanager.settings.keyfile.path = "/var/lib/NetworkManager/system-connections";

Normally, NetworkManager stores configurations in /etc/NetworkManager, but on systems that erase their filesystem on every boot, that requires explicitly preserving that directory. /var is always preserved on my machines, so it's simpler to just configure NetworkManager to put things there instead.

systemd.services.NetworkManager-wait-online.enable = false;

The wait-online service for NetworkManager is a little fussy, if I remember right. I don't really want to block things on my workstations on not being able to get online, as that might be something that needs fixing once the system is up.

users.users.mjm.extraGroups = [ "networkmanager" ];

To be able to actually change NetworkManager from the desktop, the user needs to be in the networkmanager group. This doesn't seem to need to be conditionalized on whether NetworkManager is actually enabled: if a specific machine disables NetworkManager, the group won't exist and it will be silently dropped.

services.resolved.enable = true;

I use systemd-resolved as a local caching DNS resolver on all of my machines. It needs to be enabled explicitly here because NetworkManager won't enable it by default but networkd will. resolved gets along just fine with NetworkManager: NixOS will configure NetworkManager to use resolved if both are enabled.

services.avahi = {
  enable = true;
  openFirewall = true;
};

While systemd-resolved has some basic mDNS support, it doesn't include everything that Avahi does, and some things won't work without actual Avahi.

services.resolved.settings.Resolve.MulticastDNS = "resolve";

Both resolved and Avahi will try to respond to mDNS out of the box. Setting MulticastDNS to "resolve" means that resolved can still answer mDNS queries, but it doesn't try to respond, leaving that responsibility to Avahi. I think this is generally the right way to use these two things together.