From 33f9452bed65d8d8cbfcac850d178e1a39c3bbdc Mon Sep 17 00:00:00 2001 From: Jose Martinez Date: Thu, 26 Mar 2026 11:17:11 +0100 Subject: [PATCH 1/3] =?UTF-8?q?feat(BCN01-LAB):=20a=C3=B1adir=20SSID=20EQT?= =?UTF-8?q?-GUEST=20con=20WPA2=20PSK?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/apply.yml | 1 + .github/workflows/plan.yml | 1 + modules/meraki-site/variables.tf | 6 ++++++ sites/BCN01-LAB/ssids.auto.tfvars | 11 +++++++++++ sites/BCN01-LAB/variables.tf | 6 ++++++ 5 files changed, 25 insertions(+) diff --git a/.github/workflows/apply.yml b/.github/workflows/apply.yml index db97234..b377a71 100644 --- a/.github/workflows/apply.yml +++ b/.github/workflows/apply.yml @@ -39,3 +39,4 @@ jobs: AWS_REGION: us-east-1 MERAKI_DASHBOARD_API_KEY: ${{ secrets.MERAKI_DASHBOARD_API_KEY }} TF_VAR_radius_secret: ${{ secrets.RADIUS_SECRET }} + TF_VAR_wifi_password_psk: ${{ secrets.WIFI_PASSWORD_PSK }} \ No newline at end of file diff --git a/.github/workflows/plan.yml b/.github/workflows/plan.yml index 957789f..096270a 100644 --- a/.github/workflows/plan.yml +++ b/.github/workflows/plan.yml @@ -41,6 +41,7 @@ jobs: AWS_REGION: us-east-1 MERAKI_DASHBOARD_API_KEY: ${{ secrets.MERAKI_DASHBOARD_API_KEY }} TF_VAR_radius_secret: ${{ secrets.RADIUS_SECRET }} + TF_VAR_wifi_password_psk: ${{ secrets.WIFI_PASSWORD_PSK }} - name: Comentar Plan en el PR uses: actions/github-script@v7 diff --git a/modules/meraki-site/variables.tf b/modules/meraki-site/variables.tf index f4c55d9..0c69c15 100755 --- a/modules/meraki-site/variables.tf +++ b/modules/meraki-site/variables.tf @@ -58,6 +58,12 @@ variable "radius_secret" { description = "Shared secret para autenticación RADIUS. Pasar via TF_VAR_radius_secret" } +variable "wifi_password_psk" { + type = string + description = "Password para la SSID WPA2 desde GitHub Secrets" + sensitive = true +} + # Definición del mapa de VLANs variable "switch_vlans" { type = map(object({ diff --git a/sites/BCN01-LAB/ssids.auto.tfvars b/sites/BCN01-LAB/ssids.auto.tfvars index 7c4a777..f4989f3 100644 --- a/sites/BCN01-LAB/ssids.auto.tfvars +++ b/sites/BCN01-LAB/ssids.auto.tfvars @@ -20,5 +20,16 @@ wireless_ssids = [ port = 1912 } ] + }, + { + number = 1 + name = "EQT-GUEST" + enabled = true + auth_mode = "psk" # Modo para contraseña compartida + wpa_encryption_mode = "WPA2 only" # Lo que pediste para compatibilidad + psk = var.wifi_password_psk # Esta variable vendrá de GitHub Secrets + ip_assignment_mode = "Bridge mode" + use_vlan_tagging = true + default_vlan_id = 101 } ] diff --git a/sites/BCN01-LAB/variables.tf b/sites/BCN01-LAB/variables.tf index 4af645a..e3537c9 100755 --- a/sites/BCN01-LAB/variables.tf +++ b/sites/BCN01-LAB/variables.tf @@ -50,6 +50,12 @@ variable "wireless_ssids" { description = "Lista de SSIDs wireless a configurar en el site" } +variable "wifi_password_psk" { + type = string + description = "Password para la SSID WPA2 desde GitHub Secrets" + sensitive = true +} + # Shared secret para servidores RADIUS (sensible, no incluir en tfvars) variable "radius_secret" { type = string From 314f1c539177f6f3d674d3a2e9cb183800f62c49 Mon Sep 17 00:00:00 2001 From: Jose Martinez Date: Thu, 26 Mar 2026 11:22:08 +0100 Subject: [PATCH 2/3] fix: psk no puede usar var. en tfvars, se inyecta via TF_VAR MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - ssids.auto.tfvars: eliminada referencia var.wifi_password_psk (inválida en ficheros tfvars) - main.tf: psk usa each.value.psk si está definido, sino cae en var.wifi_password_psk (TF_VAR_wifi_password_psk desde GitHub Secrets) Co-Authored-By: Claude Sonnet 4.6 --- modules/meraki-site/main.tf | 3 ++- sites/BCN01-LAB/ssids.auto.tfvars | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/modules/meraki-site/main.tf b/modules/meraki-site/main.tf index 1195b1f..1e4724e 100755 --- a/modules/meraki-site/main.tf +++ b/modules/meraki-site/main.tf @@ -160,7 +160,8 @@ resource "meraki_wireless_ssid" "ssids" { name = each.value.name enabled = each.value.enabled auth_mode = each.value.auth_mode - psk = each.value.psk + # Si el SSID no tiene psk en el tfvars, usa var.wifi_password_psk (TF_VAR_wifi_password_psk) + psk = each.value.psk != null ? each.value.psk : var.wifi_password_psk # wpa_encryption_mode solo es compatible con auth_mode != "open" # Para OWE (open + WPA3) la API rechaza el campo; la encriptación Enhanced Open # se negocia a nivel de beacon y no se expone como atributo de la API Meraki. diff --git a/sites/BCN01-LAB/ssids.auto.tfvars b/sites/BCN01-LAB/ssids.auto.tfvars index f4989f3..d84a38b 100644 --- a/sites/BCN01-LAB/ssids.auto.tfvars +++ b/sites/BCN01-LAB/ssids.auto.tfvars @@ -27,7 +27,7 @@ wireless_ssids = [ enabled = true auth_mode = "psk" # Modo para contraseña compartida wpa_encryption_mode = "WPA2 only" # Lo que pediste para compatibilidad - psk = var.wifi_password_psk # Esta variable vendrá de GitHub Secrets + # psk se inyecta via TF_VAR_wifi_password_psk (GitHub secret WIFI_PASSWORD_PSK) ip_assignment_mode = "Bridge mode" use_vlan_tagging = true default_vlan_id = 101 From b110644466362dc11eb714ad55401d92b0bd7dc4 Mon Sep 17 00:00:00 2001 From: Jose Martinez Date: Thu, 26 Mar 2026 11:32:22 +0100 Subject: [PATCH 3/3] feat(BCN01-LAB): actualizar main.tf del site --- sites/BCN01-LAB/main.tf | 1 + 1 file changed, 1 insertion(+) diff --git a/sites/BCN01-LAB/main.tf b/sites/BCN01-LAB/main.tf index 1b252d4..c4f0b92 100755 --- a/sites/BCN01-LAB/main.tf +++ b/sites/BCN01-LAB/main.tf @@ -36,4 +36,5 @@ module "bcn01_lab" { switch_management_vlan = var.switch_management_vlan stack_routing_interfaces = var.stack_routing_interfaces appliance_ports = var.appliance_ports + wifi_password_psk = var.wifi_password_psk }