From 4cf91c5c967e5152f12f2034fe2c6945581cefc9 Mon Sep 17 00:00:00 2001 From: Jose Martinez Date: Fri, 27 Mar 2026 08:32:54 +0100 Subject: [PATCH 1/7] wip: add SSID slot 3 placeholder for drift detection via terraform plan --- sites/BCN01-LAB/ssids.auto.tfvars | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/sites/BCN01-LAB/ssids.auto.tfvars b/sites/BCN01-LAB/ssids.auto.tfvars index cd6f32a..854c189 100644 --- a/sites/BCN01-LAB/ssids.auto.tfvars +++ b/sites/BCN01-LAB/ssids.auto.tfvars @@ -23,6 +23,14 @@ wireless_ssids = [ } ] }, + { + # SSID slot 3 — creada manualmente en el Dashboard, pendiente de revisar con terraform plan + # Los valores reales se sincronizan desde el output del plan (borrar este comentario cuando esté validado) + number = 3 + name = "PENDING_REVIEW" + auth_mode = "open" + enabled = false + }, { number = 1 name = "EQT-GUEST" From af7f59f3c2d0badddc87cd4652dfe58d29f1aa55 Mon Sep 17 00:00:00 2001 From: Jose Martinez Date: Fri, 27 Mar 2026 08:37:14 +0100 Subject: [PATCH 2/7] fix: only inject PSK and wpa_encryption_mode for auth_mode=psk SSIDs --- modules/meraki-site/main.tf | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/modules/meraki-site/main.tf b/modules/meraki-site/main.tf index a2da0ab..be04d4f 100755 --- a/modules/meraki-site/main.tf +++ b/modules/meraki-site/main.tf @@ -160,12 +160,10 @@ resource "meraki_wireless_ssid" "ssids" { name = each.value.name enabled = each.value.enabled auth_mode = each.value.auth_mode - # Si el SSID no tiene psk en el tfvars, usa var.wifi_password_psk (TF_VAR_wifi_password_psk) - psk = each.value.psk != null ? each.value.psk : var.wifi_password_psk - # wpa_encryption_mode solo es compatible con auth_mode != "open" - # Para OWE (open + WPA3) la API rechaza el campo; la encriptación Enhanced Open - # se negocia a nivel de beacon y no se expone como atributo de la API Meraki. - wpa_encryption_mode = each.value.auth_mode != "open" ? each.value.wpa_encryption_mode : null + # PSK solo se envía para SSIDs con auth_mode "psk"; para open/open-enhanced se deja null + psk = each.value.auth_mode == "psk" ? (each.value.psk != null ? each.value.psk : var.wifi_password_psk) : null + # wpa_encryption_mode solo aplica a SSIDs con PSK; open y open-enhanced (OWE) no lo usan + wpa_encryption_mode = each.value.auth_mode == "psk" ? each.value.wpa_encryption_mode : null encryption_mode = each.value.encryption_mode splash_page = each.value.splash_page ip_assignment_mode = each.value.ip_assignment_mode From 02381faf91d02bfae6d73b6504ecd6e4e0187ff2 Mon Sep 17 00:00:00 2001 From: Jose Martinez Date: Fri, 27 Mar 2026 08:38:20 +0100 Subject: [PATCH 3/7] fix: SSID slot 3 -> slot 2 (Meraki indexa desde 0) --- sites/BCN01-LAB/ssids.auto.tfvars | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sites/BCN01-LAB/ssids.auto.tfvars b/sites/BCN01-LAB/ssids.auto.tfvars index 854c189..6a3500c 100644 --- a/sites/BCN01-LAB/ssids.auto.tfvars +++ b/sites/BCN01-LAB/ssids.auto.tfvars @@ -24,9 +24,9 @@ wireless_ssids = [ ] }, { - # SSID slot 3 — creada manualmente en el Dashboard, pendiente de revisar con terraform plan + # SSID slot 2 — creada manualmente en el Dashboard, pendiente de revisar con terraform plan # Los valores reales se sincronizan desde el output del plan (borrar este comentario cuando esté validado) - number = 3 + number = 2 name = "PENDING_REVIEW" auth_mode = "open" enabled = false From 27292fddb6df50f5c37712d9c6901d6b9518f237 Mon Sep 17 00:00:00 2001 From: Jose Martinez Date: Fri, 27 Mar 2026 08:39:00 +0100 Subject: [PATCH 4/7] fix: set real name for SSID slot 2 (EQT-CORPO-OWE-OK) --- sites/BCN01-LAB/ssids.auto.tfvars | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/sites/BCN01-LAB/ssids.auto.tfvars b/sites/BCN01-LAB/ssids.auto.tfvars index 6a3500c..ae89504 100644 --- a/sites/BCN01-LAB/ssids.auto.tfvars +++ b/sites/BCN01-LAB/ssids.auto.tfvars @@ -24,10 +24,8 @@ wireless_ssids = [ ] }, { - # SSID slot 2 — creada manualmente en el Dashboard, pendiente de revisar con terraform plan - # Los valores reales se sincronizan desde el output del plan (borrar este comentario cuando esté validado) number = 2 - name = "PENDING_REVIEW" + name = "EQT-CORPO-OWE-OK" auth_mode = "open" enabled = false }, From ab3f30469b3bda76767cd741c1fd708afb2f4ba3 Mon Sep 17 00:00:00 2001 From: Jose Martinez Date: Fri, 27 Mar 2026 08:43:08 +0100 Subject: [PATCH 5/7] fix: sync wpa_encryption_mode WPA3 only for EQT-CORPO OWE + pass through from tfvars --- modules/meraki-site/main.tf | 4 ++-- sites/BCN01-LAB/ssids.auto.tfvars | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/meraki-site/main.tf b/modules/meraki-site/main.tf index be04d4f..4379bdd 100755 --- a/modules/meraki-site/main.tf +++ b/modules/meraki-site/main.tf @@ -162,8 +162,8 @@ resource "meraki_wireless_ssid" "ssids" { auth_mode = each.value.auth_mode # PSK solo se envía para SSIDs con auth_mode "psk"; para open/open-enhanced se deja null psk = each.value.auth_mode == "psk" ? (each.value.psk != null ? each.value.psk : var.wifi_password_psk) : null - # wpa_encryption_mode solo aplica a SSIDs con PSK; open y open-enhanced (OWE) no lo usan - wpa_encryption_mode = each.value.auth_mode == "psk" ? each.value.wpa_encryption_mode : null + # wpa_encryption_mode se pasa directamente desde el tfvars (null si no aplica) + wpa_encryption_mode = each.value.wpa_encryption_mode encryption_mode = each.value.encryption_mode splash_page = each.value.splash_page ip_assignment_mode = each.value.ip_assignment_mode diff --git a/sites/BCN01-LAB/ssids.auto.tfvars b/sites/BCN01-LAB/ssids.auto.tfvars index ae89504..2e210ed 100644 --- a/sites/BCN01-LAB/ssids.auto.tfvars +++ b/sites/BCN01-LAB/ssids.auto.tfvars @@ -10,7 +10,7 @@ wireless_ssids = [ auth_mode = "open-enhanced" # OWE (Opportunistic Wireless Encryption) # Meraki API utiliza "open-enhanced" para indicar Enhanced Open / OWE. # Este valor refleja exactamente lo que está configurado en el Dashboard. - wpa_encryption_mode = null + wpa_encryption_mode = "WPA3 only" splash_page = "Password-protected with custom RADIUS" ip_assignment_mode = "Bridge mode" use_vlan_tagging = true From 1919e1ffc93b708081e1f9be044a494d4dc859b5 Mon Sep 17 00:00:00 2001 From: Jose Martinez Date: Fri, 27 Mar 2026 11:35:06 +0100 Subject: [PATCH 6/7] feat: add EQT-CORPO-OWE-OK SSID (slot 2) synced from Dashboard --- sites/BCN01-LAB/ssids.auto.tfvars | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/sites/BCN01-LAB/ssids.auto.tfvars b/sites/BCN01-LAB/ssids.auto.tfvars index 2e210ed..bacef8c 100644 --- a/sites/BCN01-LAB/ssids.auto.tfvars +++ b/sites/BCN01-LAB/ssids.auto.tfvars @@ -24,10 +24,21 @@ wireless_ssids = [ ] }, { - number = 2 - name = "EQT-CORPO-OWE-OK" - auth_mode = "open" - enabled = false + number = 2 + name = "EQT-CORPO-OWE-OK" + enabled = true + auth_mode = "open" + splash_page = "Password-protected with custom RADIUS" + ip_assignment_mode = "Bridge mode" + use_vlan_tagging = true + default_vlan_id = 100 + redirect_url = "https://www.adevinta.com" + radius_servers = [ + { + host = "15.15.15.15" + port = 1912 + } + ] }, { number = 1 From e6668edd37cc23a7b7abac805ef4768277df598f Mon Sep 17 00:00:00 2001 From: Jose Martinez Date: Fri, 27 Mar 2026 11:53:02 +0100 Subject: [PATCH 7/7] feat: add visible field to SSID module + hide EQT-CORPO-OWE-OK --- modules/meraki-site/main.tf | 1 + modules/meraki-site/variables.tf | 1 + sites/BCN01-LAB/ssids.auto.tfvars | 1 + 3 files changed, 3 insertions(+) diff --git a/modules/meraki-site/main.tf b/modules/meraki-site/main.tf index 4379bdd..b3c498a 100755 --- a/modules/meraki-site/main.tf +++ b/modules/meraki-site/main.tf @@ -159,6 +159,7 @@ resource "meraki_wireless_ssid" "ssids" { number = each.value.number name = each.value.name enabled = each.value.enabled + visible = each.value.visible auth_mode = each.value.auth_mode # PSK solo se envía para SSIDs con auth_mode "psk"; para open/open-enhanced se deja null psk = each.value.auth_mode == "psk" ? (each.value.psk != null ? each.value.psk : var.wifi_password_psk) : null diff --git a/modules/meraki-site/variables.tf b/modules/meraki-site/variables.tf index 76b43d9..8686059 100755 --- a/modules/meraki-site/variables.tf +++ b/modules/meraki-site/variables.tf @@ -33,6 +33,7 @@ variable "wireless_ssids" { number = number name = string enabled = optional(bool, true) + visible = optional(bool, true) # false = SSID oculto (no broadcast) auth_mode = string psk = optional(string, null) # Contraseña WPA2/WPA3-PSK (sensible, usar TF_VAR o secret) encryption_mode = optional(string, null) # "wpa" para PSK; null para open/OWE diff --git a/sites/BCN01-LAB/ssids.auto.tfvars b/sites/BCN01-LAB/ssids.auto.tfvars index bacef8c..33a5788 100644 --- a/sites/BCN01-LAB/ssids.auto.tfvars +++ b/sites/BCN01-LAB/ssids.auto.tfvars @@ -27,6 +27,7 @@ wireless_ssids = [ number = 2 name = "EQT-CORPO-OWE-OK" enabled = true + visible = false # SSID oculto — no hace broadcast del nombre auth_mode = "open" splash_page = "Password-protected with custom RADIUS" ip_assignment_mode = "Bridge mode"