nix-config/patches/PR/365727.diff

diff --git a/nixos/modules/services/networking/hostapd.nix b/nixos/modules/services/networking/hostapd.nix
index 8635dea738ce2..28dd6db874bc4 100644
--- a/nixos/modules/services/networking/hostapd.nix
+++ b/nixos/modules/services/networking/hostapd.nix
@@ -1,4 +1,10 @@
-{ config, lib, pkgs, utils, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  utils,
+  ...
+}:
 # All hope abandon ye who enter here. hostapd's configuration
 # format is ... special, and you won't be able to infer any
 # of their assumptions from just reading the "documentation"
@@ -6,8 +12,7 @@
 # to make informed decisions you will probably need to look
 # at hostapd's code. You have been warned, proceed with care.
 let
-  inherit
-    (lib)
+  inherit (lib)
     attrNames
     attrValues
     concatLists
@@ -16,11 +21,11 @@ let
     count
     escapeShellArg
     filter
-    flip
     generators
     getAttr
     hasPrefix
     imap0
+    imap1
     isInt
     isString
     length
@@ -45,68 +50,97 @@ let
   cfg = config.services.hostapd;
 
   extraSettingsFormat = {
-    type = let
-      singleAtom = types.oneOf [ types.bool types.int types.str ];
-      atom = types.either singleAtom (types.listOf singleAtom) // {
-        description = "atom (bool, int or string) or a list of them for duplicate keys";
-      };
-    in types.attrsOf atom;
-
-    generate = name: value: pkgs.writeText name (generators.toKeyValue {
-      listsAsDuplicateKeys = true;
-      mkKeyValue = generators.mkKeyValueDefault {
-        mkValueString = v:
-          if      isInt    v then toString v
-          else if isString v then v
-          else if true  == v then "1"
-          else if false == v then "0"
-          else throw "unsupported type ${builtins.typeOf v}: ${(generators.toPretty {}) v}";
-      } "=";
-    } value);
+    type =
+      let
+        singleAtom = types.oneOf [
+          types.bool
+          types.int
+          types.str
+        ];
+        atom = types.either singleAtom (types.listOf singleAtom) // {
+          description = "atom (bool, int or string) or a list of them for duplicate keys";
+        };
+      in
+      types.attrsOf atom;
+
+    generate =
+      name: value:
+      pkgs.writeText name (
+        generators.toKeyValue {
+          listsAsDuplicateKeys = true;
+          mkKeyValue = generators.mkKeyValueDefault {
+            mkValueString =
+              v:
+              if isInt v then
+                toString v
+              else if isString v then
+                v
+              else if true == v then
+                "1"
+              else if false == v then
+                "0"
+              else
+                throw "unsupported type ${builtins.typeOf v}: ${(generators.toPretty { }) v}";
+          } "=";
+        } value
+      );
   };
 
   # Generates the header for a single BSS (i.e. WiFi network)
-  writeBssHeader = radio: bss: bssIdx: pkgs.writeText "hostapd-radio-${radio}-bss-${bss}.conf" ''
-    ''\n''\n# BSS ${toString bssIdx}: ${bss}
-    ################################
-
-    ${if bssIdx == 0 then "interface" else "bss"}=${bss}
-  '';
-
-  makeRadioRuntimeFiles = radio: radioCfg:
-    pkgs.writeShellScript "make-hostapd-${radio}-files" (''
-      set -euo pipefail
-
-      hostapd_config_file=/run/hostapd/${escapeShellArg radio}.hostapd.conf
-      rm -f "$hostapd_config_file"
-      cat > "$hostapd_config_file" <<EOF
-      # Radio base configuration: ${radio}
+  writeBssHeader =
+    radio: bss: bssIdx:
+    pkgs.writeText "hostapd-radio-${radio}-bss-${bss}.conf" ''
+      ''\n''\n# BSS ${toString bssIdx}: ${bss}
       ################################
 
-      EOF
-
-      cat ${escapeShellArg (extraSettingsFormat.generate "hostapd-radio-${radio}-extra.conf" radioCfg.settings)} >> "$hostapd_config_file"
-      ${concatMapStrings (script: "${script} \"$hostapd_config_file\"\n") (attrValues radioCfg.dynamicConfigScripts)}
-    ''
-    + concatMapStrings (x: "${x}\n") (imap0 (i: f: f i)
-      (mapAttrsToList (bss: bssCfg: bssIdx: ''
-        ''\n# BSS configuration: ${bss}
-
-        mac_allow_file=/run/hostapd/${escapeShellArg bss}.mac.allow
-        rm -f "$mac_allow_file"
-        touch "$mac_allow_file"
-
-        mac_deny_file=/run/hostapd/${escapeShellArg bss}.mac.deny
-        rm -f "$mac_deny_file"
-        touch "$mac_deny_file"
+      ${if bssIdx == 0 then "interface" else "bss"}=${bss}
+    '';
 
-        cat ${writeBssHeader radio bss bssIdx} >> "$hostapd_config_file"
-        cat ${escapeShellArg (extraSettingsFormat.generate "hostapd-radio-${radio}-bss-${bss}-extra.conf" bssCfg.settings)} >> "$hostapd_config_file"
-        ${concatMapStrings (script: "${script} \"$hostapd_config_file\" \"$mac_allow_file\" \"$mac_deny_file\"\n") (attrValues bssCfg.dynamicConfigScripts)}
-      '') radioCfg.networks)));
+  makeRadioRuntimeFiles =
+    radio: radioCfg:
+    pkgs.writeShellScript "make-hostapd-${radio}-files" (
+      ''
+        set -euo pipefail
+
+        hostapd_config_file=/run/hostapd/${escapeShellArg radio}.hostapd.conf
+        rm -f "$hostapd_config_file"
+        cat > "$hostapd_config_file" <<EOF
+        # Radio base configuration: ${radio}
+        ################################
+
+        EOF
+
+        cat ${escapeShellArg (extraSettingsFormat.generate "hostapd-radio-${radio}-extra.conf" radioCfg.settings)} >> "$hostapd_config_file"
+        ${concatMapStrings (script: "${script} \"$hostapd_config_file\"\n") (
+          attrValues radioCfg.dynamicConfigScripts
+        )}
+      ''
+      + concatMapStrings (x: "${x}\n") (
+        imap0 (i: f: f i) (
+          mapAttrsToList (bss: bssCfg: bssIdx: ''
+            ''\n# BSS configuration: ${bss}
+
+            mac_allow_file=/run/hostapd/${escapeShellArg bss}.mac.allow
+            rm -f "$mac_allow_file"
+            touch "$mac_allow_file"
+
+            mac_deny_file=/run/hostapd/${escapeShellArg bss}.mac.deny
+            rm -f "$mac_deny_file"
+            touch "$mac_deny_file"
+
+            cat ${writeBssHeader radio bss bssIdx} >> "$hostapd_config_file"
+            cat ${escapeShellArg (extraSettingsFormat.generate "hostapd-radio-${radio}-bss-${bss}-extra.conf" bssCfg.settings)} >> "$hostapd_config_file"
+            ${concatMapStrings (
+              script: "${script} \"$hostapd_config_file\" \"$mac_allow_file\" \"$mac_deny_file\"\n"
+            ) (attrValues bssCfg.dynamicConfigScripts)}
+          '') radioCfg.networks
+        )
+      )
+    );
 
   runtimeConfigFiles = mapAttrsToList (radio: _: "/run/hostapd/${radio}.hostapd.conf") cfg.radios;
-in {
+in
+{
   meta.maintainers = with maintainers; [ oddlama ];
 
   options = {
@@ -118,10 +152,10 @@ in {
         authentication server
       '';
 
-      package = mkPackageOption pkgs "hostapd" {};
+      package = mkPackageOption pkgs "hostapd" { };
 
       radios = mkOption {
-        default = {};
+        default = { };
         example = literalExpression ''
           {
             # Simple 2.4GHz AP
@@ -129,7 +163,7 @@ in {
               # countryCode = "US";
               networks.wlp2s0 = {
                 ssid = "AP 1";
-                authentication.saePasswords = [{ password = "a flakey password"; }]; # Use saePasswordsFile if possible.
+                authentication.saePasswords = [{ passwordFile = "/run/secrets/my-password"; }];
               };
             };
 
@@ -140,7 +174,7 @@ in {
               # countryCode = "US";
               networks.wlp3s0 = {
                 ssid = "My AP";
-                authentication.saePasswords = [{ password = "a flakey password"; }]; # Use saePasswordsFile if possible.
+                authentication.saePasswords = [{ passwordFile = "/run/secrets/my-password"; }];
               };
               networks.wlp3s0-1 = {
                 ssid = "Open AP with WiFi5";
@@ -176,990 +210,1164 @@ in {
           and supports configuring multiple APs (Refer to valid interface combinations in
           {command}`iw list`).
         '';
-        type = types.attrsOf (types.submodule (radioSubmod: {
-          options = {
-            driver = mkOption {
-              default = "nl80211";
-              example = "none";
-              type = types.str;
-              description = ''
-                The driver {command}`hostapd` will use.
-                {var}`nl80211` is used with all Linux mac80211 drivers.
-                {var}`none` is used if building a standalone RADIUS server that does
-                not control any wireless/wired driver.
-                Most applications will probably use the default.
-              '';
-            };
-
-            noScan = mkOption {
-              type = types.bool;
-              default = false;
-              description = ''
-                Disables scan for overlapping BSSs in HT40+/- mode.
-                Caution: turning this on will likely violate regulatory requirements!
-              '';
-            };
-
-            countryCode = mkOption {
-              default = null;
-              example = "US";
-              type = types.nullOr types.str;
-              description = ''
-                Country code (ISO/IEC 3166-1). Used to set regulatory domain.
-                Set as needed to indicate country in which device is operating.
-                This can limit available channels and transmit power.
-                These two octets are used as the first two octets of the Country String
-                (dot11CountryString).
-
-                Setting this will force you to also enable IEEE 802.11d and IEEE 802.11h.
-
-                IEEE 802.11d: This advertises the countryCode and the set of allowed channels
-                and transmit power levels based on the regulatory limits.
-
-                IEEE802.11h: This enables radar detection and DFS (Dynamic Frequency Selection)
-                support if available. DFS support is required on outdoor 5 GHz channels in most
-                countries of the world.
-              '';
-            };
-
-            band = mkOption {
-              default = "2g";
-              type = types.enum ["2g" "5g" "6g" "60g"];
-              description = ''
-                Specifies the frequency band to use, possible values are 2g for 2.4 GHz,
-                5g for 5 GHz, 6g for 6 GHz and 60g for 60 GHz.
-              '';
-            };
-
-            channel = mkOption {
-              default = 0;
-              example = 11;
-              type = types.int;
-              description = ''
-                The channel to operate on. Use 0 to enable ACS (Automatic Channel Selection).
-                Beware that not every device supports ACS in which case {command}`hostapd`
-                will fail to start.
-              '';
-            };
-
-            settings = mkOption {
-              default = {};
-              example = { acs_exclude_dfs = true; };
-              type = types.submodule {
-                freeformType = extraSettingsFormat.type;
+        type = types.attrsOf (
+          types.submodule (radioSubmod: {
+            options = {
+              driver = mkOption {
+                default = "nl80211";
+                example = "none";
+                type = types.str;
+                description = ''
+                  The driver {command}`hostapd` will use.
+                  {var}`nl80211` is used with all Linux mac80211 drivers.
+                  {var}`none` is used if building a standalone RADIUS server that does
+                  not control any wireless/wired driver.
+                  Most applications will probably use the default.
+                '';
               };
-              description = ''
-                Extra configuration options to put at the end of global initialization, before defining BSSs.
-                To find out which options are global and which are per-bss you have to read hostapd's source code,
-                which is non-trivial and not documented otherwise.
-
-                Lists will be converted to multiple definitions of the same key, and booleans to 0/1.
-                Otherwise, the inputs are not modified or checked for correctness.
-              '';
-            };
 
-            dynamicConfigScripts = mkOption {
-              default = {};
-              type = types.attrsOf types.path;
-              example = literalExpression ''
-                {
-                  exampleDynamicConfig = pkgs.writeShellScript "dynamic-config" '''
-                    HOSTAPD_CONFIG=$1
-
-                    cat >> "$HOSTAPD_CONFIG" << EOF
-                    # Add some dynamically generated statements here,
-                    # for example based on the physical adapter in use
-                    EOF
-                  ''';
-                }
-              '';
-              description = ''
-                All of these scripts will be executed in lexicographical order before hostapd
-                is started, right after the global segment was generated and may dynamically
-                append global options the generated configuration file.
-
-                The first argument will point to the configuration file that you may append to.
-              '';
-            };
-
-            #### IEEE 802.11n (WiFi 4) related configuration
-
-            wifi4 = {
-              enable = mkOption {
-                default = true;
+              noScan = mkOption {
                 type = types.bool;
+                default = false;
                 description = ''
-                  Enables support for IEEE 802.11n (WiFi 4, HT).
-                  This is enabled by default, since the vase majority of devices
-                  are expected to support this.
+                  Disables scan for overlapping BSSs in HT40+/- mode.
+                  Caution: turning this on will likely violate regulatory requirements!
                 '';
               };
 
-              capabilities = mkOption {
-                type = types.listOf types.str;
-                default = ["HT40" "SHORT-GI-20" "SHORT-GI-40"];
-                example = ["LDPC" "HT40+" "HT40-" "GF" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1"];
+              countryCode = mkOption {
+                default = null;
+                example = "US";
+                type = types.nullOr types.str;
                 description = ''
-                  HT (High Throughput) capabilities given as a list of flags.
-                  Please refer to the hostapd documentation for allowed values and
-                  only set values supported by your physical adapter.
-
-                  The default contains common values supported by most adapters.
-                '';
-              };
+                  Country code (ISO/IEC 3166-1). Used to set regulatory domain.
+                  Set as needed to indicate country in which device is operating.
+                  This can limit available channels and transmit power.
+                  These two octets are used as the first two octets of the Country String
+                  (dot11CountryString).
 
-              require = mkOption {
-                default = false;
-                type = types.bool;
-                description = "Require stations (clients) to support WiFi 4 (HT) and disassociate them if they don't.";
-              };
-            };
+                  Setting this will force you to also enable IEEE 802.11d and IEEE 802.11h.
 
-            #### IEEE 802.11ac (WiFi 5) related configuration
+                  IEEE 802.11d: This advertises the countryCode and the set of allowed channels
+                  and transmit power levels based on the regulatory limits.
 
-            wifi5 = {
-              enable = mkOption {
-                default = true;
-                type = types.bool;
-                description = "Enables support for IEEE 802.11ac (WiFi 5, VHT)";
+                  IEEE802.11h: This enables radar detection and DFS (Dynamic Frequency Selection)
+                  support if available. DFS support is required on outdoor 5 GHz channels in most
+                  countries of the world.
+                '';
               };
 
-              capabilities = mkOption {
-                type = types.listOf types.str;
-                default = [];
-                example = ["SHORT-GI-80" "TX-STBC-2BY1" "RX-STBC-1" "RX-ANTENNA-PATTERN" "TX-ANTENNA-PATTERN"];
+              band = mkOption {
+                default = "2g";
+                type = types.enum [
+                  "2g"
+                  "5g"
+                  "6g"
+                  "60g"
+                ];
                 description = ''
-                  VHT (Very High Throughput) capabilities given as a list of flags.
-                  Please refer to the hostapd documentation for allowed values and
-                  only set values supported by your physical adapter.
+                  Specifies the frequency band to use, possible values are 2g for 2.4 GHz,
+                  5g for 5 GHz, 6g for 6 GHz and 60g for 60 GHz.
                 '';
               };
 
-              require = mkOption {
-                default = false;
-                type = types.bool;
-                description = "Require stations (clients) to support WiFi 5 (VHT) and disassociate them if they don't.";
+              channel = mkOption {
+                default = 0;
+                example = 11;
+                type = types.int;
+                description = ''
+                  The channel to operate on. Use 0 to enable ACS (Automatic Channel Selection).
+                  Beware that not every device supports ACS in which case {command}`hostapd`
+                  will fail to start.
+                '';
               };
 
-              operatingChannelWidth = mkOption {
-                default = "20or40";
-                type = types.enum ["20or40" "80" "160" "80+80"];
-                apply = x:
-                  getAttr x {
-                    "20or40" = 0;
-                    "80" = 1;
-                    "160" = 2;
-                    "80+80" = 3;
-                  };
+              settings = mkOption {
+                default = { };
+                example = {
+                  acs_exclude_dfs = true;
+                };
+                type = types.submodule {
+                  freeformType = extraSettingsFormat.type;
+                };
                 description = ''
-                  Determines the operating channel width for VHT.
+                  Extra configuration options to put at the end of global initialization, before defining BSSs.
+                  To find out which options are global and which are per-bss you have to read hostapd's source code,
+                  which is non-trivial and not documented otherwise.
 
-                  - {var}`"20or40"`: 20 or 40 MHz operating channel width
-                  - {var}`"80"`: 80 MHz channel width
-                  - {var}`"160"`: 160 MHz channel width
-                  - {var}`"80+80"`: 80+80 MHz channel width
+                  Lists will be converted to multiple definitions of the same key, and booleans to 0/1.
+                  Otherwise, the inputs are not modified or checked for correctness.
                 '';
               };
-            };
 
-            #### IEEE 802.11ax (WiFi 6) related configuration
+              dynamicConfigScripts = mkOption {
+                default = { };
+                type = types.attrsOf types.path;
+                example = literalExpression ''
+                  {
+                    exampleDynamicConfig = pkgs.writeShellScript "dynamic-config" '''
+                      HOSTAPD_CONFIG=$1
+
+                      cat >> "$HOSTAPD_CONFIG" << EOF
+                      # Add some dynamically generated statements here,
+                      # for example based on the physical adapter in use
+                      EOF
+                    ''';
+                  }
+                '';
+                description = ''
+                  All of these scripts will be executed in lexicographical order before hostapd
+                  is started, right after the global segment was generated and may dynamically
+                  append global options the generated configuration file.
 
-            wifi6 = {
-              enable = mkOption {
-                default = false;
-                type = types.bool;
-                description = "Enables support for IEEE 802.11ax (WiFi 6, HE)";
+                  The first argument will point to the configuration file that you may append to.
+                '';
               };
 
-              require = mkOption {
-                default = false;
-                type = types.bool;
-                description = "Require stations (clients) to support WiFi 6 (HE) and disassociate them if they don't.";
-              };
+              #### IEEE 802.11n (WiFi 4) related configuration
+
+              wifi4 = {
+                enable = mkOption {
+                  default = true;
+                  type = types.bool;
+                  description = ''
+                    Enables support for IEEE 802.11n (WiFi 4, HT).
+                    This is enabled by default, since the vase majority of devices
+                    are expected to support this.
+                  '';
+                };
 
-              singleUserBeamformer = mkOption {
-                default = false;
-                type = types.bool;
-                description = "HE single user beamformer support";
-              };
+                capabilities = mkOption {
+                  type = types.listOf types.str;
+                  default = [
+                    "HT40"
+                    "SHORT-GI-20"
+                    "SHORT-GI-40"
+                  ];
+                  example = [
+                    "LDPC"
+                    "HT40+"
+                    "HT40-"
+                    "GF"
+                    "SHORT-GI-20"
+                    "SHORT-GI-40"
+                    "TX-STBC"
+                    "RX-STBC1"
+                  ];
+                  description = ''
+                    HT (High Throughput) capabilities given as a list of flags.
+                    Please refer to the hostapd documentation for allowed values and
+                    only set values supported by your physical adapter.
+
+                    The default contains common values supported by most adapters.
+                  '';
+                };
 
-              singleUserBeamformee = mkOption {
-                default = false;
-                type = types.bool;
-                description = "HE single user beamformee support";
+                require = mkOption {
+                  default = false;
+                  type = types.bool;
+                  description = "Require stations (clients) to support WiFi 4 (HT) and disassociate them if they don't.";
+                };
               };
 
-              multiUserBeamformer = mkOption {
-                default = false;
-                type = types.bool;
-                description = "HE multi user beamformee support";
-              };
+              #### IEEE 802.11ac (WiFi 5) related configuration
 
-              operatingChannelWidth = mkOption {
-                default = "20or40";
-                type = types.enum ["20or40" "80" "160" "80+80"];
-                apply = x:
-                  getAttr x {
-                    "20or40" = 0;
-                    "80" = 1;
-                    "160" = 2;
-                    "80+80" = 3;
-                  };
-                description = ''
-                  Determines the operating channel width for HE.
+              wifi5 = {
+                enable = mkOption {
+                  default = true;
+                  type = types.bool;
+                  description = "Enables support for IEEE 802.11ac (WiFi 5, VHT)";
+                };
 
-                  - {var}`"20or40"`: 20 or 40 MHz operating channel width
-                  - {var}`"80"`: 80 MHz channel width
-                  - {var}`"160"`: 160 MHz channel width
-                  - {var}`"80+80"`: 80+80 MHz channel width
-                '';
-              };
-            };
+                capabilities = mkOption {
+                  type = types.listOf types.str;
+                  default = [ ];
+                  example = [
+                    "SHORT-GI-80"
+                    "TX-STBC-2BY1"
+                    "RX-STBC-1"
+                    "RX-ANTENNA-PATTERN"
+                    "TX-ANTENNA-PATTERN"
+                  ];
+                  description = ''
+                    VHT (Very High Throughput) capabilities given as a list of flags.
+                    Please refer to the hostapd documentation for allowed values and
+                    only set values supported by your physical adapter.
+                  '';
+                };
 
-            #### IEEE 802.11be (WiFi 7) related configuration
+                require = mkOption {
+                  default = false;
+                  type = types.bool;
+                  description = "Require stations (clients) to support WiFi 5 (VHT) and disassociate them if they don't.";
+                };
 
-            wifi7 = {
-              enable = mkOption {
-                default = false;
-                type = types.bool;
-                description = ''
-                  Enables support for IEEE 802.11be (WiFi 7, EHT). This is currently experimental
-                  and requires you to manually enable CONFIG_IEEE80211BE when building hostapd.
-                '';
+                operatingChannelWidth = mkOption {
+                  default = "20or40";
+                  type = types.enum [
+                    "20or40"
+                    "80"
+                    "160"
+                    "80+80"
+                  ];
+                  apply =
+                    x:
+                    getAttr x {
+                      "20or40" = 0;
+                      "80" = 1;
+                      "160" = 2;
+                      "80+80" = 3;
+                    };
+                  description = ''
+                    Determines the operating channel width for VHT.
+
+                    - {var}`"20or40"`: 20 or 40 MHz operating channel width
+                    - {var}`"80"`: 80 MHz channel width
+                    - {var}`"160"`: 160 MHz channel width
+                    - {var}`"80+80"`: 80+80 MHz channel width
+                  '';
+                };
               };
 
-              singleUserBeamformer = mkOption {
-                default = false;
-                type = types.bool;
-                description = "EHT single user beamformer support";
-              };
+              #### IEEE 802.11ax (WiFi 6) related configuration
 
-              singleUserBeamformee = mkOption {
-                default = false;
-                type = types.bool;
-                description = "EHT single user beamformee support";
+              wifi6 = {
+                enable = mkOption {
+                  default = false;
+                  type = types.bool;
+                  description = "Enables support for IEEE 802.11ax (WiFi 6, HE)";
+                };
+
+                require = mkOption {
+                  default = false;
+                  type = types.bool;
+                  description = "Require stations (clients) to support WiFi 6 (HE) and disassociate them if they don't.";
+                };
+
+                singleUserBeamformer = mkOption {
+                  default = false;
+                  type = types.bool;
+                  description = "HE single user beamformer support";
+                };
+
+                singleUserBeamformee = mkOption {
+                  default = false;
+                  type = types.bool;
+                  description = "HE single user beamformee support";
+                };
+
+                multiUserBeamformer = mkOption {
+                  default = false;
+                  type = types.bool;
+                  description = "HE multi user beamformee support";
+                };
+
+                operatingChannelWidth = mkOption {
+                  default = "20or40";
+                  type = types.enum [
+                    "20or40"
+                    "80"
+                    "160"
+                    "80+80"
+                  ];
+                  apply =
+                    x:
+                    getAttr x {
+                      "20or40" = 0;
+                      "80" = 1;
+                      "160" = 2;
+                      "80+80" = 3;
+                    };
+                  description = ''
+                    Determines the operating channel width for HE.
+
+                    - {var}`"20or40"`: 20 or 40 MHz operating channel width
+                    - {var}`"80"`: 80 MHz channel width
+                    - {var}`"160"`: 160 MHz channel width
+                    - {var}`"80+80"`: 80+80 MHz channel width
+                  '';
+                };
               };
 
-              multiUserBeamformer = mkOption {
-                default = false;
-                type = types.bool;
-                description = "EHT multi user beamformee support";
+              #### IEEE 802.11be (WiFi 7) related configuration
+
+              wifi7 = {
+                enable = mkOption {
+                  default = false;
+                  type = types.bool;
+                  description = ''
+                    Enables support for IEEE 802.11be (WiFi 7, EHT). This is currently experimental
+                    and requires you to manually enable CONFIG_IEEE80211BE when building hostapd.
+                  '';
+                };
+
+                singleUserBeamformer = mkOption {
+                  default = false;
+                  type = types.bool;
+                  description = "EHT single user beamformer support";
+                };
+
+                singleUserBeamformee = mkOption {
+                  default = false;
+                  type = types.bool;
+                  description = "EHT single user beamformee support";
+                };
+
+                multiUserBeamformer = mkOption {
+                  default = false;
+                  type = types.bool;
+                  description = "EHT multi user beamformee support";
+                };
+
+                operatingChannelWidth = mkOption {
+                  default = "20or40";
+                  type = types.enum [
+                    "20or40"
+                    "80"
+                    "160"
+                    "80+80"
+                  ];
+                  apply =
+                    x:
+                    getAttr x {
+                      "20or40" = 0;
+                      "80" = 1;
+                      "160" = 2;
+                      "80+80" = 3;
+                    };
+                  description = ''
+                    Determines the operating channel width for EHT.
+
+                    - {var}`"20or40"`: 20 or 40 MHz operating channel width
+                    - {var}`"80"`: 80 MHz channel width
+                    - {var}`"160"`: 160 MHz channel width
+                    - {var}`"80+80"`: 80+80 MHz channel width
+                  '';
+                };
               };
 
-              operatingChannelWidth = mkOption {
-                default = "20or40";
-                type = types.enum ["20or40" "80" "160" "80+80"];
-                apply = x:
-                  getAttr x {
-                    "20or40" = 0;
-                    "80" = 1;
-                    "160" = 2;
-                    "80+80" = 3;
-                  };
-                description = ''
-                  Determines the operating channel width for EHT.
+              #### BSS definitions
 
-                  - {var}`"20or40"`: 20 or 40 MHz operating channel width
-                  - {var}`"80"`: 80 MHz channel width
-                  - {var}`"160"`: 160 MHz channel width
-                  - {var}`"80+80"`: 80+80 MHz channel width
+              networks = mkOption {
+                default = { };
+                example = literalExpression ''
+                  {
+                    wlp2s0 = {
+                      ssid = "Primary advertised network";
+                      authentication.saePasswords = [{ passwordFile = "/run/secrets/my-password"; }];
+                    };
+                    wlp2s0-1 = {
+                      ssid = "Secondary advertised network (Open)";
+                      authentication.mode = "none";
+                    };
+                  }
                 '';
-              };
-            };
+                description = ''
+                  This defines a BSS, colloquially known as a WiFi network.
+                  You have to specify at least one.
+                '';
+                type = types.attrsOf (
+                  types.submodule (bssSubmod: {
+                    options = {
+                      logLevel = mkOption {
+                        default = 2;
+                        type = types.int;
+                        description = ''
+                          Levels (minimum value for logged events):
+                          0 = verbose debugging
+                          1 = debugging
+                          2 = informational messages
+                          3 = notification
+                          4 = warning
+                        '';
+                      };
 
-            #### BSS definitions
+                      group = mkOption {
+                        default = "wheel";
+                        example = "network";
+                        type = types.str;
+                        description = ''
+                          Members of this group can access the control socket for this interface.
+                        '';
+                      };
 
-            networks = mkOption {
-              default = {};
-              example = literalExpression ''
-                {
-                  wlp2s0 = {
-                    ssid = "Primary advertised network";
-                    authentication.saePasswords = [{ password = "a flakey password"; }]; # Use saePasswordsFile if possible.
-                  };
-                  wlp2s0-1 = {
-                    ssid = "Secondary advertised network (Open)";
-                    authentication.mode = "none";
-                  };
-                }
-              '';
-              description = ''
-                This defines a BSS, colloquially known as a WiFi network.
-                You have to specify at least one.
-              '';
-              type = types.attrsOf (types.submodule (bssSubmod: {
-                options = {
-                  logLevel = mkOption {
-                    default = 2;
-                    type = types.int;
-                    description = ''
-                      Levels (minimum value for logged events):
-                      0 = verbose debugging
-                      1 = debugging
-                      2 = informational messages
-                      3 = notification
-                      4 = warning
-                    '';
-                  };
-
-                  group = mkOption {
-                    default = "wheel";
-                    example = "network";
-                    type = types.str;
-                    description = ''
-                      Members of this group can access the control socket for this interface.
-                    '';
-                  };
-
-                  utf8Ssid = mkOption {
-                    default = true;
-                    type = types.bool;
-                    description = "Whether the SSID is to be interpreted using UTF-8 encoding.";
-                  };
-
-                  ssid = mkOption {
-                    example = "❄️ cool ❄️";
-                    type = types.str;
-                    description = "SSID to be used in IEEE 802.11 management frames.";
-                  };
-
-                  bssid = mkOption {
-                    type = types.nullOr types.str;
-                    default = null;
-                    example = "11:22:33:44:55:66";
-                    description = ''
-                      Specifies the BSSID for this BSS. Usually determined automatically,
-                      but for now you have to manually specify them when using multiple BSS.
-                      Try assigning related addresses from the locally administered MAC address ranges,
-                      by reusing the hardware address but replacing the second nibble with 2, 6, A or E.
-                      (e.g. if real address is `XX:XX:XX:XX:XX`, try `X2:XX:XX:XX:XX:XX`, `X6:XX:XX:XX:XX:XX`, ...
-                      for the second, third, ... BSS)
-                    '';
-                  };
-
-                  macAcl = mkOption {
-                    default = "deny";
-                    type = types.enum ["deny" "allow" "radius"];
-                    apply = x:
-                      getAttr x {
-                        "deny" = 0;
-                        "allow" = 1;
-                        "radius" = 2;
+                      utf8Ssid = mkOption {
+                        default = true;
+                        type = types.bool;
+                        description = "Whether the SSID is to be interpreted using UTF-8 encoding.";
                       };
-                    description = ''
-                      Station MAC address -based authentication. The following modes are available:
-
-                      - {var}`"deny"`: Allow unless listed in {option}`macDeny` (default)
-                      - {var}`"allow"`: Deny unless listed in {option}`macAllow`
-                      - {var}`"radius"`: Use external radius server, but check both {option}`macAllow` and {option}`macDeny` first
-
-                      Please note that this kind of access control requires a driver that uses
-                      hostapd to take care of management frame processing and as such, this can be
-                      used with driver=hostap or driver=nl80211, but not with driver=atheros.
-                    '';
-                  };
-
-                  macAllow = mkOption {
-                    type = types.listOf types.str;
-                    default = [];
-                    example = ["11:22:33:44:55:66"];
-                    description = ''
-                      Specifies the MAC addresses to allow if {option}`macAcl` is set to {var}`"allow"` or {var}`"radius"`.
-                      These values will be world-readable in the Nix store. Values will automatically be merged with
-                      {option}`macAllowFile` if necessary.
-                    '';
-                  };
-
-                  macAllowFile = mkOption {
-                    type = types.nullOr types.path;
-                    default = null;
-                    description = ''
-                      Specifies a file containing the MAC addresses to allow if {option}`macAcl` is set to {var}`"allow"` or {var}`"radius"`.
-                      The file should contain exactly one MAC address per line. Comments and empty lines are ignored,
-                      only lines starting with a valid MAC address will be considered (e.g. `11:22:33:44:55:66`) and
-                      any content after the MAC address is ignored.
-                    '';
-                  };
-
-                  macDeny = mkOption {
-                    type = types.listOf types.str;
-                    default = [];
-                    example = ["11:22:33:44:55:66"];
-                    description = ''
-                      Specifies the MAC addresses to deny if {option}`macAcl` is set to {var}`"deny"` or {var}`"radius"`.
-                      These values will be world-readable in the Nix store. Values will automatically be merged with
-                      {option}`macDenyFile` if necessary.
-                    '';
-                  };
-
-                  macDenyFile = mkOption {
-                    type = types.nullOr types.path;
-                    default = null;
-                    description = ''
-                      Specifies a file containing the MAC addresses to deny if {option}`macAcl` is set to {var}`"deny"` or {var}`"radius"`.
-                      The file should contain exactly one MAC address per line. Comments and empty lines are ignored,
-                      only lines starting with a valid MAC address will be considered (e.g. `11:22:33:44:55:66`) and
-                      any content after the MAC address is ignored.
-                    '';
-                  };
-
-                  ignoreBroadcastSsid = mkOption {
-                    default = "disabled";
-                    type = types.enum ["disabled" "empty" "clear"];
-                    apply = x:
-                      getAttr x {
-                        "disabled" = 0;
-                        "empty" = 1;
-                        "clear" = 2;
+
+                      ssid = mkOption {
+                        example = "❄️ cool ❄️";
+                        type = types.str;
+                        description = "SSID to be used in IEEE 802.11 management frames.";
                       };
-                    description = ''
-                      Send empty SSID in beacons and ignore probe request frames that do not
-                      specify full SSID, i.e., require stations to know SSID. Note that this does
-                      not increase security, since your clients will then broadcast the SSID instead,
-                      which can increase congestion.
-
-                      - {var}`"disabled"`: Advertise ssid normally.
-                      - {var}`"empty"`: send empty (length=0) SSID in beacon and ignore probe request for broadcast SSID
-                      - {var}`"clear"`: clear SSID (ASCII 0), but keep the original length (this may be required with some
-                        legacy clients that do not support empty SSID) and ignore probe requests for broadcast SSID. Only
-                        use this if empty does not work with your clients.
-                    '';
-                  };
-
-                  apIsolate = mkOption {
-                    default = false;
-                    type = types.bool;
-                    description = ''
-                      Isolate traffic between stations (clients) and prevent them from
-                      communicating with each other.
-                    '';
-                  };
-
-                  settings = mkOption {
-                    default = {};
-                    example = { multi_ap = true; };
-                    type = types.submodule {
-                      freeformType = extraSettingsFormat.type;
-                    };
-                    description = ''
-                      Extra configuration options to put at the end of this BSS's defintion in the
-                      hostapd.conf for the associated interface. To find out which options are global
-                      and which are per-bss you have to read hostapd's source code, which is non-trivial
-                      and not documented otherwise.
-
-                      Lists will be converted to multiple definitions of the same key, and booleans to 0/1.
-                      Otherwise, the inputs are not modified or checked for correctness.
-                    '';
-                  };
-
-                  dynamicConfigScripts = mkOption {
-                    default = {};
-                    type = types.attrsOf types.path;
-                    example = literalExpression ''
-                      {
-                        exampleDynamicConfig = pkgs.writeShellScript "dynamic-config" '''
-                          HOSTAPD_CONFIG=$1
-                          # These always exist, but may or may not be used depending on the actual configuration
-                          MAC_ALLOW_FILE=$2
-                          MAC_DENY_FILE=$3
-
-                          cat >> "$HOSTAPD_CONFIG" << EOF
-                          # Add some dynamically generated statements here
-                          EOF
-                        ''';
-                      }
-                    '';
-                    description = ''
-                      All of these scripts will be executed in lexicographical order before hostapd
-                      is started, right after the bss segment was generated and may dynamically
-                      append bss options to the generated configuration file.
-
-                      The first argument will point to the configuration file that you may append to.
-                      The second and third argument will point to this BSS's MAC allow and MAC deny file respectively.
-                    '';
-                  };
-
-                  #### IEEE 802.11i (WPA) configuration
-
-                  authentication = {
-                    mode = mkOption {
-                      default = "wpa3-sae";
-                      type = types.enum ["none" "wpa2-sha1" "wpa2-sha256" "wpa3-sae-transition" "wpa3-sae"];
-                      description = ''
-                        Selects the authentication mode for this AP.
-
-                        - {var}`"none"`: Don't configure any authentication. This will disable wpa alltogether
-                          and create an open AP. Use {option}`settings` together with this option if you
-                          want to configure the authentication manually. Any password options will still be
-                          effective, if set.
-                        - {var}`"wpa2-sha1"`: Not recommended. WPA2-Personal using HMAC-SHA1. Passwords are set
-                          using {option}`wpaPassword` or preferably by {option}`wpaPasswordFile` or {option}`wpaPskFile`.
-                        - {var}`"wpa2-sha256"`: WPA2-Personal using HMAC-SHA256 (IEEE 802.11i/RSN). Passwords are set
-                          using {option}`wpaPassword` or preferably by {option}`wpaPasswordFile` or {option}`wpaPskFile`.
-                        - {var}`"wpa3-sae-transition"`: Use WPA3-Personal (SAE) if possible, otherwise fallback
-                          to WPA2-SHA256. Only use if necessary and switch to the newer WPA3-SAE when possible.
-                          You will have to specify both {option}`wpaPassword` and {option}`saePasswords` (or one of their alternatives).
-                        - {var}`"wpa3-sae"`: Use WPA3-Personal (SAE). This is currently the recommended way to
-                          setup a secured WiFi AP (as of March 2023) and therefore the default. Passwords are set
-                          using either {option}`saePasswords` or preferably {option}`saePasswordsFile`.
-                      '';
-                    };
 
-                    pairwiseCiphers = mkOption {
-                      default = ["CCMP"];
-                      example = ["GCMP" "GCMP-256"];
-                      type = types.listOf types.str;
-                      description = ''
-                        Set of accepted cipher suites (encryption algorithms) for pairwise keys (unicast packets).
-                        By default this allows just CCMP, which is the only commonly supported secure option.
-                        Use {option}`enableRecommendedPairwiseCiphers` to also enable newer recommended ciphers.
-
-                        Please refer to the hostapd documentation for allowed values. Generally, only
-                        CCMP or GCMP modes should be considered safe options. Most devices support CCMP while
-                        GCMP and GCMP-256 is often only available with devices supporting WiFi 5 (IEEE 802.11ac) or higher.
-                        CCMP-256 support is rare.
-                      '';
-                    };
+                      bssid = mkOption {
+                        type = types.nullOr types.str;
+                        default = null;
+                        example = "11:22:33:44:55:66";
+                        description = ''
+                          Specifies the BSSID for this BSS. Usually determined automatically,
+                          but for now you have to manually specify them when using multiple BSS.
+                          Try assigning related addresses from the locally administered MAC address ranges,
+                          by reusing the hardware address but replacing the second nibble with 2, 6, A or E.
+                          (e.g. if real address is `XX:XX:XX:XX:XX`, try `X2:XX:XX:XX:XX:XX`, `X6:XX:XX:XX:XX:XX`, ...
+                          for the second, third, ... BSS)
+                        '';
+                      };
 
-                    enableRecommendedPairwiseCiphers = mkOption {
-                      default = false;
-                      example = true;
-                      type = types.bool;
-                      description = ''
-                        Additionally enable the recommended set of pairwise ciphers.
-                        This enables newer secure ciphers, additionally to those defined in {option}`pairwiseCiphers`.
-                        You will have to test whether your hardware supports these by trial-and-error, because
-                        even if `iw list` indicates hardware support, your driver might not expose it.
-
-                        Beware {command}`hostapd` will most likely not return a useful error message in case
-                        this is enabled despite the driver or hardware not supporting the newer ciphers.
-                        Look out for messages like `Failed to set beacon parameters`.
-                      '';
-                    };
+                      macAcl = mkOption {
+                        default = "deny";
+                        type = types.enum [
+                          "deny"
+                          "allow"
+                          "radius"
+                        ];
+                        apply =
+                          x:
+                          getAttr x {
+                            "deny" = 0;
+                            "allow" = 1;
+                            "radius" = 2;
+                          };
+                        description = ''
+                          Station MAC address -based authentication. The following modes are available:
 
-                    wpaPassword = mkOption {
-                      default = null;
-                      example = "a flakey password";
-                      type = types.nullOr types.str;
-                      description = ''
-                        Sets the password for WPA-PSK that will be converted to the pre-shared key.
-                        The password length must be in the range [8, 63] characters. While some devices
-                        may allow arbitrary characters (such as UTF-8) to be used, but the standard specifies
-                        that each character in the passphrase must be an ASCII character in the range [0x20, 0x7e]
-                        (IEEE Std. 802.11i-2004, Annex H.4.1). Use emojis at your own risk.
-
-                        Not used when {option}`mode` is {var}`"wpa3-sae"`.
-
-                        Warning: This password will get put into a world-readable file in the Nix store!
-                        Using {option}`wpaPasswordFile` or {option}`wpaPskFile` instead is recommended.
-                      '';
-                    };
+                          - {var}`"deny"`: Allow unless listed in {option}`macDeny` (default)
+                          - {var}`"allow"`: Deny unless listed in {option}`macAllow`
+                          - {var}`"radius"`: Use external radius server, but check both {option}`macAllow` and {option}`macDeny` first
 
-                    wpaPasswordFile = mkOption {
-                      default = null;
-                      type = types.nullOr types.path;
-                      description = ''
-                        Sets the password for WPA-PSK. Follows the same rules as {option}`wpaPassword`,
-                        but reads the password from the given file to prevent the password from being
-                        put into the Nix store.
+                          Please note that this kind of access control requires a driver that uses
+                          hostapd to take care of management frame processing and as such, this can be
+                          used with driver=hostap or driver=nl80211, but not with driver=atheros.
+                        '';
+                      };
 
-                        Not used when {option}`mode` is {var}`"wpa3-sae"`.
-                      '';
-                    };
+                      macAllow = mkOption {
+                        type = types.listOf types.str;
+                        default = [ ];
+                        example = [ "11:22:33:44:55:66" ];
+                        description = ''
+                          Specifies the MAC addresses to allow if {option}`macAcl` is set to {var}`"allow"` or {var}`"radius"`.
+                          These values will be world-readable in the Nix store. Values will automatically be merged with
+                          {option}`macAllowFile` if necessary.
+                        '';
+                      };
 
-                    wpaPskFile = mkOption {
-                      default = null;
-                      type = types.nullOr types.path;
-                      description = ''
-                        Sets the password(s) for WPA-PSK. Similar to {option}`wpaPasswordFile`,
-                        but additionally allows specifying multiple passwords, and some other options.
-
-                        Each line, except for empty lines and lines starting with #, must contain a
-                        MAC address and either a 64-hex-digit PSK or a password separated with a space.
-                        The password must follow the same rules as outlined in {option}`wpaPassword`.
-                        The special MAC address `00:00:00:00:00:00` can be used to configure PSKs
-                        that any client can use.
-
-                        An optional key identifier can be added by prefixing the line with `keyid=<keyid_string>`
-                        An optional VLAN ID can be specified by prefixing the line with `vlanid=<VLAN ID>`.
-                        An optional WPS tag can be added by prefixing the line with `wps=<0/1>` (default: 0).
-                        Any matching entry with that tag will be used when generating a PSK for a WPS Enrollee
-                        instead of generating a new random per-Enrollee PSK.
-
-                        Not used when {option}`mode` is {var}`"wpa3-sae"`.
-                      '';
-                    };
+                      macAllowFile = mkOption {
+                        type = types.nullOr types.path;
+                        default = null;
+                        description = ''
+                          Specifies a file containing the MAC addresses to allow if {option}`macAcl` is set to {var}`"allow"` or {var}`"radius"`.
+                          The file should contain exactly one MAC address per line. Comments and empty lines are ignored,
+                          only lines starting with a valid MAC address will be considered (e.g. `11:22:33:44:55:66`) and
+                          any content after the MAC address is ignored.
+                        '';
+                      };
 
-                    saePasswords = mkOption {
-                      default = [];
-                      example = literalExpression ''
-                        [
-                          # Any client may use these passwords
-                          { password = "Wi-Figure it out"; }
-                          { password = "second password for everyone"; mac = "ff:ff:ff:ff:ff:ff"; }
-
-                          # Only the client with MAC-address 11:22:33:44:55:66 can use this password
-                          { password = "sekret pazzword"; mac = "11:22:33:44:55:66"; }
-                        ]
-                      '';
-                      description = ''
-                        Sets allowed passwords for WPA3-SAE.
-
-                        The last matching (based on peer MAC address and identifier) entry is used to
-                        select which password to use. An empty string has the special meaning of
-                        removing all previously added entries.
-
-                        Warning: These entries will get put into a world-readable file in
-                        the Nix store! Using {option}`saePasswordFile` instead is recommended.
-
-                        Not used when {option}`mode` is {var}`"wpa2-sha1"` or {var}`"wpa2-sha256"`.
-                      '';
-                      type = types.listOf (types.submodule {
-                        options = {
-                          password = mkOption {
-                            example = "a flakey password";
-                            type = types.str;
-                            description = ''
-                              The password for this entry. SAE technically imposes no restrictions on
-                              password length or character set. But due to limitations of {command}`hostapd`'s
-                              config file format, a true newline character cannot be parsed.
-
-                              Warning: This password will get put into a world-readable file in
-                              the Nix store! Using {option}`wpaPasswordFile` or {option}`wpaPskFile` is recommended.
-                            '';
-                          };
+                      macDeny = mkOption {
+                        type = types.listOf types.str;
+                        default = [ ];
+                        example = [ "11:22:33:44:55:66" ];
+                        description = ''
+                          Specifies the MAC addresses to deny if {option}`macAcl` is set to {var}`"deny"` or {var}`"radius"`.
+                          These values will be world-readable in the Nix store. Values will automatically be merged with
+                          {option}`macDenyFile` if necessary.
+                        '';
+                      };
 
-                          mac = mkOption {
-                            default = null;
-                            example = "11:22:33:44:55:66";
-                            type = types.nullOr types.str;
-                            description = ''
-                              If this attribute is not included, or if is set to the wildcard address (`ff:ff:ff:ff:ff:ff`),
-                              the entry is available for any station (client) to use. If a specific peer MAC address is included,
-                              only a station with that MAC address is allowed to use the entry.
-                            '';
-                          };
+                      macDenyFile = mkOption {
+                        type = types.nullOr types.path;
+                        default = null;
+                        description = ''
+                          Specifies a file containing the MAC addresses to deny if {option}`macAcl` is set to {var}`"deny"` or {var}`"radius"`.
+                          The file should contain exactly one MAC address per line. Comments and empty lines are ignored,
+                          only lines starting with a valid MAC address will be considered (e.g. `11:22:33:44:55:66`) and
+                          any content after the MAC address is ignored.
+                        '';
+                      };
 
-                          vlanid = mkOption {
-                            default = null;
-                            example = 1;
-                            type = types.nullOr types.int;
-                            description = "If this attribute is given, all clients using this entry will get tagged with the given VLAN ID.";
+                      ignoreBroadcastSsid = mkOption {
+                        default = "disabled";
+                        type = types.enum [
+                          "disabled"
+                          "empty"
+                          "clear"
+                        ];
+                        apply =
+                          x:
+                          getAttr x {
+                            "disabled" = 0;
+                            "empty" = 1;
+                            "clear" = 2;
                           };
+                        description = ''
+                          Send empty SSID in beacons and ignore probe request frames that do not
+                          specify full SSID, i.e., require stations to know SSID. Note that this does
+                          not increase security, since your clients will then broadcast the SSID instead,
+                          which can increase congestion.
+
+                          - {var}`"disabled"`: Advertise ssid normally.
+                          - {var}`"empty"`: send empty (length=0) SSID in beacon and ignore probe request for broadcast SSID
+                          - {var}`"clear"`: clear SSID (ASCII 0), but keep the original length (this may be required with some
+                            legacy clients that do not support empty SSID) and ignore probe requests for broadcast SSID. Only
+                            use this if empty does not work with your clients.
+                        '';
+                      };
 
-                          pk = mkOption {
-                            default = null;
-                            example = "";
-                            type = types.nullOr types.str;
-                            description = ''
-                              If this attribute is given, SAE-PK will be enabled for this connection.
-                              This prevents evil-twin attacks, but a public key is required additionally to connect.
-                              (Essentially adds pubkey authentication such that the client can verify identity of the AP)
-                            '';
-                          };
+                      apIsolate = mkOption {
+                        default = false;
+                        type = types.bool;
+                        description = ''
+                          Isolate traffic between stations (clients) and prevent them from
+                          communicating with each other.
+                        '';
+                      };
 
-                          id = mkOption {
-                            default = null;
-                            example = "";
-                            type = types.nullOr types.str;
-                            description = ''
-                              If this attribute is given with non-zero length, it will set the password identifier
-                              for this entry. It can then only be used with that identifier.
-                            '';
-                          };
+                      settings = mkOption {
+                        default = { };
+                        example = {
+                          multi_ap = true;
                         };
-                      });
-                    };
+                        type = types.submodule {
+                          freeformType = extraSettingsFormat.type;
+                        };
+                        description = ''
+                          Extra configuration options to put at the end of this BSS's defintion in the
+                          hostapd.conf for the associated interface. To find out which options are global
+                          and which are per-bss you have to read hostapd's source code, which is non-trivial
+                          and not documented otherwise.
+
+                          Lists will be converted to multiple definitions of the same key, and booleans to 0/1.
+                          Otherwise, the inputs are not modified or checked for correctness.
+                        '';
+                      };
 
-                    saePasswordsFile = mkOption {
-                      default = null;
-                      type = types.nullOr types.path;
-                      description = ''
-                        Sets the password for WPA3-SAE. Follows the same rules as {option}`saePasswords`,
-                        but reads the entries from the given file to prevent them from being
-                        put into the Nix store.
-
-                        One entry per line, empty lines and lines beginning with # will be ignored.
-                        Each line must match the following format, although the order of optional
-                        parameters doesn't matter:
-                        `<password>[|mac=<peer mac>][|vlanid=<VLAN ID>][|pk=<m:ECPrivateKey-base64>][|id=<identifier>]`
-
-                        Not used when {option}`mode` is {var}`"wpa2-sha1"` or {var}`"wpa2-sha256"`.
-                      '';
-                    };
+                      dynamicConfigScripts = mkOption {
+                        default = { };
+                        type = types.attrsOf types.path;
+                        example = literalExpression ''
+                          {
+                            exampleDynamicConfig = pkgs.writeShellScript "dynamic-config" '''
+                              HOSTAPD_CONFIG=$1
+                              # These always exist, but may or may not be used depending on the actual configuration
+                              MAC_ALLOW_FILE=$2
+                              MAC_DENY_FILE=$3
+
+                              cat >> "$HOSTAPD_CONFIG" << EOF
+                              # Add some dynamically generated statements here
+                              EOF
+                            ''';
+                          }
+                        '';
+                        description = ''
+                          All of these scripts will be executed in lexicographical order before hostapd
+                          is started, right after the bss segment was generated and may dynamically
+                          append bss options to the generated configuration file.
+
+                          The first argument will point to the configuration file that you may append to.
+                          The second and third argument will point to this BSS's MAC allow and MAC deny file respectively.
+                        '';
+                      };
 
-                    saeAddToMacAllow = mkOption {
-                      type = types.bool;
-                      default = false;
-                      description = ''
-                        If set, all sae password entries that have a non-wildcard MAC associated to
-                        them will additionally be used to populate the MAC allow list. This is
-                        additional to any entries set via {option}`macAllow` or {option}`macAllowFile`.
-                      '';
+                      #### IEEE 802.11i (WPA) configuration
+
+                      authentication = {
+                        mode = mkOption {
+                          default = "wpa3-sae";
+                          type = types.enum [
+                            "none"
+                            "wpa2-sha1"
+                            "wpa2-sha256"
+                            "wpa3-sae-transition"
+                            "wpa3-sae"
+                          ];
+                          description = ''
+                            Selects the authentication mode for this AP.
+
+                            - {var}`"none"`: Don't configure any authentication. This will disable wpa alltogether
+                              and create an open AP. Use {option}`settings` together with this option if you
+                              want to configure the authentication manually. Any password options will still be
+                              effective, if set.
+                            - {var}`"wpa2-sha1"`: Not recommended. WPA2-Personal using HMAC-SHA1. Passwords are set
+                              using {option}`wpaPassword` or preferably by {option}`wpaPasswordFile` or {option}`wpaPskFile`.
+                            - {var}`"wpa2-sha256"`: WPA2-Personal using HMAC-SHA256 (IEEE 802.11i/RSN). Passwords are set
+                              using {option}`wpaPassword` or preferably by {option}`wpaPasswordFile` or {option}`wpaPskFile`.
+                            - {var}`"wpa3-sae-transition"`: Use WPA3-Personal (SAE) if possible, otherwise fallback
+                              to WPA2-SHA256. Only use if necessary and switch to the newer WPA3-SAE when possible.
+                              You will have to specify both {option}`wpaPassword` and {option}`saePasswords` (or one of their alternatives).
+                            - {var}`"wpa3-sae"`: Use WPA3-Personal (SAE). This is currently the recommended way to
+                              setup a secured WiFi AP (as of March 2023) and therefore the default. Passwords are set
+                              using either {option}`saePasswords` or {option}`saePasswordsFile`.
+                          '';
+                        };
+
+                        pairwiseCiphers = mkOption {
+                          default = [ "CCMP" ];
+                          example = [
+                            "GCMP"
+                            "GCMP-256"
+                          ];
+                          type = types.listOf types.str;
+                          description = ''
+                            Set of accepted cipher suites (encryption algorithms) for pairwise keys (unicast packets).
+                            By default this allows just CCMP, which is the only commonly supported secure option.
+                            Use {option}`enableRecommendedPairwiseCiphers` to also enable newer recommended ciphers.
+
+                            Please refer to the hostapd documentation for allowed values. Generally, only
+                            CCMP or GCMP modes should be considered safe options. Most devices support CCMP while
+                            GCMP and GCMP-256 is often only available with devices supporting WiFi 5 (IEEE 802.11ac) or higher.
+                            CCMP-256 support is rare.
+                          '';
+                        };
+
+                        enableRecommendedPairwiseCiphers = mkOption {
+                          default = false;
+                          example = true;
+                          type = types.bool;
+                          description = ''
+                            Additionally enable the recommended set of pairwise ciphers.
+                            This enables newer secure ciphers, additionally to those defined in {option}`pairwiseCiphers`.
+                            You will have to test whether your hardware supports these by trial-and-error, because
+                            even if `iw list` indicates hardware support, your driver might not expose it.
+
+                            Beware {command}`hostapd` will most likely not return a useful error message in case
+                            this is enabled despite the driver or hardware not supporting the newer ciphers.
+                            Look out for messages like `Failed to set beacon parameters`.
+                          '';
+                        };
+
+                        wpaPassword = mkOption {
+                          default = null;
+                          example = "a flakey password";
+                          type = types.nullOr types.str;
+                          description = ''
+                            Sets the password for WPA-PSK that will be converted to the pre-shared key.
+                            The password length must be in the range [8, 63] characters. While some devices
+                            may allow arbitrary characters (such as UTF-8) to be used, but the standard specifies
+                            that each character in the passphrase must be an ASCII character in the range [0x20, 0x7e]
+                            (IEEE Std. 802.11i-2004, Annex H.4.1). Use emojis at your own risk.
+
+                            Not used when {option}`mode` is {var}`"wpa3-sae"`.
+
+                            Warning: This password will get put into a world-readable file in the Nix store!
+                            Using {option}`wpaPasswordFile` or {option}`wpaPskFile` instead is recommended.
+                          '';
+                        };
+
+                        wpaPasswordFile = mkOption {
+                          default = null;
+                          type = types.nullOr types.path;
+                          description = ''
+                            Sets the password for WPA-PSK. Follows the same rules as {option}`wpaPassword`,
+                            but reads the password from the given file to prevent the password from being
+                            put into the Nix store.
+
+                            Not used when {option}`mode` is {var}`"wpa3-sae"`.
+                          '';
+                        };
+
+                        wpaPskFile = mkOption {
+                          default = null;
+                          type = types.nullOr types.path;
+                          description = ''
+                            Sets the password(s) for WPA-PSK. Similar to {option}`wpaPasswordFile`,
+                            but additionally allows specifying multiple passwords, and some other options.
+
+                            Each line, except for empty lines and lines starting with #, must contain a
+                            MAC address and either a 64-hex-digit PSK or a password separated with a space.
+                            The password must follow the same rules as outlined in {option}`wpaPassword`.
+                            The special MAC address `00:00:00:00:00:00` can be used to configure PSKs
+                            that any client can use.
+
+                            An optional key identifier can be added by prefixing the line with `keyid=<keyid_string>`
+                            An optional VLAN ID can be specified by prefixing the line with `vlanid=<VLAN ID>`.
+                            An optional WPS tag can be added by prefixing the line with `wps=<0/1>` (default: 0).
+                            Any matching entry with that tag will be used when generating a PSK for a WPS Enrollee
+                            instead of generating a new random per-Enrollee PSK.
+
+                            Not used when {option}`mode` is {var}`"wpa3-sae"`.
+                          '';
+                        };
+
+                        saePasswords = mkOption {
+                          default = [ ];
+                          example = literalExpression ''
+                            [
+                              # Any client may use these passwords
+                              { password = "Wi-Figure it out"; }
+                              { passwordFile = "/run/secrets/my-password-file"; mac = "ff:ff:ff:ff:ff:ff"; }
+
+                              # Only the client with MAC-address 11:22:33:44:55:66 can use this password
+                              { password = "sekret pazzword"; mac = "11:22:33:44:55:66"; }
+                            ]
+                          '';
+                          description = ''
+                            Sets allowed passwords for WPA3-SAE.
+
+                            The last matching (based on peer MAC address and identifier) entry is used to
+                            select which password to use. An empty string has the special meaning of
+                            removing all previously added entries.
+
+                            Warning: These entries will get put into a world-readable file in
+                            the Nix store! Using {option}`saePasswordFile` instead is recommended.
+
+                            Not used when {option}`mode` is {var}`"wpa2-sha1"` or {var}`"wpa2-sha256"`.
+                          '';
+                          type = types.listOf (
+                            types.submodule {
+                              options = {
+                                password = mkOption {
+                                  default = null;
+                                  example = "a flakey password";
+                                  type = types.nullOr types.str;
+                                  description = ''
+                                    The password for this entry. SAE technically imposes no restrictions on
+                                    password length or character set. But due to limitations of {command}`hostapd`'s
+                                    config file format, a true newline character cannot be parsed.
+
+                                    Warning: This password will get put into a world-readable file in
+                                    the Nix store! Prefer using the sibling option {option}`passwordFile` or directly set {option}`saePasswordsFile`.
+                                  '';
+                                };
+
+                                passwordFile = mkOption {
+                                  default = null;
+                                  type = types.nullOr types.path;
+                                  description = ''
+                                    The password for this entry, read from the given file when starting hostapd.
+                                    SAE technically imposes no restrictions on password length or character set.
+                                    But due to limitations of {command}`hostapd`'s config file format, a true newline
+                                    character cannot be parsed.
+                                  '';
+                                };
+
+                                mac = mkOption {
+                                  default = null;
+                                  example = "11:22:33:44:55:66";
+                                  type = types.nullOr types.str;
+                                  description = ''
+                                    If this attribute is not included, or if is set to the wildcard address (`ff:ff:ff:ff:ff:ff`),
+                                    the entry is available for any station (client) to use. If a specific peer MAC address is included,
+                                    only a station with that MAC address is allowed to use the entry.
+                                  '';
+                                };
+
+                                vlanid = mkOption {
+                                  default = null;
+                                  example = 1;
+                                  type = types.nullOr types.int;
+                                  description = "If this attribute is given, all clients using this entry will get tagged with the given VLAN ID.";
+                                };
+
+                                pk = mkOption {
+                                  default = null;
+                                  example = "";
+                                  type = types.nullOr types.str;
+                                  description = ''
+                                    If this attribute is given, SAE-PK will be enabled for this connection.
+                                    This prevents evil-twin attacks, but a public key is required additionally to connect.
+                                    (Essentially adds pubkey authentication such that the client can verify identity of the AP)
+                                  '';
+                                };
+
+                                id = mkOption {
+                                  default = null;
+                                  example = "";
+                                  type = types.nullOr types.str;
+                                  description = ''
+                                    If this attribute is given with non-zero length, it will set the password identifier
+                                    for this entry. It can then only be used with that identifier.
+                                  '';
+                                };
+                              };
+                            }
+                          );
+                        };
+
+                        saePasswordsFile = mkOption {
+                          default = null;
+                          type = types.nullOr types.path;
+                          description = ''
+                            Sets the password for WPA3-SAE. Follows the same rules as {option}`saePasswords`,
+                            but reads the entries from the given file to prevent them from being
+                            put into the Nix store.
+
+                            One entry per line, empty lines and lines beginning with # will be ignored.
+                            Each line must match the following format, although the order of optional
+                            parameters doesn't matter:
+                            `<password>[|mac=<peer mac>][|vlanid=<VLAN ID>][|pk=<m:ECPrivateKey-base64>][|id=<identifier>]`
+
+                            Not used when {option}`mode` is {var}`"wpa2-sha1"` or {var}`"wpa2-sha256"`.
+                          '';
+                        };
+
+                        saeAddToMacAllow = mkOption {
+                          type = types.bool;
+                          default = false;
+                          description = ''
+                            If set, all sae password entries that have a non-wildcard MAC associated to
+                            them will additionally be used to populate the MAC allow list. This is
+                            additional to any entries set via {option}`macAllow` or {option}`macAllowFile`.
+                          '';
+                        };
+                      };
                     };
-                  };
-                };
 
-                config = let
-                  bssCfg = bssSubmod.config;
-                  pairwiseCiphers =
-                    concatStringsSep " " (unique (bssCfg.authentication.pairwiseCiphers
-                      ++ optionals bssCfg.authentication.enableRecommendedPairwiseCiphers ["CCMP" "GCMP" "GCMP-256"]));
-                in {
-                  settings = {
-                    ssid = bssCfg.ssid;
-                    utf8_ssid = bssCfg.utf8Ssid;
-
-                    logger_syslog = mkDefault (-1);
-                    logger_syslog_level = bssCfg.logLevel;
-                    logger_stdout = mkDefault (-1);
-                    logger_stdout_level = bssCfg.logLevel;
-                    ctrl_interface = mkDefault "/run/hostapd";
-                    ctrl_interface_group = bssCfg.group;
-
-                    macaddr_acl = bssCfg.macAcl;
-
-                    ignore_broadcast_ssid = bssCfg.ignoreBroadcastSsid;
-
-                    # IEEE 802.11i (authentication) related configuration
-                    # Encrypt management frames to protect against deauthentication and similar attacks
-                    ieee80211w = mkDefault 1;
-                    sae_require_mfp = mkDefault 1;
-
-                    # Only allow WPA by default and disable insecure WEP
-                    auth_algs = mkDefault 1;
-                    # Always enable QoS, which is required for 802.11n and above
-                    wmm_enabled = mkDefault true;
-                    ap_isolate = bssCfg.apIsolate;
-
-                    sae_password = flip map bssCfg.authentication.saePasswords (
-                      entry:
-                        entry.password
-                        + optionalString (entry.mac != null) "|mac=${entry.mac}"
-                        + optionalString (entry.vlanid != null) "|vlanid=${toString entry.vlanid}"
-                        + optionalString (entry.pk != null) "|pk=${entry.pk}"
-                        + optionalString (entry.id != null) "|id=${entry.id}"
-                    );
-                  } // optionalAttrs (bssCfg.bssid != null) {
-                    bssid = bssCfg.bssid;
-                  } // optionalAttrs (bssCfg.macAllow != [] || bssCfg.macAllowFile != null || bssCfg.authentication.saeAddToMacAllow) {
-                    accept_mac_file = "/run/hostapd/${bssCfg._module.args.name}.mac.allow";
-                  } // optionalAttrs (bssCfg.macDeny != [] || bssCfg.macDenyFile != null) {
-                    deny_mac_file = "/run/hostapd/${bssCfg._module.args.name}.mac.deny";
-                  } // optionalAttrs (bssCfg.authentication.mode == "none") {
-                    wpa = mkDefault 0;
-                  } // optionalAttrs (bssCfg.authentication.mode == "wpa3-sae") {
-                    wpa = 2;
-                    wpa_key_mgmt = "SAE";
-                    # Derive PWE using both hunting-and-pecking loop and hash-to-element
-                    sae_pwe = 2;
-                    # Prevent downgrade attacks by indicating to clients that they should
-                    # disable any transition modes from now on.
-                    transition_disable = "0x01";
-                  } // optionalAttrs (bssCfg.authentication.mode == "wpa3-sae-transition") {
-                    wpa = 2;
-                    wpa_key_mgmt = "WPA-PSK-SHA256 SAE";
-                  } // optionalAttrs (bssCfg.authentication.mode == "wpa2-sha1") {
-                    wpa = 2;
-                    wpa_key_mgmt = "WPA-PSK";
-                  } // optionalAttrs (bssCfg.authentication.mode == "wpa2-sha256") {
-                    wpa = 2;
-                    wpa_key_mgmt = "WPA-PSK-SHA256";
-                  } // optionalAttrs (bssCfg.authentication.mode != "none") {
-                    wpa_pairwise = pairwiseCiphers;
-                    rsn_pairwise = pairwiseCiphers;
-                  } // optionalAttrs (bssCfg.authentication.wpaPassword != null) {
-                    wpa_passphrase = bssCfg.authentication.wpaPassword;
-                  } // optionalAttrs (bssCfg.authentication.wpaPskFile != null) {
-                    wpa_psk_file = toString bssCfg.authentication.wpaPskFile;
-                  };
-
-                  dynamicConfigScripts = let
-                    # All MAC addresses from SAE entries that aren't the wildcard address
-                    saeMacs = filter (mac: mac != null && (toLower mac) != "ff:ff:ff:ff:ff:ff") (map (x: x.mac) bssCfg.authentication.saePasswords);
-                  in {
-                    "20-addMacAllow" = mkIf (bssCfg.macAllow != []) (pkgs.writeShellScript "add-mac-allow" ''
-                      MAC_ALLOW_FILE=$2
-                      cat >> "$MAC_ALLOW_FILE" <<EOF
-                      ${concatStringsSep "\n" bssCfg.macAllow}
-                      EOF
-                    '');
-                    "20-addMacAllowFile" = mkIf (bssCfg.macAllowFile != null) (pkgs.writeShellScript "add-mac-allow-file" ''
-                      MAC_ALLOW_FILE=$2
-                      grep -Eo '^([0-9A-Fa-f]{2}[:]){5}([0-9A-Fa-f]{2})' ${escapeShellArg bssCfg.macAllowFile} >> "$MAC_ALLOW_FILE"
-                    '');
-                    "20-addMacAllowFromSae" = mkIf (bssCfg.authentication.saeAddToMacAllow && saeMacs != []) (pkgs.writeShellScript "add-mac-allow-from-sae" ''
-                      MAC_ALLOW_FILE=$2
-                      cat >> "$MAC_ALLOW_FILE" <<EOF
-                      ${concatStringsSep "\n" saeMacs}
-                      EOF
-                    '');
-                    # Populate mac allow list from saePasswordsFile
-                    # (filter for lines with mac=;  exclude commented lines; filter for real mac-addresses; strip mac=)
-                    "20-addMacAllowFromSaeFile" = mkIf (bssCfg.authentication.saeAddToMacAllow && bssCfg.authentication.saePasswordsFile != null) (pkgs.writeShellScript "add-mac-allow-from-sae-file" ''
-                      MAC_ALLOW_FILE=$2
-                      grep mac= ${escapeShellArg bssCfg.authentication.saePasswordsFile} \
-                        | grep -v '^\s*#' \
-                        | grep -Eo 'mac=([0-9A-Fa-f]{2}[:]){5}([0-9A-Fa-f]{2})' \
-                        | sed 's|^mac=||' >> "$MAC_ALLOW_FILE"
-                    '');
-                    "20-addMacDeny" = mkIf (bssCfg.macDeny != []) (pkgs.writeShellScript "add-mac-deny" ''
-                      MAC_DENY_FILE=$3
-                      cat >> "$MAC_DENY_FILE" <<EOF
-                      ${concatStringsSep "\n" bssCfg.macDeny}
-                      EOF
-                    '');
-                    "20-addMacDenyFile" = mkIf (bssCfg.macDenyFile != null) (pkgs.writeShellScript "add-mac-deny-file" ''
-                      MAC_DENY_FILE=$3
-                      grep -Eo '^([0-9A-Fa-f]{2}[:]){5}([0-9A-Fa-f]{2})' ${escapeShellArg bssCfg.macDenyFile} >> "$MAC_DENY_FILE"
-                    '');
-                    # Add wpa_passphrase from file
-                    "20-wpaPasswordFile" = mkIf (bssCfg.authentication.wpaPasswordFile != null) (pkgs.writeShellScript "wpa-password-file" ''
-                      HOSTAPD_CONFIG_FILE=$1
-                      cat >> "$HOSTAPD_CONFIG_FILE" <<EOF
-                      wpa_passphrase=$(cat ${escapeShellArg bssCfg.authentication.wpaPasswordFile})
-                      EOF
-                    '');
-                    # Add sae passwords from file
-                    "20-saePasswordsFile" = mkIf (bssCfg.authentication.saePasswordsFile != null) (pkgs.writeShellScript "sae-passwords-file" ''
-                      HOSTAPD_CONFIG_FILE=$1
-                      grep -v '^\s*#' ${escapeShellArg bssCfg.authentication.saePasswordsFile} \
-                        | sed 's/^/sae_password=/' >> "$HOSTAPD_CONFIG_FILE"
-                    '');
-                  };
-                };
-              }));
+                    config =
+                      let
+                        bssCfg = bssSubmod.config;
+                        pairwiseCiphers = concatStringsSep " " (
+                          unique (
+                            bssCfg.authentication.pairwiseCiphers
+                            ++ optionals bssCfg.authentication.enableRecommendedPairwiseCiphers [
+                              "CCMP"
+                              "GCMP"
+                              "GCMP-256"
+                            ]
+                          )
+                        );
+                      in
+                      {
+                        settings =
+                          {
+                            ssid = bssCfg.ssid;
+                            utf8_ssid = bssCfg.utf8Ssid;
+
+                            logger_syslog = mkDefault (-1);
+                            logger_syslog_level = bssCfg.logLevel;
+                            logger_stdout = mkDefault (-1);
+                            logger_stdout_level = bssCfg.logLevel;
+                            ctrl_interface = mkDefault "/run/hostapd";
+                            ctrl_interface_group = bssCfg.group;
+
+                            macaddr_acl = bssCfg.macAcl;
+
+                            ignore_broadcast_ssid = bssCfg.ignoreBroadcastSsid;
+
+                            # IEEE 802.11i (authentication) related configuration
+                            # Encrypt management frames to protect against deauthentication and similar attacks
+                            ieee80211w = mkDefault 1;
+                            sae_require_mfp = mkDefault 1;
+
+                            # Only allow WPA by default and disable insecure WEP
+                            auth_algs = mkDefault 1;
+                            # Always enable QoS, which is required for 802.11n and above
+                            wmm_enabled = mkDefault true;
+                            ap_isolate = bssCfg.apIsolate;
+                          }
+                          // optionalAttrs (bssCfg.bssid != null) {
+                            bssid = bssCfg.bssid;
+                          }
+                          //
+                            optionalAttrs
+                              (bssCfg.macAllow != [ ] || bssCfg.macAllowFile != null || bssCfg.authentication.saeAddToMacAllow)
+                              {
+                                accept_mac_file = "/run/hostapd/${bssCfg._module.args.name}.mac.allow";
+                              }
+                          // optionalAttrs (bssCfg.macDeny != [ ] || bssCfg.macDenyFile != null) {
+                            deny_mac_file = "/run/hostapd/${bssCfg._module.args.name}.mac.deny";
+                          }
+                          // optionalAttrs (bssCfg.authentication.mode == "none") {
+                            wpa = mkDefault 0;
+                          }
+                          // optionalAttrs (bssCfg.authentication.mode == "wpa3-sae") {
+                            wpa = 2;
+                            wpa_key_mgmt = "SAE";
+                            # Derive PWE using both hunting-and-pecking loop and hash-to-element
+                            sae_pwe = 2;
+                            # Prevent downgrade attacks by indicating to clients that they should
+                            # disable any transition modes from now on.
+                            transition_disable = "0x01";
+                          }
+                          // optionalAttrs (bssCfg.authentication.mode == "wpa3-sae-transition") {
+                            wpa = 2;
+                            wpa_key_mgmt = "WPA-PSK-SHA256 SAE";
+                          }
+                          // optionalAttrs (bssCfg.authentication.mode == "wpa2-sha1") {
+                            wpa = 2;
+                            wpa_key_mgmt = "WPA-PSK";
+                          }
+                          // optionalAttrs (bssCfg.authentication.mode == "wpa2-sha256") {
+                            wpa = 2;
+                            wpa_key_mgmt = "WPA-PSK-SHA256";
+                          }
+                          // optionalAttrs (bssCfg.authentication.mode != "none") {
+                            wpa_pairwise = pairwiseCiphers;
+                            rsn_pairwise = pairwiseCiphers;
+                          }
+                          // optionalAttrs (bssCfg.authentication.wpaPassword != null) {
+                            wpa_passphrase = bssCfg.authentication.wpaPassword;
+                          }
+                          // optionalAttrs (bssCfg.authentication.wpaPskFile != null) {
+                            wpa_psk_file = toString bssCfg.authentication.wpaPskFile;
+                          };
+
+                        dynamicConfigScripts =
+                          let
+                            # All MAC addresses from SAE entries that aren't the wildcard address
+                            saeMacs = filter (mac: mac != null && (toLower mac) != "ff:ff:ff:ff:ff:ff") (
+                              map (x: x.mac) bssCfg.authentication.saePasswords
+                            );
+                          in
+                          {
+                            "20-addMacAllow" = mkIf (bssCfg.macAllow != [ ]) (
+                              pkgs.writeShellScript "add-mac-allow" ''
+                                MAC_ALLOW_FILE=$2
+                                cat >> "$MAC_ALLOW_FILE" <<EOF
+                                ${concatStringsSep "\n" bssCfg.macAllow}
+                                EOF
+                              ''
+                            );
+                            "20-addMacAllowFile" = mkIf (bssCfg.macAllowFile != null) (
+                              pkgs.writeShellScript "add-mac-allow-file" ''
+                                MAC_ALLOW_FILE=$2
+                                grep -Eo '^([0-9A-Fa-f]{2}[:]){5}([0-9A-Fa-f]{2})' ${escapeShellArg bssCfg.macAllowFile} >> "$MAC_ALLOW_FILE"
+                              ''
+                            );
+                            "20-addMacAllowFromSae" = mkIf (bssCfg.authentication.saeAddToMacAllow && saeMacs != [ ]) (
+                              pkgs.writeShellScript "add-mac-allow-from-sae" ''
+                                MAC_ALLOW_FILE=$2
+                                cat >> "$MAC_ALLOW_FILE" <<EOF
+                                ${concatStringsSep "\n" saeMacs}
+                                EOF
+                              ''
+                            );
+                            # Populate mac allow list from saePasswordsFile
+                            # (filter for lines with mac=;  exclude commented lines; filter for real mac-addresses; strip mac=)
+                            "20-addMacAllowFromSaeFile" =
+                              mkIf (bssCfg.authentication.saeAddToMacAllow && bssCfg.authentication.saePasswordsFile != null)
+                                (
+                                  pkgs.writeShellScript "add-mac-allow-from-sae-file" ''
+                                    MAC_ALLOW_FILE=$2
+                                    grep mac= ${escapeShellArg bssCfg.authentication.saePasswordsFile} \
+                                      | grep -v '^\s*#' \
+                                      | grep -Eo 'mac=([0-9A-Fa-f]{2}[:]){5}([0-9A-Fa-f]{2})' \
+                                      | sed 's|^mac=||' >> "$MAC_ALLOW_FILE"
+                                  ''
+                                );
+                            "20-addMacDeny" = mkIf (bssCfg.macDeny != [ ]) (
+                              pkgs.writeShellScript "add-mac-deny" ''
+                                MAC_DENY_FILE=$3
+                                cat >> "$MAC_DENY_FILE" <<EOF
+                                ${concatStringsSep "\n" bssCfg.macDeny}
+                                EOF
+                              ''
+                            );
+                            "20-addMacDenyFile" = mkIf (bssCfg.macDenyFile != null) (
+                              pkgs.writeShellScript "add-mac-deny-file" ''
+                                MAC_DENY_FILE=$3
+                                grep -Eo '^([0-9A-Fa-f]{2}[:]){5}([0-9A-Fa-f]{2})' ${escapeShellArg bssCfg.macDenyFile} >> "$MAC_DENY_FILE"
+                              ''
+                            );
+                            # Add wpa_passphrase from file
+                            "20-wpaPasswordFile" = mkIf (bssCfg.authentication.wpaPasswordFile != null) (
+                              pkgs.writeShellScript "wpa-password-file" ''
+                                HOSTAPD_CONFIG_FILE=$1
+                                cat >> "$HOSTAPD_CONFIG_FILE" <<EOF
+                                wpa_passphrase=$(cat ${escapeShellArg bssCfg.authentication.wpaPasswordFile})
+                                EOF
+                              ''
+                            );
+                            # Add sae passwords from file
+                            "20-saePasswordsFile" = mkIf (bssCfg.authentication.saePasswordsFile != null) (
+                              pkgs.writeShellScript "sae-passwords-file" ''
+                                HOSTAPD_CONFIG_FILE=$1
+                                grep -v '^\s*#' ${escapeShellArg bssCfg.authentication.saePasswordsFile} \
+                                  | sed 's/^/sae_password=/' >> "$HOSTAPD_CONFIG_FILE"
+                              ''
+                            );
+                            # Add sae passwords from nix definitions, potentially reading secrets
+                            "20-saePasswords" = mkIf (bssCfg.authentication.saePasswords != [ ]) (
+                              pkgs.writeShellScript "sae-passwords" (
+                                ''
+                                  HOSTAPD_CONFIG_FILE=$1
+                                ''
+                                + concatMapStrings (
+                                  entry:
+                                  let
+                                    lineSuffix =
+                                      optionalString (entry.password != null) entry.password
+                                      + optionalString (entry.mac != null) "|mac=${entry.mac}"
+                                      + optionalString (entry.vlanid != null) "|vlanid=${toString entry.vlanid}"
+                                      + optionalString (entry.pk != null) "|pk=${entry.pk}"
+                                      + optionalString (entry.id != null) "|id=${entry.id}";
+                                  in
+                                  ''
+                                    (
+                                      echo -n 'sae_password='
+                                      ${optionalString (entry.passwordFile != null) ''tr -d '\n' < ${entry.passwordFile}''}
+                                      echo ${escapeShellArg lineSuffix}
+                                    ) >> "$HOSTAPD_CONFIG_FILE"
+                                  ''
+                                ) bssCfg.authentication.saePasswords
+                              )
+                            );
+                          };
+                      };
+                  })
+                );
+              };
             };
-          };
-
-          config.settings = let
-            radioCfg = radioSubmod.config;
-          in {
-            driver = radioCfg.driver;
-            hw_mode = {
-              "2g" = "g";
-              "5g" = "a";
-              "6g" = "a";
-              "60g" = "ad";
-            }.${radioCfg.band};
-            channel = radioCfg.channel;
-            noscan = radioCfg.noScan;
-          } // optionalAttrs (radioCfg.countryCode != null) {
-            country_code = radioCfg.countryCode;
-            # IEEE 802.11d: Limit to frequencies allowed in country
-            ieee80211d = true;
-            # IEEE 802.11h: Enable radar detection and DFS (Dynamic Frequency Selection)
-            ieee80211h = true;
-          } // optionalAttrs radioCfg.wifi4.enable {
-            # IEEE 802.11n (WiFi 4) related configuration
-            ieee80211n = true;
-            require_ht = radioCfg.wifi4.require;
-            ht_capab = concatMapStrings (x: "[${x}]") radioCfg.wifi4.capabilities;
-          } // optionalAttrs radioCfg.wifi5.enable {
-            # IEEE 802.11ac (WiFi 5) related configuration
-            ieee80211ac = true;
-            require_vht = radioCfg.wifi5.require;
-            vht_oper_chwidth = radioCfg.wifi5.operatingChannelWidth;
-            vht_capab = concatMapStrings (x: "[${x}]") radioCfg.wifi5.capabilities;
-          } // optionalAttrs radioCfg.wifi6.enable {
-            # IEEE 802.11ax (WiFi 6) related configuration
-            ieee80211ax = true;
-            require_he = mkIf radioCfg.wifi6.require true;
-            he_oper_chwidth = radioCfg.wifi6.operatingChannelWidth;
-            he_su_beamformer = radioCfg.wifi6.singleUserBeamformer;
-            he_su_beamformee = radioCfg.wifi6.singleUserBeamformee;
-            he_mu_beamformer = radioCfg.wifi6.multiUserBeamformer;
-          } // optionalAttrs radioCfg.wifi7.enable {
-            # IEEE 802.11be (WiFi 7) related configuration
-            ieee80211be = true;
-            eht_oper_chwidth = radioCfg.wifi7.operatingChannelWidth;
-            eht_su_beamformer = radioCfg.wifi7.singleUserBeamformer;
-            eht_su_beamformee = radioCfg.wifi7.singleUserBeamformee;
-            eht_mu_beamformer = radioCfg.wifi7.multiUserBeamformer;
-          };
-        }));
+
+            config.settings =
+              let
+                radioCfg = radioSubmod.config;
+              in
+              {
+                driver = radioCfg.driver;
+                hw_mode =
+                  {
+                    "2g" = "g";
+                    "5g" = "a";
+                    "6g" = "a";
+                    "60g" = "ad";
+                  }
+                  .${radioCfg.band};
+                channel = radioCfg.channel;
+                noscan = radioCfg.noScan;
+              }
+              // optionalAttrs (radioCfg.countryCode != null) {
+                country_code = radioCfg.countryCode;
+                # IEEE 802.11d: Limit to frequencies allowed in country
+                ieee80211d = true;
+                # IEEE 802.11h: Enable radar detection and DFS (Dynamic Frequency Selection)
+                ieee80211h = true;
+              }
+              // optionalAttrs radioCfg.wifi4.enable {
+                # IEEE 802.11n (WiFi 4) related configuration
+                ieee80211n = true;
+                require_ht = radioCfg.wifi4.require;
+                ht_capab = concatMapStrings (x: "[${x}]") radioCfg.wifi4.capabilities;
+              }
+              // optionalAttrs radioCfg.wifi5.enable {
+                # IEEE 802.11ac (WiFi 5) related configuration
+                ieee80211ac = true;
+                require_vht = radioCfg.wifi5.require;
+                vht_oper_chwidth = radioCfg.wifi5.operatingChannelWidth;
+                vht_capab = concatMapStrings (x: "[${x}]") radioCfg.wifi5.capabilities;
+              }
+              // optionalAttrs radioCfg.wifi6.enable {
+                # IEEE 802.11ax (WiFi 6) related configuration
+                ieee80211ax = true;
+                require_he = mkIf radioCfg.wifi6.require true;
+                he_oper_chwidth = radioCfg.wifi6.operatingChannelWidth;
+                he_su_beamformer = radioCfg.wifi6.singleUserBeamformer;
+                he_su_beamformee = radioCfg.wifi6.singleUserBeamformee;
+                he_mu_beamformer = radioCfg.wifi6.multiUserBeamformer;
+              }
+              // optionalAttrs radioCfg.wifi7.enable {
+                # IEEE 802.11be (WiFi 7) related configuration
+                ieee80211be = true;
+                eht_oper_chwidth = radioCfg.wifi7.operatingChannelWidth;
+                eht_su_beamformer = radioCfg.wifi7.singleUserBeamformer;
+                eht_su_beamformee = radioCfg.wifi7.singleUserBeamformee;
+                eht_mu_beamformer = radioCfg.wifi7.multiUserBeamformer;
+              };
+          })
+        );
       };
     };
   };
 
-  imports = let
-    renamedOptionMessage = message: ''
-      ${message}
-      Refer to the documentation of `services.hostapd.radios` for an example and more information.
-    '';
-  in [
-    (mkRemovedOptionModule ["services" "hostapd" "interface"]
-      (renamedOptionMessage "All other options for this interface are now set via `services.hostapd.radios.«interface».*`."))
-
-    (mkRemovedOptionModule ["services" "hostapd" "driver"]
-      (renamedOptionMessage "It has been replaced by `services.hostapd.radios.«interface».driver`."))
-    (mkRemovedOptionModule ["services" "hostapd" "noScan"]
-      (renamedOptionMessage "It has been replaced by `services.hostapd.radios.«interface».noScan`."))
-    (mkRemovedOptionModule ["services" "hostapd" "countryCode"]
-      (renamedOptionMessage "It has been replaced by `services.hostapd.radios.«interface».countryCode`."))
-    (mkRemovedOptionModule ["services" "hostapd" "hwMode"]
-      (renamedOptionMessage "It has been replaced by `services.hostapd.radios.«interface».band`."))
-    (mkRemovedOptionModule ["services" "hostapd" "channel"]
-      (renamedOptionMessage "It has been replaced by `services.hostapd.radios.«interface».channel`."))
-    (mkRemovedOptionModule ["services" "hostapd" "extraConfig"]
-      (renamedOptionMessage ''
+  imports =
+    let
+      renamedOptionMessage = message: ''
+        ${message}
+        Refer to the documentation of `services.hostapd.radios` for an example and more information.
+      '';
+    in
+    [
+      (mkRemovedOptionModule [ "services" "hostapd" "interface" ] (
+        renamedOptionMessage "All other options for this interface are now set via `services.hostapd.radios.«interface».*`."
+      ))
+
+      (mkRemovedOptionModule [ "services" "hostapd" "driver" ] (
+        renamedOptionMessage "It has been replaced by `services.hostapd.radios.«interface».driver`."
+      ))
+      (mkRemovedOptionModule [ "services" "hostapd" "noScan" ] (
+        renamedOptionMessage "It has been replaced by `services.hostapd.radios.«interface».noScan`."
+      ))
+      (mkRemovedOptionModule [ "services" "hostapd" "countryCode" ] (
+        renamedOptionMessage "It has been replaced by `services.hostapd.radios.«interface».countryCode`."
+      ))
+      (mkRemovedOptionModule [ "services" "hostapd" "hwMode" ] (
+        renamedOptionMessage "It has been replaced by `services.hostapd.radios.«interface».band`."
+      ))
+      (mkRemovedOptionModule [ "services" "hostapd" "channel" ] (
+        renamedOptionMessage "It has been replaced by `services.hostapd.radios.«interface».channel`."
+      ))
+      (mkRemovedOptionModule [ "services" "hostapd" "extraConfig" ] (renamedOptionMessage ''
         It has been replaced by `services.hostapd.radios.«interface».settings` and
         `services.hostapd.radios.«interface».networks.«network».settings` respectively
         for per-radio and per-network extra configuration. The module now supports a lot more
         options inherently, so please re-check whether using settings is still necessary.''))
 
-    (mkRemovedOptionModule ["services" "hostapd" "logLevel"]
-      (renamedOptionMessage "It has been replaced by `services.hostapd.radios.«interface».networks.«network».logLevel`."))
-    (mkRemovedOptionModule ["services" "hostapd" "group"]
-      (renamedOptionMessage "It has been replaced by `services.hostapd.radios.«interface».networks.«network».group`."))
-    (mkRemovedOptionModule ["services" "hostapd" "ssid"]
-      (renamedOptionMessage "It has been replaced by `services.hostapd.radios.«interface».networks.«network».ssid`."))
-
-    (mkRemovedOptionModule ["services" "hostapd" "wpa"]
-      (renamedOptionMessage "It has been replaced by `services.hostapd.radios.«interface».networks.«network».authentication.mode`."))
-    (mkRemovedOptionModule ["services" "hostapd" "wpaPassphrase"]
-      (renamedOptionMessage ''
-        It has been replaced by `services.hostapd.radios.«interface».networks.«network».authentication.wpaPassword`.
-        While upgrading your config, please consider using the newer SAE authentication scheme
-        and one of the new `passwordFile`-like options to avoid putting the password into the world readable nix-store.''))
-  ];
+      (mkRemovedOptionModule [ "services" "hostapd" "logLevel" ] (
+        renamedOptionMessage "It has been replaced by `services.hostapd.radios.«interface».networks.«network».logLevel`."
+      ))
+      (mkRemovedOptionModule [ "services" "hostapd" "group" ] (
+        renamedOptionMessage "It has been replaced by `services.hostapd.radios.«interface».networks.«network».group`."
+      ))
+      (mkRemovedOptionModule [ "services" "hostapd" "ssid" ] (
+        renamedOptionMessage "It has been replaced by `services.hostapd.radios.«interface».networks.«network».ssid`."
+      ))
+
+      (mkRemovedOptionModule [ "services" "hostapd" "wpa" ] (
+        renamedOptionMessage "It has been replaced by `services.hostapd.radios.«interface».networks.«network».authentication.mode`."
+      ))
+      (mkRemovedOptionModule [ "services" "hostapd" "wpaPassphrase" ]
+        (renamedOptionMessage ''
+          It has been replaced by `services.hostapd.radios.«interface».networks.«network».authentication.wpaPassword`.
+          While upgrading your config, please consider using the newer SAE authentication scheme
+          and one of the new `passwordFile`-like options to avoid putting the password into the world readable nix-store.'')
+      )
+    ];
 
   config = mkIf cfg.enable {
     assertions =
       [
         {
-          assertion = cfg.radios != {};
+          assertion = cfg.radios != { };
           message = "At least one radio must be configured with hostapd!";
         }
       ]
       # Radio warnings
-      ++ (concatLists (mapAttrsToList (
+      ++ (concatLists (
+        mapAttrsToList (
           radio: radioCfg:
-            [
-              {
-                assertion = radioCfg.networks != {};
-                message = "hostapd radio ${radio}: At least one network must be configured!";
-              }
-              # XXX: There could be many more useful assertions about (band == xy) -> ensure other required settings.
-              # see https://github.com/openwrt/openwrt/blob/539cb5389d9514c99ec1f87bd4465f77c7ed9b93/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh#L158
-              {
-                assertion = length (filter (bss: bss == radio) (attrNames radioCfg.networks)) == 1;
-                message = ''hostapd radio ${radio}: Exactly one network must be named like the radio, for reasons internal to hostapd.'';
-              }
-              {
-                assertion = (radioCfg.wifi4.enable && builtins.elem "HT40-" radioCfg.wifi4.capabilities) -> radioCfg.channel != 0;
-                message = ''hostapd radio ${radio}: using ACS (channel = 0) together with HT40- (wifi4.capabilities) is unsupported by hostapd'';
-              }
-            ]
-            # BSS warnings
-            ++ (concatLists (mapAttrsToList (bss: bssCfg: let
+          [
+            {
+              assertion = radioCfg.networks != { };
+              message = "hostapd radio ${radio}: At least one network must be configured!";
+            }
+            # XXX: There could be many more useful assertions about (band == xy) -> ensure other required settings.
+            # see https://github.com/openwrt/openwrt/blob/539cb5389d9514c99ec1f87bd4465f77c7ed9b93/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh#L158
+            {
+              assertion = length (filter (bss: bss == radio) (attrNames radioCfg.networks)) == 1;
+              message = ''hostapd radio ${radio}: Exactly one network must be named like the radio, for reasons internal to hostapd.'';
+            }
+            {
+              assertion =
+                (radioCfg.wifi4.enable && builtins.elem "HT40-" radioCfg.wifi4.capabilities)
+                -> radioCfg.channel != 0;
+              message = ''hostapd radio ${radio}: using ACS (channel = 0) together with HT40- (wifi4.capabilities) is unsupported by hostapd'';
+            }
+          ]
+          # BSS warnings
+          ++ (concatLists (
+            mapAttrsToList (
+              bss: bssCfg:
+              let
                 auth = bssCfg.authentication;
                 countWpaPasswordDefinitions = count (x: x != null) [
                   auth.wpaPassword
                   auth.wpaPasswordFile
                   auth.wpaPskFile
                 ];
-              in [
+              in
+              [
                 {
                   assertion = hasPrefix radio bss;
                   message = "hostapd radio ${radio} bss ${bss}: The bss (network) name ${bss} is invalid. It must be prefixed by the radio name for reasons internal to hostapd. A valid name would be e.g. ${radio}, ${radio}-1, ...";
@@ -1173,39 +1381,55 @@ in {
                   message = ''hostapd radio ${radio} bss ${bss}: must use at most one WPA password option (wpaPassword, wpaPasswordFile, wpaPskFile)'';
                 }
                 {
-                  assertion = auth.wpaPassword != null -> (stringLength auth.wpaPassword >= 8 && stringLength auth.wpaPassword <= 63);
+                  assertion =
+                    auth.wpaPassword != null
+                    -> (stringLength auth.wpaPassword >= 8 && stringLength auth.wpaPassword <= 63);
                   message = ''hostapd radio ${radio} bss ${bss}: uses a wpaPassword of invalid length (must be in [8,63]).'';
                 }
                 {
-                  assertion = auth.saePasswords == [] || auth.saePasswordsFile == null;
+                  assertion = auth.saePasswords == [ ] || auth.saePasswordsFile == null;
                   message = ''hostapd radio ${radio} bss ${bss}: must use only one SAE password option (saePasswords or saePasswordsFile)'';
                 }
                 {
-                  assertion = auth.mode == "wpa3-sae" -> (auth.saePasswords != [] || auth.saePasswordsFile != null);
+                  assertion = auth.mode == "wpa3-sae" -> (auth.saePasswords != [ ] || auth.saePasswordsFile != null);
                   message = ''hostapd radio ${radio} bss ${bss}: uses WPA3-SAE which requires defining a sae password option'';
                 }
                 {
-                  assertion = auth.mode == "wpa3-sae-transition" -> (auth.saePasswords != [] || auth.saePasswordsFile != null) && countWpaPasswordDefinitions == 1;
+                  assertion =
+                    auth.mode == "wpa3-sae-transition"
+                    -> (auth.saePasswords != [ ] || auth.saePasswordsFile != null) && countWpaPasswordDefinitions == 1;
                   message = ''hostapd radio ${radio} bss ${bss}: uses WPA3-SAE in transition mode requires defining both a wpa password option and a sae password option'';
                 }
                 {
-                  assertion = (auth.mode == "wpa2-sha1" || auth.mode == "wpa2-sha256") -> countWpaPasswordDefinitions == 1;
+                  assertion =
+                    (auth.mode == "wpa2-sha1" || auth.mode == "wpa2-sha256") -> countWpaPasswordDefinitions == 1;
                   message = ''hostapd radio ${radio} bss ${bss}: uses WPA2-PSK which requires defining a wpa password option'';
                 }
-              ])
-              radioCfg.networks))
-        )
-        cfg.radios));
-
-    environment.systemPackages = [cfg.package];
+              ]
+              ++ optionals (auth.saePasswords != [ ]) (
+                imap1 (i: entry: {
+                  assertion = (entry.password == null) != (entry.passwordFile == null);
+                  message = ''hostapd radio ${radio} bss ${bss} saePassword entry ${i}: must set exactly one of `password` or `passwordFile`'';
+                }) auth.saePasswords
+              )
+            ) radioCfg.networks
+          ))
+        ) cfg.radios
+      ));
+
+    environment.systemPackages = [ cfg.package ];
 
     systemd.services.hostapd = {
       description = "IEEE 802.11 Host Access-Point Daemon";
 
-      path = [cfg.package];
-      after = map (radio: "sys-subsystem-net-devices-${utils.escapeSystemdPath radio}.device") (attrNames cfg.radios);
-      bindsTo = map (radio: "sys-subsystem-net-devices-${utils.escapeSystemdPath radio}.device") (attrNames cfg.radios);
-      wantedBy = ["multi-user.target"];
+      path = [ cfg.package ];
+      after = map (radio: "sys-subsystem-net-devices-${utils.escapeSystemdPath radio}.device") (
+        attrNames cfg.radios
+      );
+      bindsTo = map (radio: "sys-subsystem-net-devices-${utils.escapeSystemdPath radio}.device") (
+        attrNames cfg.radios
+      );
+      wantedBy = [ "multi-user.target" ];
 
       # Create merged configuration and acl files for each radio (and their bss's) prior to starting
       preStart = concatStringsSep "\n" (mapAttrsToList makeRadioRuntimeFiles cfg.radios);
diff --git a/nixos/tests/wpa_supplicant.nix b/nixos/tests/wpa_supplicant.nix
index 180219adca754..d893885ae65b0 100644
--- a/nixos/tests/wpa_supplicant.nix
+++ b/nixos/tests/wpa_supplicant.nix
@@ -35,7 +35,7 @@ let
                 ssid = "nixos-test-sae";
                 authentication = {
                   mode = "wpa3-sae";
-                  saePasswords = [ { password = naughtyPassphrase; } ];
+                  saePasswords = [ { passwordFile = pkgs.writeText "password" naughtyPassphrase; } ];
                 };
                 bssid = "02:00:00:00:00:00";
               };