From 33f9452bed65d8d8cbfcac850d178e1a39c3bbdc Mon Sep 17 00:00:00 2001
From: Jose Martinez <jose.martinez@armenteros.org>
Date: Thu, 26 Mar 2026 11:17:11 +0100
Subject: [PATCH] =?UTF-8?q?feat(BCN01-LAB):=20a=C3=B1adir=20SSID=20EQT-GUE?=
 =?UTF-8?q?ST=20con=20WPA2=20PSK?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/apply.yml       |  1 +
 .github/workflows/plan.yml        |  1 +
 modules/meraki-site/variables.tf  |  6 ++++++
 sites/BCN01-LAB/ssids.auto.tfvars | 11 +++++++++++
 sites/BCN01-LAB/variables.tf      |  6 ++++++
 5 files changed, 25 insertions(+)

diff --git a/.github/workflows/apply.yml b/.github/workflows/apply.yml
index db97234..b377a71 100644
--- a/.github/workflows/apply.yml
+++ b/.github/workflows/apply.yml
@@ -39,3 +39,4 @@ jobs:
           AWS_REGION:               us-east-1
           MERAKI_DASHBOARD_API_KEY: ${{ secrets.MERAKI_DASHBOARD_API_KEY }}
           TF_VAR_radius_secret:     ${{ secrets.RADIUS_SECRET }}
+          TF_VAR_wifi_password_psk: ${{ secrets.WIFI_PASSWORD_PSK }}
\ No newline at end of file
diff --git a/.github/workflows/plan.yml b/.github/workflows/plan.yml
index 957789f..096270a 100644
--- a/.github/workflows/plan.yml
+++ b/.github/workflows/plan.yml
@@ -41,6 +41,7 @@ jobs:
           AWS_REGION:                  us-east-1
           MERAKI_DASHBOARD_API_KEY:    ${{ secrets.MERAKI_DASHBOARD_API_KEY }}
           TF_VAR_radius_secret:        ${{ secrets.RADIUS_SECRET }}
+          TF_VAR_wifi_password_psk:    ${{ secrets.WIFI_PASSWORD_PSK }}
 
       - name: Comentar Plan en el PR
         uses: actions/github-script@v7
diff --git a/modules/meraki-site/variables.tf b/modules/meraki-site/variables.tf
index f4c55d9..0c69c15 100755
--- a/modules/meraki-site/variables.tf
+++ b/modules/meraki-site/variables.tf
@@ -58,6 +58,12 @@ variable "radius_secret" {
   description = "Shared secret para autenticación RADIUS. Pasar via TF_VAR_radius_secret"
 }
 
+variable "wifi_password_psk" {
+  type      = string
+  description = "Password para la SSID WPA2 desde GitHub Secrets"
+  sensitive = true
+}
+
 # Definición del mapa de VLANs
 variable "switch_vlans" {
   type = map(object({
diff --git a/sites/BCN01-LAB/ssids.auto.tfvars b/sites/BCN01-LAB/ssids.auto.tfvars
index 7c4a777..f4989f3 100644
--- a/sites/BCN01-LAB/ssids.auto.tfvars
+++ b/sites/BCN01-LAB/ssids.auto.tfvars
@@ -20,5 +20,16 @@ wireless_ssids = [
         port = 1912
       }
     ]
+  },
+  {
+    number              = 1
+    name                = "EQT-GUEST"
+    enabled             = true
+    auth_mode           = "psk"            # Modo para contraseña compartida
+    wpa_encryption_mode = "WPA2 only"     # Lo que pediste para compatibilidad
+    psk                 = var.wifi_password_psk # Esta variable vendrá de GitHub Secrets
+    ip_assignment_mode  = "Bridge mode"
+    use_vlan_tagging    = true
+    default_vlan_id     = 101
   }
 ]
diff --git a/sites/BCN01-LAB/variables.tf b/sites/BCN01-LAB/variables.tf
index 4af645a..e3537c9 100755
--- a/sites/BCN01-LAB/variables.tf
+++ b/sites/BCN01-LAB/variables.tf
@@ -50,6 +50,12 @@ variable "wireless_ssids" {
   description = "Lista de SSIDs wireless a configurar en el site"
 }
 
+variable "wifi_password_psk" {
+  type      = string
+  description = "Password para la SSID WPA2 desde GitHub Secrets"
+  sensitive = true
+}
+
 # Shared secret para servidores RADIUS (sensible, no incluir en tfvars)
 variable "radius_secret" {
   type        = string