feat: add EQT-CORPO SSID with OWE and Okta RADIUS

modules/meraki-site/main.tf

@@ -43,7 +43,34 @@ resource "meraki_appliance_vlan" "mx_gateways" {
   dhcp_handling      = each.value.dhcp_handling
 }
 
-# 3. Reglas de firewall L3
+# 3. SSIDs wireless
+resource "meraki_wireless_ssid" "ssids" {
+  for_each   = { for s in var.wireless_ssids : tostring(s.number) => s }
+  depends_on = [meraki_appliance_vlans_settings.activate_vlans]
+
+  network_id          = local.network_id
+  number              = each.value.number
+  name                = each.value.name
+  enabled             = each.value.enabled
+  auth_mode           = each.value.auth_mode
+  splash_page         = each.value.splash_page
+  wpa_encryption_mode = each.value.wpa_encryption_mode
+  ip_assignment_mode  = each.value.ip_assignment_mode
+  use_vlan_tagging    = each.value.use_vlan_tagging
+  default_vlan_id     = each.value.default_vlan_id
+  splash_url          = each.value.redirect_url != "" ? each.value.redirect_url : null
+
+  dynamic "radius_servers" {
+    for_each = each.value.radius_servers
+    content {
+      host   = radius_servers.value.host
+      port   = radius_servers.value.port
+      secret = var.radius_secret
+    }
+  }
+}
+
+# 4. Reglas de firewall L3
 resource "meraki_appliance_l3_firewall_rules" "reglas_firewall" {
   network_id = local.network_id
   rules      = var.firewall_rules

modules/meraki-site/variables.tf

@@ -27,6 +27,36 @@ variable "firewall_rules" {
   description = "Reglas de firewall L3 para el site. Se aplican en orden, antes de la regla allow-all implícita de Meraki"
 }
 
+# SSIDs wireless
+variable "wireless_ssids" {
+  type = list(object({
+    number           = number
+    name             = string
+    enabled          = optional(bool, true)
+    auth_mode        = string
+    splash_page      = optional(string, "None")
+    wpa_encryption_mode = optional(string, "WPA3 only")
+    ip_assignment_mode  = optional(string, "Bridge mode")
+    use_vlan_tagging    = optional(bool, false)
+    default_vlan_id     = optional(number, null)
+    redirect_url        = optional(string, "")
+    radius_servers = optional(list(object({
+      host = string
+      port = number
+    })), [])
+  }))
+  default     = []
+  description = "Lista de SSIDs wireless a configurar en el site"
+}
+
+# Shared secret para servidores RADIUS (sensible, no incluir en tfvars)
+variable "radius_secret" {
+  type        = string
+  sensitive   = true
+  default     = ""
+  description = "Shared secret para autenticación RADIUS. Pasar via TF_VAR_radius_secret"
+}
+
 # Definición del mapa de VLANs
 variable "switch_vlans" {
   type = map(object({