# Configuración de switches MS - BCN01-LAB
# El shared secret de RADIUS se pasa via TF_VAR_radius_secret (GitHub secret: RADIUS_SECRET)

# --- POLÍTICAS DE ACCESO 802.1X ---
switch_access_policies = [
  {
    name                               = "DOT1X-CORPO"
    access_policy_type                 = "Hybrid authentication"
    host_mode                          = "Multi-Auth"
    radius_accounting_enabled          = false
    radius_re_authentication_interval  = 0
    url_redirect_walled_garden_enabled = false

    # VLAN a la que cae el puerto si el RADIUS no responde
    radius_failed_auth_vlan_id = 101 # GUEST

    radius_servers = [
      {
        host = "15.15.15.15"
        port = 1912
      }
    ]
  }
]

# --- PUERTOS DE SWITCH ---
# El serial aparece en Dashboard > Switches > nombre del switch > Overview.
# access_policy_number: número auto-asignado por Meraki a la política creada arriba
#   (visible en Dashboard > Switches > Switch settings > Access policies)
#
# Ejemplo con los tres tipos de puerto:
# switch_port_configs = [
#
#   # Puertos de acceso general con 802.1X (PCs, portátiles)
#   # Autenticación: 802.1X → MAB → VLAN GUEST si falla RADIUS
#   # La VLAN final la asigna Okta dinámicamente; vlan=100 es el fallback estático
#   {
#     serial               = "XXXX-XXXX-XXXX"
#     port_range           = "1-20"
#     type                 = "access"
#     vlan                 = 100  # ACCESS - fallback si Okta no devuelve VLAN
#     access_policy_type   = "Custom access policy"
#     access_policy_number = 1    # id de la política DOT1X-CORPO
#   },
#
#   # Puertos designados para impresoras (sin 802.1X)
#   # VLAN asignada estáticamente en el puerto - las Group Policies en switches no asignan VLAN
#   {
#     serial               = "XXXX-XXXX-XXXX"
#     port_range           = "21-24"
#     type                 = "access"
#     vlan                 = 103  # PRINTERS - VLAN fija en el puerto
#     access_policy_type   = "Open"
#   },
#
#   # Puertos designados para APs (sin 802.1X)
#   # Igual que impresoras: VLAN fija en el puerto
#   {
#     serial               = "XXXX-XXXX-XXXX"
#     port_range           = "25-27"
#     type                 = "access"
#     vlan                 = 108  # APs - VLAN fija en el puerto
#     access_policy_type   = "Open"
#   },
#
#   # Puerto de uplink (trunk, sin autenticación)
#   {
#     serial               = "XXXX-XXXX-XXXX"
#     port_range           = "28"
#     type                 = "trunk"
#     access_policy_type   = "Open"
#   },
#
# ]
switch_port_configs = []

# --- PUERTOS DE STACK ---
# Terraform resuelve automáticamente los seriales de todos los miembros del stack.
# El stack_name debe coincidir exactamente con el nombre en Dashboard > Switches > Stacks.
# Terraform aplicará el mismo port_range a CADA switch del stack (ambos de 48 puertos).
#
# Ejemplo para bnc01-lab-stack01 (2x 48 puertos):
# switch_stack_port_configs = [
#
#   # Puertos 1-44: acceso general con 802.1X (PCs, portátiles)
#   {
#     stack_name           = "bnc01-lab-stack01"
#     port_range           = "1-44"
#     type                 = "access"
#     vlan                 = 100  # ACCESS - fallback si Okta no devuelve VLAN
#     access_policy_type   = "Custom access policy"
#     access_policy_number = 1    # id de la política DOT1X-CORPO
#   },
#
#   # Puertos 45-46: impresoras (VLAN fija, sin 802.1X)
#   {
#     stack_name           = "bnc01-lab-stack01"
#     port_range           = "45-46"
#     type                 = "access"
#     vlan                 = 103  # PRINTERS
#     access_policy_type   = "Open"
#   },
#
#   # Puertos 47-48: APs (VLAN fija, sin 802.1X)
#   {
#     stack_name           = "bnc01-lab-stack01"
#     port_range           = "47-48"
#     type                 = "access"
#     vlan                 = 108  # APs
#     access_policy_type   = "Open"
#   },
#
# ]
switch_stack_port_configs = [
  {
    stack_name         = "bcn01-lab-stack01"
    port_range         = "6"
    type               = "access"
    vlan               = 101  # GUEST
    access_policy_type = "Open"
  },
  {
    # Puerto 47: uplink trunk en ambos miembros del stack
    # VLAN nativa 109 (MANAGEMENT), permite todas las VLANs
    stack_name         = "bcn01-lab-stack01"
    port_range         = "47"
    name               = "Uplink trunk"
    type               = "trunk"
    vlan               = 109  # MANAGEMENT - VLAN nativa (untagged)
    allowed_vlans      = "all"
    access_policy_type = "Open"
  },
]

# Puertos de un switch concreto (miembro individual del stack)
# El serial se encuentra en: Dashboard > Switches > eqt-lab-st01-sw01 > Overview
switch_named_port_configs = [
  {
    # Puerto 1 de eqt-lab-st01-sw01 → VLAN SERVERS (estática, sin autenticación)
    switch_name        = "eqt-lab-st01-sw01"
    port_range         = "1"
    name               = "Servers"
    type               = "access"
    vlan               = 110  # SERVERS
    access_policy_type = "Open"
  },
  {
    # Puerto 3 de eqt-lab-st01-sw01 → AP (trunk, nativa 108 APs, tageadas 100 ACCESS y 101 GUEST)
    switch_name        = "eqt-lab-st01-sw01"
    port_range         = "3"
    name               = "AP"
    type               = "trunk"
    vlan               = 108          # APs - VLAN nativa (untagged)
    allowed_vlans      = "100,101,108" # ACCESS + GUEST + APs
    access_policy_type = "Open"
  },
]

# VLAN de gestión de los switches del site
switch_management_vlan = 109

# Interfaces L3 en el stack para acceso de gestión al Dashboard de Meraki
stack_routing_interfaces = [
  {
    stack_name      = "bcn01-lab-stack01"
    name            = "MANAGEMENT"
    vlan_id         = 109
    ip_address      = "10.2.55.2"
    subnet          = "10.2.55.0/24"
    default_gateway = "10.2.55.1"
    dns1            = "8.8.8.8"
    dns2            = "8.8.4.4"
  },
]