nixpkgs/nixos/doc/manual/configuration/wireless.xml

<section xmlns="http://docbook.org/ns/docbook"
         xmlns:xlink="http://www.w3.org/1999/xlink"
         xmlns:xi="http://www.w3.org/2001/XInclude"
         version="5.0"
         xml:id="sec-wireless">
 <title>Wireless Networks</title>

 <para>
  For a desktop installation using NetworkManager (e.g., GNOME), you just have
  to make sure the user is in the <code>networkmanager</code> group and you can
  skip the rest of this section on wireless networks.
 </para>

 <para>
  NixOS will start wpa_supplicant for you if you enable this setting:
<programlisting>
<xref linkend="opt-networking.wireless.enable"/> = true;
</programlisting>
  NixOS lets you specify networks for wpa_supplicant declaratively:
<programlisting>
<xref linkend="opt-networking.wireless.networks"/> = {
  echelon = {
    psk = "abcdefgh";
  };
  "free.wifi" = {};
}
</programlisting>
  Be aware that keys will be written to the nix store in plaintext! When no
  networks are set, it will default to using a configuration file at
  <literal>/etc/wpa_supplicant.conf</literal>. You should edit this file
  yourself to define wireless networks, WPA keys and so on (see
  <citerefentry>
    <refentrytitle>wpa_supplicant.conf</refentrytitle>
    <manvolnum>5</manvolnum>
  </citerefentry>).
 </para>

 <para>
  If you are using WPA2 you can generate pskRaw key using
  <command>wpa_passphrase</command>:
<screen>
$ wpa_passphrase ESSID PSK
network={
        ssid="echelon"
        #psk="abcdefgh"
        psk=dca6d6ed41f4ab5a984c9f55f6f66d4efdc720ebf66959810f4329bb391c5435
}
</screen>
<programlisting>
<xref linkend="opt-networking.wireless.networks"/> = {
  echelon = {
    pskRaw = "dca6d6ed41f4ab5a984c9f55f6f66d4efdc720ebf66959810f4329bb391c5435";
  };
}
</programlisting>
  or you can use it to directly generate the
  <literal>wpa_supplicant.conf</literal>:
<screen>
# wpa_passphrase ESSID PSK > /etc/wpa_supplicant.conf</screen>
  After you have edited the <literal>wpa_supplicant.conf</literal>, you need to
  restart the wpa_supplicant service.
<screen>
# systemctl restart wpa_supplicant.service</screen>
 </para>
</section>