wren-linux / docs / wifi.md (as plain text)
wifi.sh
It finds your Wi-Fi card, turns it on if it's blocked in software, shows
nearby networks, asks for the name and password, connects, and saves the
network so it reconnects at boot. Wrong passwords are caught and you get
three tries. Once install-base.sh has run, NetworkManager takes over
and nmtui is the everyday tool; wifi.sh is for getting online the
first time, or rescuing a broken setup.
It uses the first of these that works:
| What's installed | How it connects | Saved for boot by |
|---|---|---|
| NetworkManager (running) | nmcli | NetworkManager |
| iwd | iwctl | iwd (it also enables iwd's own DHCP) |
| wpa_supplicant + ifupdown + dhcpcd/dhclient | checks the password, then ifup | /etc/network/interfaces.d/wren-wifi-<dev> |
| wpa_supplicant without a DHCP client | wpa_supplicant@<dev> service | that service + systemd-networkd |
| nothing | installs wpasupplicant from offline/debs/, then as above | |
nothing, and no offline/debs/ | asks for Ethernet or USB tethering, installs wpasupplicant with apt |
It also handles a missing firmware (installs it from offline/debs/ and reloads
the driver), Wi-Fi switched off in hardware, hidden and open networks,
an installer that already set up Wi-Fi (asks first, keeps a backup of
/etc/network/interfaces), and getting an address without any DHCP
client (systemd-networkd, or busybox). USB tethering from a phone shows
up as a wired network, so it works with no Wi-Fi software at all.
Packages from the USB stick are checked
Debian's packages aren't signed one by one. The archive signs a list of
the packages' hashes instead, so prep/fetch-offline-debs.sh saves those
signed lists in offline/debs/verify/ next to the .deb files. Before
wifi.sh installs anything from the stick (as root), it checks the lists
against Debian's archive keyring, which is already on every Debian system,
and then every package against the lists. A package that was changed, or
added, or that isn't Debian's, stops the installation. `bash
prep/fetch-offline-debs.sh --check` refreshes the lists and checks what you
have saved; bash test.sh also checks it, without internet.
While secure DNS (parts/secure-dns.sh) is switched on, wifi.sh leaves /etc/resolv.conf alone
(it points at Unbound on this computer), and wifi.sh --remove doesn't put its
old copy back over it.
Passwords
wifi.sh never puts your Wi-Fi password on a command line, where any
program running on the computer could read it: NetworkManager gets it on
its standard input, iwd from a file only root can read, and wpa_supplicant
from a config file only root can read. If your nmcli doesn't accept the
password that way, WREN_PASSWORD_ON_COMMAND_LINE=1 bash wifi.sh uses
the old way.
Removing it: wifi.sh --remove
For a computer that doesn't need Wi-Fi (or no longer does), bash wifi.sh --remove
undoes what wifi.sh set up by hand: the wpa_supplicant files it marked as its
own and their services, its ifupdown stanzas, its systemd-networkd files and
the DNS file it saved (which it puts back). Files of yours with similar names are
left alone, and no package is removed.
It then offers to remove the other Wi-Fi pieces Wren Linux installs, NetworkManager
and the random Wi-Fi address, leaving only the wired connection. Say no and it
prints the two commands for later. install-base.sh skips both on a computer
with no Wi-Fi adapter to begin with.