From e6668edd37cc23a7b7abac805ef4768277df598f Mon Sep 17 00:00:00 2001
From: Jose Martinez <jose.martinez@armenteros.org>
Date: Fri, 27 Mar 2026 11:53:02 +0100
Subject: [PATCH] feat: add visible field to SSID module + hide
 EQT-CORPO-OWE-OK

---
 modules/meraki-site/main.tf       | 1 +
 modules/meraki-site/variables.tf  | 1 +
 sites/BCN01-LAB/ssids.auto.tfvars | 1 +
 3 files changed, 3 insertions(+)

diff --git a/modules/meraki-site/main.tf b/modules/meraki-site/main.tf
index 4379bdd..b3c498a 100755
--- a/modules/meraki-site/main.tf
+++ b/modules/meraki-site/main.tf
@@ -159,6 +159,7 @@ resource "meraki_wireless_ssid" "ssids" {
   number              = each.value.number
   name                = each.value.name
   enabled             = each.value.enabled
+  visible             = each.value.visible
   auth_mode           = each.value.auth_mode
   # PSK solo se envía para SSIDs con auth_mode "psk"; para open/open-enhanced se deja null
   psk                 = each.value.auth_mode == "psk" ? (each.value.psk != null ? each.value.psk : var.wifi_password_psk) : null
diff --git a/modules/meraki-site/variables.tf b/modules/meraki-site/variables.tf
index 76b43d9..8686059 100755
--- a/modules/meraki-site/variables.tf
+++ b/modules/meraki-site/variables.tf
@@ -33,6 +33,7 @@ variable "wireless_ssids" {
     number              = number
     name                = string
     enabled             = optional(bool, true)
+    visible             = optional(bool, true)   # false = SSID oculto (no broadcast)
     auth_mode           = string
     psk                 = optional(string, null)   # Contraseña WPA2/WPA3-PSK (sensible, usar TF_VAR o secret)
     encryption_mode     = optional(string, null)   # "wpa" para PSK; null para open/OWE
diff --git a/sites/BCN01-LAB/ssids.auto.tfvars b/sites/BCN01-LAB/ssids.auto.tfvars
index bacef8c..33a5788 100644
--- a/sites/BCN01-LAB/ssids.auto.tfvars
+++ b/sites/BCN01-LAB/ssids.auto.tfvars
@@ -27,6 +27,7 @@ wireless_ssids = [
     number             = 2
     name               = "EQT-CORPO-OWE-OK"
     enabled            = true
+    visible            = false   # SSID oculto — no hace broadcast del nombre
     auth_mode          = "open"
     splash_page        = "Password-protected with custom RADIUS"
     ip_assignment_mode = "Bridge mode"