Merge pull request #5 from its-corp/feature/add-ssid-eqt-corpo

feat: add EQT-CORPO SSID with OWE and Okta RADIUS

.github/workflows/apply.yml

@@ -38,3 +38,4 @@ jobs:
           AWS_SECRET_ACCESS_KEY:    ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           AWS_REGION:               us-east-1
           MERAKI_DASHBOARD_API_KEY: ${{ secrets.MERAKI_DASHBOARD_API_KEY }}
+          TF_VAR_radius_secret:     ${{ secrets.RADIUS_SECRET }}

.github/workflows/plan.yml

@@ -40,6 +40,7 @@ jobs:
           AWS_SECRET_ACCESS_KEY:       ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           AWS_REGION:                  us-east-1
           MERAKI_DASHBOARD_API_KEY:    ${{ secrets.MERAKI_DASHBOARD_API_KEY }}
+          TF_VAR_radius_secret:        ${{ secrets.RADIUS_SECRET }}
 
       - name: Comentar Plan en el PR
         uses: actions/github-script@v7

modules/meraki-site/main.tf

@@ -43,7 +43,34 @@ resource "meraki_appliance_vlan" "mx_gateways" {
   dhcp_handling      = each.value.dhcp_handling
 }
 
-# 3. Reglas de firewall L3
+# 3. SSIDs wireless
+resource "meraki_wireless_ssid" "ssids" {
+  for_each   = { for s in var.wireless_ssids : tostring(s.number) => s }
+  depends_on = [meraki_appliance_vlans_settings.activate_vlans]
+
+  network_id          = local.network_id
+  number              = each.value.number
+  name                = each.value.name
+  enabled             = each.value.enabled
+  auth_mode           = each.value.auth_mode
+  splash_page         = each.value.splash_page
+  wpa_encryption_mode = each.value.wpa_encryption_mode
+  ip_assignment_mode  = each.value.ip_assignment_mode
+  use_vlan_tagging    = each.value.use_vlan_tagging
+  default_vlan_id     = each.value.default_vlan_id
+  splash_url          = each.value.redirect_url != "" ? each.value.redirect_url : null
+
+  dynamic "radius_servers" {
+    for_each = each.value.radius_servers
+    content {
+      host   = radius_servers.value.host
+      port   = radius_servers.value.port
+      secret = var.radius_secret
+    }
+  }
+}
+
+# 4. Reglas de firewall L3
 resource "meraki_appliance_l3_firewall_rules" "reglas_firewall" {
   network_id = local.network_id
   rules      = var.firewall_rules

modules/meraki-site/variables.tf

@@ -27,6 +27,36 @@ variable "firewall_rules" {
   description = "Reglas de firewall L3 para el site. Se aplican en orden, antes de la regla allow-all implícita de Meraki"
 }
 
+# SSIDs wireless
+variable "wireless_ssids" {
+  type = list(object({
+    number           = number
+    name             = string
+    enabled          = optional(bool, true)
+    auth_mode        = string
+    splash_page      = optional(string, "None")
+    wpa_encryption_mode = optional(string, "WPA3 only")
+    ip_assignment_mode  = optional(string, "Bridge mode")
+    use_vlan_tagging    = optional(bool, false)
+    default_vlan_id     = optional(number, null)
+    redirect_url        = optional(string, "")
+    radius_servers = optional(list(object({
+      host = string
+      port = number
+    })), [])
+  }))
+  default     = []
+  description = "Lista de SSIDs wireless a configurar en el site"
+}
+
+# Shared secret para servidores RADIUS (sensible, no incluir en tfvars)
+variable "radius_secret" {
+  type        = string
+  sensitive   = true
+  default     = ""
+  description = "Shared secret para autenticación RADIUS. Pasar via TF_VAR_radius_secret"
+}
+
 # Definición del mapa de VLANs
 variable "switch_vlans" {
   type = map(object({

sites/bcn01/main.tf

@@ -27,4 +27,6 @@ module "bcn01" {
   network_name      = var.network_name
   switch_vlans      = var.switch_vlans
   firewall_rules    = var.firewall_rules
+  wireless_ssids    = var.wireless_ssids
+  radius_secret     = var.radius_secret
 }

sites/bcn01/ssids.auto.tfvars

@@ -0,0 +1,24 @@
+# SSIDs wireless - BCN01
+# NOTA: El shared secret de RADIUS NO está aquí.
+# Se pasa como variable de entorno TF_VAR_radius_secret (GitHub secret: RADIUS_SECRET)
+
+wireless_ssids = [
+  {
+    number              = 0
+    name                = "EQT-CORPO"
+    enabled             = true
+    auth_mode           = "open-with-radius"
+    splash_page         = "Password-protected with custom RADIUS"
+    wpa_encryption_mode = "WPA3 only"
+    ip_assignment_mode  = "Bridge mode"
+    use_vlan_tagging    = true
+    default_vlan_id     = 100
+    redirect_url        = "https://www.adevinta.com"
+    radius_servers = [
+      {
+        host = "15.15.15.15"
+        port = 1912
+      }
+    ]
+  }
+]

sites/bcn01/variables.tf

@@ -27,6 +27,36 @@ variable "firewall_rules" {
   description = "Lista de reglas de firewall L3 para el site"
 }
 
+# SSIDs wireless
+variable "wireless_ssids" {
+  type = list(object({
+    number              = number
+    name                = string
+    enabled             = optional(bool, true)
+    auth_mode           = string
+    splash_page         = optional(string, "None")
+    wpa_encryption_mode = optional(string, "WPA3 only")
+    ip_assignment_mode  = optional(string, "Bridge mode")
+    use_vlan_tagging    = optional(bool, false)
+    default_vlan_id     = optional(number, null)
+    redirect_url        = optional(string, "")
+    radius_servers = optional(list(object({
+      host = string
+      port = number
+    })), [])
+  }))
+  default     = []
+  description = "Lista de SSIDs wireless a configurar en el site"
+}
+
+# Shared secret para servidores RADIUS (sensible, no incluir en tfvars)
+variable "radius_secret" {
+  type        = string
+  sensitive   = true
+  default     = ""
+  description = "Shared secret para autenticación RADIUS. Pasar via TF_VAR_radius_secret"
+}
+
 # Definición de VLANs
 variable "switch_vlans" {
   type = map(object({