diff --git a/.github/workflows/apply.yml b/.github/workflows/apply.yml index 036c790..46b1efb 100644 --- a/.github/workflows/apply.yml +++ b/.github/workflows/apply.yml @@ -38,3 +38,4 @@ jobs: AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} AWS_REGION: us-east-1 MERAKI_DASHBOARD_API_KEY: ${{ secrets.MERAKI_DASHBOARD_API_KEY }} + TF_VAR_radius_secret: ${{ secrets.RADIUS_SECRET }} diff --git a/.github/workflows/plan.yml b/.github/workflows/plan.yml index 7771df8..3c3b92c 100644 --- a/.github/workflows/plan.yml +++ b/.github/workflows/plan.yml @@ -40,6 +40,7 @@ jobs: AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} AWS_REGION: us-east-1 MERAKI_DASHBOARD_API_KEY: ${{ secrets.MERAKI_DASHBOARD_API_KEY }} + TF_VAR_radius_secret: ${{ secrets.RADIUS_SECRET }} - name: Comentar Plan en el PR uses: actions/github-script@v7 diff --git a/modules/meraki-site/main.tf b/modules/meraki-site/main.tf index f694ae0..df92bed 100755 --- a/modules/meraki-site/main.tf +++ b/modules/meraki-site/main.tf @@ -43,7 +43,34 @@ resource "meraki_appliance_vlan" "mx_gateways" { dhcp_handling = each.value.dhcp_handling } -# 3. Reglas de firewall L3 +# 3. SSIDs wireless +resource "meraki_wireless_ssid" "ssids" { + for_each = { for s in var.wireless_ssids : tostring(s.number) => s } + depends_on = [meraki_appliance_vlans_settings.activate_vlans] + + network_id = local.network_id + number = each.value.number + name = each.value.name + enabled = each.value.enabled + auth_mode = each.value.auth_mode + splash_page = each.value.splash_page + wpa_encryption_mode = each.value.wpa_encryption_mode + ip_assignment_mode = each.value.ip_assignment_mode + use_vlan_tagging = each.value.use_vlan_tagging + default_vlan_id = each.value.default_vlan_id + splash_url = each.value.redirect_url != "" ? each.value.redirect_url : null + + dynamic "radius_servers" { + for_each = each.value.radius_servers + content { + host = radius_servers.value.host + port = radius_servers.value.port + secret = var.radius_secret + } + } +} + +# 4. Reglas de firewall L3 resource "meraki_appliance_l3_firewall_rules" "reglas_firewall" { network_id = local.network_id rules = var.firewall_rules diff --git a/modules/meraki-site/variables.tf b/modules/meraki-site/variables.tf index ec4a72a..ac43bcc 100755 --- a/modules/meraki-site/variables.tf +++ b/modules/meraki-site/variables.tf @@ -27,6 +27,36 @@ variable "firewall_rules" { description = "Reglas de firewall L3 para el site. Se aplican en orden, antes de la regla allow-all implícita de Meraki" } +# SSIDs wireless +variable "wireless_ssids" { + type = list(object({ + number = number + name = string + enabled = optional(bool, true) + auth_mode = string + splash_page = optional(string, "None") + wpa_encryption_mode = optional(string, "WPA3 only") + ip_assignment_mode = optional(string, "Bridge mode") + use_vlan_tagging = optional(bool, false) + default_vlan_id = optional(number, null) + redirect_url = optional(string, "") + radius_servers = optional(list(object({ + host = string + port = number + })), []) + })) + default = [] + description = "Lista de SSIDs wireless a configurar en el site" +} + +# Shared secret para servidores RADIUS (sensible, no incluir en tfvars) +variable "radius_secret" { + type = string + sensitive = true + default = "" + description = "Shared secret para autenticación RADIUS. Pasar via TF_VAR_radius_secret" +} + # Definición del mapa de VLANs variable "switch_vlans" { type = map(object({ diff --git a/sites/bcn01/main.tf b/sites/bcn01/main.tf index a53db65..a88a566 100755 --- a/sites/bcn01/main.tf +++ b/sites/bcn01/main.tf @@ -27,4 +27,6 @@ module "bcn01" { network_name = var.network_name switch_vlans = var.switch_vlans firewall_rules = var.firewall_rules + wireless_ssids = var.wireless_ssids + radius_secret = var.radius_secret } diff --git a/sites/bcn01/ssids.auto.tfvars b/sites/bcn01/ssids.auto.tfvars new file mode 100644 index 0000000..a64bf31 --- /dev/null +++ b/sites/bcn01/ssids.auto.tfvars @@ -0,0 +1,24 @@ +# SSIDs wireless - BCN01 +# NOTA: El shared secret de RADIUS NO está aquí. +# Se pasa como variable de entorno TF_VAR_radius_secret (GitHub secret: RADIUS_SECRET) + +wireless_ssids = [ + { + number = 0 + name = "EQT-CORPO" + enabled = true + auth_mode = "open-with-radius" + splash_page = "Password-protected with custom RADIUS" + wpa_encryption_mode = "WPA3 only" + ip_assignment_mode = "Bridge mode" + use_vlan_tagging = true + default_vlan_id = 100 + redirect_url = "https://www.adevinta.com" + radius_servers = [ + { + host = "15.15.15.15" + port = 1912 + } + ] + } +] diff --git a/sites/bcn01/variables.tf b/sites/bcn01/variables.tf index 74c05b5..7e983d6 100755 --- a/sites/bcn01/variables.tf +++ b/sites/bcn01/variables.tf @@ -27,6 +27,36 @@ variable "firewall_rules" { description = "Lista de reglas de firewall L3 para el site" } +# SSIDs wireless +variable "wireless_ssids" { + type = list(object({ + number = number + name = string + enabled = optional(bool, true) + auth_mode = string + splash_page = optional(string, "None") + wpa_encryption_mode = optional(string, "WPA3 only") + ip_assignment_mode = optional(string, "Bridge mode") + use_vlan_tagging = optional(bool, false) + default_vlan_id = optional(number, null) + redirect_url = optional(string, "") + radius_servers = optional(list(object({ + host = string + port = number + })), []) + })) + default = [] + description = "Lista de SSIDs wireless a configurar en el site" +} + +# Shared secret para servidores RADIUS (sensible, no incluir en tfvars) +variable "radius_secret" { + type = string + sensitive = true + default = "" + description = "Shared secret para autenticación RADIUS. Pasar via TF_VAR_radius_secret" +} + # Definición de VLANs variable "switch_vlans" { type = map(object({