My NixOS module for the eduroam at FH Potsdam

eduroam.nix

{ config, pkgs, ... }:{

  networking.wireless = {
    enable = true;
    userControlled.enable = true;
    networks = {
      eduroam =
      let
        # define an awk script, that cuts one certificate out of the
        # ca-bundle.crt file
        cert = pkgs.stdenv.mkDerivation rec{
          name = "telesec-globalroot-class-2.pem";
          src = builtins.toFile "${name}-awk-helper" ''
            {
              if(a > 0) {
                print
              }
            }

            /-----END CERTIFICATE-----/ {
              a = 0
            }

            /T-TeleSec GlobalRoot Class 2/ {
              a = 1
            }
          '';
          nativeBuildInputs = with pkgs; [ cacert gawk ];
          phases = "installPhase";
          installPhase = "${pkgs.gawk}/bin/awk -f $src ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt > $out";
        };
      in
      {
        auth = ''
          key_mgmt=WPA-EAP
          eap=PEAP
          identity="s12345@fh-potsdam.de"
          password="mypassword"
          altsubject_match="DNS:dc1.campus.fh-potsdam.de"
          anonymous_identity="eduroam@fh-potsdam.de"
          phase2="auth=MSCHAPV2"
          ca_cert="${cert}"
        '';
      };
    };
  };
}