locals {
  wireless_ssids = [
    {
      number              = 0
      name                = "EQT-CORPO"
      enabled             = true
      auth_mode           = "open-enhanced"  # OWE (Opportunistic Wireless Encryption)
      wpa_encryption_mode = "WPA3 only"
      splash_page         = "Password-protected with custom RADIUS"
      ip_assignment_mode  = "Bridge mode"
      use_vlan_tagging    = true
      default_vlan_id     = 100
      redirect_url        = "https://www.adevinta.com"
      radius_servers = [
        { host = "15.15.15.15", port = 1912 }
      ]
    },
    {
      number             = 2
      name               = "EQT-CORPO-OWE-OK"
      enabled            = true
      visible            = false  # Hidden SSID — no broadcast
      auth_mode          = "open"
      splash_page        = "Password-protected with custom RADIUS"
      ip_assignment_mode = "Bridge mode"
      use_vlan_tagging   = true
      default_vlan_id    = 100
      redirect_url       = "https://www.adevinta.com"
      radius_servers = [
        { host = "15.15.15.15", port = 1912 }
      ]
    },
    {
      number              = 1
      name                = "EQT-GUEST"
      enabled             = true
      auth_mode           = "psk"
      encryption_mode     = "wpa"
      wpa_encryption_mode = "WPA3 Transition Mode"
      # Password injected via TF_VAR_wifi_password_psk (GitHub Secret: WIFI_PASSWORD_PSK)
      ip_assignment_mode  = "Bridge mode"
      use_vlan_tagging    = true
      default_vlan_id     = 101
    },
  ]
}