nixpkgs/nixos/doc/manual/from_md/configuration/wireless.section.xml

<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-wireless">
  <title>Wireless Networks</title>
  <para>
    For a desktop installation using NetworkManager (e.g., GNOME), you
    just have to make sure the user is in the
    <literal>networkmanager</literal> group and you can skip the rest of
    this section on wireless networks.
  </para>
  <para>
    NixOS will start wpa_supplicant for you if you enable this setting:
  </para>
  <programlisting language="bash">
networking.wireless.enable = true;
</programlisting>
  <para>
    NixOS lets you specify networks for wpa_supplicant declaratively:
  </para>
  <programlisting language="bash">
networking.wireless.networks = {
  echelon = {                # SSID with no spaces or special characters
    psk = &quot;abcdefgh&quot;;
  };
  &quot;echelon's AP&quot; = {         # SSID with spaces and/or special characters
    psk = &quot;ijklmnop&quot;;
  };
  echelon = {                # Hidden SSID
    hidden = true;
    psk = &quot;qrstuvwx&quot;;
  };
  free.wifi = {};            # Public wireless network
};
</programlisting>
  <para>
    Be aware that keys will be written to the nix store in plaintext!
    When no networks are set, it will default to using a configuration
    file at <literal>/etc/wpa_supplicant.conf</literal>. You should edit
    this file yourself to define wireless networks, WPA keys and so on
    (see wpa_supplicant.conf(5)).
  </para>
  <para>
    If you are using WPA2 you can generate pskRaw key using
    <literal>wpa_passphrase</literal>:
  </para>
  <programlisting>
$ wpa_passphrase ESSID PSK
network={
        ssid=&quot;echelon&quot;
        #psk=&quot;abcdefgh&quot;
        psk=dca6d6ed41f4ab5a984c9f55f6f66d4efdc720ebf66959810f4329bb391c5435
}
</programlisting>
  <programlisting language="bash">
networking.wireless.networks = {
  echelon = {
    pskRaw = &quot;dca6d6ed41f4ab5a984c9f55f6f66d4efdc720ebf66959810f4329bb391c5435&quot;;
  };
}
</programlisting>
  <para>
    or you can use it to directly generate the
    <literal>wpa_supplicant.conf</literal>:
  </para>
  <programlisting>
# wpa_passphrase ESSID PSK &gt; /etc/wpa_supplicant.conf
</programlisting>
  <para>
    After you have edited the <literal>wpa_supplicant.conf</literal>,
    you need to restart the wpa_supplicant service.
  </para>
  <programlisting>
# systemctl restart wpa_supplicant.service
</programlisting>
</section>