diff --git a/machines/moonlark/default.nix b/machines/moonlark/default.nix
index cf1f231..e6e4784 100644
--- a/machines/moonlark/default.nix
+++ b/machines/moonlark/default.nix
@@ -312,6 +312,11 @@
         "QargoCoffee-Guest".psk = "Lavazza@7";
         "Fulton".psk = "9064405930";
         "TP-LINK_ECF0".psk = "ad1066AD!";
+        "eduroam" = {
+          eduroam = true;
+          identity = "kieranklukas@cedarville.edu";
+          pskVar = "psk_cedarville";
+        };
       };
     };
   };
diff --git a/modules/nixos/system/wifi.nix b/modules/nixos/system/wifi.nix
index f28938e..d120de6 100644
--- a/modules/nixos/system/wifi.nix
+++ b/modules/nixos/system/wifi.nix
@@ -3,12 +3,18 @@
 # This module provides a simpler way to declare wifi profiles with network manager.
 # - you can pass the PSK via environment variable, direct value, or file.
 # - profiles are defined in `atelier.network.wifi.profiles`.
+# - eduroam networks are supported with the `eduroam = true` flag.
 #
 # Example usage:
 #   atelier.network.wifi = {
 #     enable = true;
 #     profiles = {
 #       "MySSID" = { psk = "supersecret"; };
+#       "eduroam" = {
+#         eduroam = true;
+#         identity = "user@university.edu";
+#         psk = "password";
+#       };
 #     };
 #   };
 
@@ -26,6 +32,8 @@ let
       pskVar ? null,
       psk ? null,
       pskFile ? null,
+      eduroam ? false,
+      identity ? null,
     }:
     let
       base = {
@@ -44,7 +52,37 @@ let
         };
       };
       sec =
-        if pskVar != null then
+        if eduroam then
+          if pskVar != null then
+            {
+              wifi-security = {
+                key-mgmt = "wpa-eap";
+                password = "$" + pskVar;
+                identity = identity;
+                phase2-auth = "mschapv2";
+              };
+            }
+          else if psk != null then
+            {
+              wifi-security = {
+                key-mgmt = "wpa-eap";
+                password = psk;
+                identity = identity;
+                phase2-auth = "mschapv2";
+              };
+            }
+          else if pskFile != null then
+            {
+              wifi-security = {
+                key-mgmt = "wpa-eap";
+                password = "$(" + pkgs.coreutils + "/bin/cat " + pskFile + ")";
+                identity = identity;
+                phase2-auth = "mschapv2";
+              };
+            }
+          else
+            { }
+        else if pskVar != null then
           {
             wifi-security = {
               key-mgmt = "wpa-psk";
@@ -106,12 +144,22 @@ in
                 type = lib.types.nullOr lib.types.path;
                 default = null;
               };
+              eduroam = lib.mkOption {
+                type = lib.types.bool;
+                default = false;
+                description = "Enable eduroam configuration";
+              };
+              identity = lib.mkOption {
+                type = lib.types.nullOr lib.types.str;
+                default = null;
+                description = "Identity for eduroam authentication";
+              };
             };
           }
         )
       );
       default = { };
-      description = "Map of SSID -> { pskVar | psk | pskFile }.";
+      description = "Map of SSID -> { pskVar | psk | pskFile | eduroam config }.";
     };
   };
 
diff --git a/secrets/wifi.age b/secrets/wifi.age
index b602f01f6fa0cae08b65a296e6418ed43e8e4ff8..9704a3e3d0f676513704a7b87f9a1fa4bc9a8c15 100644
GIT binary patch
delta 813
zcmbQic7kn!M!i#3R(`p*NoBfQSxKaKU`|w!aYaUDWMY0{R%Lo(K~R`umAk)dpg~@V
zi*|{3Qc{q9WkqIbS%ihLw?UvuN)ea4n@hP%NTp|JW_h-uN07g9grQ@Zd191@nMJvK
zWm=A@x1V=<m}{7;sc({DdVy=cfn~UBV6m@9xM@UHSiPY$S3smivWdHAW_V(rscC3o
zg`0L*Mt-uPMP^`8MVNO$QJ!&7p{I$zzk!)orJtK`L8QB-Yo&HZT0n4daIj&bHkX%W
zZn&v=aFu7eVV*~zv4wwjxp8T-p_#v<dq_%-L0Vv9fN`jMnQK8=VX&`rP?ULwUx=?+
zigAWZM7>*iqF)M^Td}`$nR`iAPHI+^QHfDfNV&JKYj9~)abZSsP?2d$cut|eet=V6
zzOPGYRIou#aiLR0X_Zk`MOI2gQnGUim#L#;u5X&5MX6UsX_0oiVP#HIicg@IL8^I4
zNVZForFoi3QG`dKL0(u&Vq}zKSgvP<bA?NVcD<2lZbi9UNGg|pWtnT3XP9?}bAi9N
ztGP*`sgFmhccrCiT7a{Gr?$R%YNDxsqF<V!en>#BrF*$^QIcs;n16(Slxc8TxxXQo
zZ$xIUS8#BSe_}vnj$dk;caoz~xIs#ViNBX)mPuBoVNpO*rAw)!xu3pUX;zVkccy1}
zWW8@*g`uB$j$5Fq7Z;bVuC794fk${ns)1*6iGho&VXj3)x|?Z<SxQc(VR}%3ud#l)
zag=s?L8NhRfB_db+bwQ|$;;HG)kS6oC@;Jbv$^(X=lc><h9?i#-4{Kmv1HTt+C8_}
zyo+y^UFAG^{{D_-rE({t{avrjInA`eW24A2hWeP&eWtGJcITcOP2H?}^4YbQzEA)D
zlj?sdRD8DapIx_4Ncn~Bs@8%U?5_`-S@k}@DwgzcmOp2DL40+}`ijt}r8=#%d?Kyi
zgr*gr+~=b$(BrW3C`U=Cmf_Z&u4hhm&%CZQ)owM*IiG-YlYQltuAiM~wf-CDn{!b-
zekIlKW*a1{G4ZhVylQobQ$4qS|F--B?GpD=)9c@s2{%8}KYXN`{d!Bjr~%7l0H0zl
AX#fBK

delta 764
zcmX@XHiK<~Mt!8GVOm&aK$UTFs9`~IZceg(g;S-4d1Q%&xqGQ&xKDAhg@L(Yk%voa
zK)$6%QDRVFkcoeplZi!Co|BKIX*O3uTBVOyd2(byihF56L6&JqNl8jpVSc8IWr|ax
zlTUJSkxP|}OQvaMYH)T`vSn_Rfss$4zF|a!NvMBWQoX(-my5YUSYW0}Qhro;N|0r`
zUv_!0X`qK$P@zS5p;3Nda=KxGuW6NcZe+5Vey~xFpNWBCvZcF6n2Wbjv2S^47*}3a
zN<dM*zNKG?c8O0xS!K9+dP+{3QIV%dUXf9DqF;%#Z@EFLQ@Tl^acE9JXh@=dcBOkr
zQDuHbalN*ar;!O)o=H-GQ--HYlw*;(m!nZhahRJ?o<UBSe@RY-wo|raSYCl!ka=Ed
zl7YW>NNG})r?!5nr*~?xxo22OZb)t<m$65fzL}YytEZd4o3puRqE|{rnqRhIZdHYG
zR!V@OS#YA4g?@-zl#6z_m$R9vOL2&^Z$?3~SG{(Uqg!E`PY#!brE5i)YmTR<f00X&
zQ;BzxkxPC-P(f8uq<^ZPlb61JWsr8Jc}1nRf1Y1Tp|Ov?sjq29YPi2^ab8-EMP?;e
zP_lcLd4Y+GZ?TV4NMvwfl75&+rlWUZl6irjUx-&qnR%sUiA9cwlSx#Xi$`X0u&298
zMtxYSOJq)No>Q(<5EqxOuC9WiM{<s9M1Gi&ab|&KxVfcaxu?FNVMa=5vWuxfwqams
zxM7)3u0?oGnE}@yaSqcJS0iVywqJB){RFP#)e(PF6d!C~ZBcFfdc&oOdUsUT9%|#*
zDt=lqG9%Rd1LOTpjkl4D%u;UGt>03|^+v*VeyQr+Sckxdr)~@^jq!QinXGY!zLDye
z_X;}tDDRqSv9;yPJUPprnaq6JLW{n>eX0KC|BET@3r#&&+^Bf;C+G`D*&qM4s=I3E
zW#(MlY3s!Cg@Z#TbnDbCyVq@Hw!#~_t9&+bdG{?UUa0NK@x<+gtl*akNBT?E0jwPp
ASpWb4