Add contest WiFi connection

contestops/configure-machines.sh

@@ -3,7 +3,7 @@
 set -ex
 
 # Disable WiFi.
-parallel-ssh -x "-F local.ssh_config" -h hostlist nmcli radio wifi off
+# parallel-ssh -x "-F local.ssh_config" -h hostlist nmcli radio wifi off
 
 # Create hosts file so we don't need DNS.
 parallel-scp -x "-F local.ssh_config" -h hostlist ./config-hosts /etc/hosts

os/build.py

@@ -174,6 +174,9 @@ def main():
         mkdir("config/includes.chroot/root/.ssh")
         run(["cp", f"{script_dir}/config/contestant_authorized_keys", "config/includes.chroot/root/.ssh/authorized_keys"])
 
+        edit_file("config/includes.chroot/etc/NetworkManager/system-connections/contest.nmconnection",
+            lambda s: s.replace("@wifi_password@", config["contestant_wifi_password"]))
+
     # Configure boot options.
     grub_boot_options = '\n'.join(
         f'menuentry "{option["label"]}" {{\n'

os/config-example/config.toml

@@ -4,3 +4,6 @@ install_admin_password = "$y$j9T$h5VhMd4KkdmbxdZD1gO0N/$1hvwZgO8pQw13Xd6jaNXbtkb
 
 # Example password: soi
 contestant_root_password = "$y$j9T$h5VhMd4KkdmbxdZD1gO0N/$1hvwZgO8pQw13Xd6jaNXbtkbqVOC4W/ia/KXOcCGYvB"
+
+# WiFi passwords must be at least 8 characters
+contestant_wifi_password = "12345678"

os/layers/contestant/hooks/live/2010-contestant.hook.chroot

@@ -25,3 +25,6 @@ $DISABLE_DESKTOP /usr/share/applications/gnome-sharing-panel.desktop
 # We want to load kexec manually, and execution of kexec is already done by systemd.
 systemctl disable kexec-load.service
 systemctl disable kexec.service
+
+# Restrict access to the config which contains the WiFi password.
+chmod og= /etc/NetworkManager/system-connections/contest.nmconnection

os/layers/contestant/includes.chroot/etc/NetworkManager/system-connections/contest.nmconnection

@@ -0,0 +1,20 @@
+[connection]
+id=contest
+uuid=b4b09615-f7b9-4777-baa0-7812d58a01dd
+type=wifi
+
+[wifi]
+mode=infrastructure
+ssid=contest
+
+[wifi-security]
+auth-alg=open
+key-mgmt=wpa-psk
+psk=@wifi_password@
+
+[ipv4]
+method=auto
+
+[ipv6]
+addr-gen-mode=default
+method=auto

os/layers/contestant/includes.chroot/etc/polkit-1/rules.d/50-lockdown.rules

@@ -7,7 +7,8 @@
 polkit.addRule(function (action, subject) {
   if (
     action.id.indexOf("org.freedesktop.ModemManager1.") === 0 ||
-    action.id.indexOf("org.freedesktop.NetworkManager.") === 0 ||
+    (action.id.indexOf("org.freedesktop.NetworkManager.") === 0 &&
+      action.id !== "org.freedesktop.NetworkManager.wifi.scan") ||
     action.id === "org.freedesktop.login1.hibernate" ||
     action.id === "org.freedesktop.packagekit.system-network-proxy-configure" ||
     action.id.indexOf("org.freedesktop.udisks2.") === 0

os/readme.md

@@ -119,6 +119,7 @@ Here is a list of features.
   - install and configure ssh server
   - set root password
   - set `authorized_keys` for root
+  - contest WiFi connection
   - automatic login
   - set browser homepage and bookmarks to https://contest.soi.ch
   - Gnome Shell extension which displays the user name in the top bar