From bd247191e6db30fb2599eeb1eb8d32cb84dff272 Mon Sep 17 00:00:00 2001 From: Howard Enos Date: Mon, 6 Jul 2026 13:43:38 -0700 Subject: [PATCH] sync: auto-sync from HOWARD-HOME at 2026-07-06 13:43:09 Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-06 13:43:09 --- .claude/memory/MEMORY.md | 1 + .../memory/reference_client_wifi_inventory.md | 32 ++++++ .ocu.err | 0 .ocu.json | 0 wiki/index.md | 9 ++ wiki/reference/client-wifi.md | 105 ++++++++++++++++++ 6 files changed, 147 insertions(+) create mode 100644 .claude/memory/reference_client_wifi_inventory.md create mode 100644 .ocu.err create mode 100644 .ocu.json create mode 100644 wiki/reference/client-wifi.md diff --git a/.claude/memory/MEMORY.md b/.claude/memory/MEMORY.md index eac29255..28f82801 100644 --- a/.claude/memory/MEMORY.md +++ b/.claude/memory/MEMORY.md @@ -28,6 +28,7 @@ - [Matomo Analytics](reference_matomo_analytics.md) — Self-hosted analytics at analytics.azcomputerguru.com, site IDs, tracking for all 3 sites. - [TickTick Integration](reference_ticktick_integration.md) — OAuth API integration, MCP server, SOPS vault creds, project/task CRUD. - [Client Docs Structure](reference_client_docs_structure.md) — clients//docs/ layout (overview, network, servers, cloud, security, rmm). Template: clients/_client_template/. +- [Client Wi-Fi Inventory](reference_client_wifi_inventory.md) — Building a fleet Wi-Fi list to connect onsite without asking. Passwords → vault `clients//wifi.sops.yaml` (`credentials._ssid/_password`); readable index → `wiki/reference/client-wifi.md`. `/wifi` importer deferred (structure-only 2026-07-06). - [MSP Audit Scripts](reference_msp_audit_scripts.md) — server_audit.ps1 / workstation_audit.ps1 at projects/msp-tools/msp-audit-scripts/. - [Pluto Build Server](reference_pluto_build_server.md) — Windows build VM: hostname PLUTO = Unraid VM "Claude-Builder" = 172.16.3.36 (all the same box). MSVC + WiX + Azure Trusted Signing. Drive via /rmm (agent enrolls as PLUTO) when SSH key isn't authorized. - [Coord /messages API shape](reference_coord_messages_api_shape.md) — GET /api/coord/messages returns {total,skip,limit,messages[]} NOT a bare array; parse .messages[], strip control chars, read flag may be null. diff --git a/.claude/memory/reference_client_wifi_inventory.md b/.claude/memory/reference_client_wifi_inventory.md new file mode 100644 index 00000000..dcc6b74f --- /dev/null +++ b/.claude/memory/reference_client_wifi_inventory.md @@ -0,0 +1,32 @@ +--- +name: reference_client_wifi_inventory +description: Where client Wi-Fi networks are recorded so techs connect onsite without asking — vault holds passwords, wiki holds the readable index. +metadata: + type: reference +--- + +We are building a fleet-wide client Wi-Fi list so anyone onsite can connect without asking +for the SSID/password again. Established 2026-07-06 (Howard). + +**Split (security-driven):** +- **Passwords/PSKs → SOPS vault**, `clients//wifi.sops.yaml`, one file per client. + Per network use `credentials._ssid`, `credentials._password`, optional + `credentials._auth` (`` = `staff`/`guest`/`voice`/`warehouse`...). Everything under + `credentials:` is encrypted at rest, so the entry is self-contained for an importer. Write it + with the `vault` skill's `vault-helper.sh new`/`set` (NEVER paste a Wi-Fi password into chat, + a ticket, a session log, or the wiki). +- **Readable index → wiki**, `wiki/reference/client-wifi.md` (registered in `wiki/index.md` + under a new **Reference** section). Client / SSID / band / location / vault-field — NO passwords. + It lives under `wiki/reference/` so `/wiki-compile` never clobbers it (compile only touches + clients/projects/systems slugs). + +**Capture flow onsite:** ask "Wi-Fi name + password? staff vs guest? which should our machines +use?" → store in vault via vault-helper → add a row to the wiki inventory → `/sync`. + +**Importer is DEFERRED** (Howard chose "structure only for now" 2026-07-06). Planned end state: +a `/wifi import ` that reads the vault file, builds a Windows WLAN profile per network +(`netsh wlan add profile`), and auto-connects. Interim: read the password with +`vault.sh get-field clients//wifi credentials._password` and connect manually. +Build the importer/`/wifi` skill once a few real networks exist. + +Keep `` identical to the client's `wiki/clients/.md` slug so vault + wiki + article line up. diff --git a/.ocu.err b/.ocu.err new file mode 100644 index 00000000..e69de29b diff --git a/.ocu.json b/.ocu.json new file mode 100644 index 00000000..e69de29b diff --git a/wiki/index.md b/wiki/index.md index 581844b8..54979ee4 100644 --- a/wiki/index.md +++ b/wiki/index.md @@ -2,6 +2,7 @@ Last updated: 2026-07-06 Compiled by: HOWARD-HOME/claude-main +(2026-07-06: added Reference section — client Wi-Fi inventory.) This wiki is LLM-maintained. Do not edit articles manually — run `/wiki-compile` to update. Run `/wiki-lint` to check for stale entries and broken backlinks. @@ -99,6 +100,14 @@ Run `/wiki-lint` to check for stale entries and broken backlinks. |---|---|---| | [Tailscale client management](patterns/tailscale-client-management.md) | One tailnet per client (never merge into yours); you hold Admin; enroll devices as tagged nodes via pre-auth keys pushed from GuruRMM ([enroll script](patterns/tailscale-client-enroll.ps1)). Windows subnet-routing reality + "see each other" ACL. | 2026-06-06 | +## Reference + +*Manually / skill maintained — NOT produced by `/wiki-compile`.* + +| Article | Summary | Maintained | +|---|---|---| +| [Client Wi-Fi Inventory](reference/client-wifi.md) | Human-readable index of client Wi-Fi networks (SSID/band/location) so we connect onsite without asking. **Passwords are NOT here** — encrypted in vault `clients//wifi.sops.yaml`. Build as discovered. Automated `/wifi` importer planned. | 2026-07-06 | + --- ## Cross-Reference diff --git a/wiki/reference/client-wifi.md b/wiki/reference/client-wifi.md new file mode 100644 index 00000000..435aac5f --- /dev/null +++ b/wiki/reference/client-wifi.md @@ -0,0 +1,105 @@ +# Client Wi-Fi Inventory + +> **MANUALLY / SKILL MAINTAINED — `/wiki-compile` does NOT touch this file** (it only +> compiles `clients/`, `projects/`, and `systems/` slugs). Edit it directly as networks +> are discovered. +> +> **NO PASSWORDS IN THIS FILE.** Wi-Fi passwords are credentials — they live encrypted in +> the SOPS vault (`clients//wifi.sops.yaml`). This page is the human-readable index +> of *which* client has *which* networks and *where*; the password column only names the +> vault path/field, never the value. See [[reference_client_wifi_inventory]]. + +Purpose: so any of us arriving onsite can connect to a client's Wi-Fi without asking for +the name/password again. We build this as we go — whenever someone is onsite or touching a +client network, capture the Wi-Fi and add it here + to the vault. + +--- + +## Inventory + +*None captured yet. Add a row per network as you discover them (newest client on top is fine).* + +| Client | Network key | SSID | Band | Auth | Location / scope | Vault field | Notes | +|---|---|---|---|---|---|---|---| +| _example (delete)_ | `staff` | `Acme-Staff` | 5 | WPA2-PSK | All buildings | `clients/acme/wifi` → `credentials.staff_password` | 6GHz off; staff net only | + +Columns: +- **Network key** — short slug (`staff`, `guest`, `voice`, `warehouse`) that links the + wiki row to the vault fields (`_ssid`, `_password`). +- **Band** — `2.4`, `5`, `6`, or a combo like `2.4/5`. +- **Auth** — `WPA2-PSK`, `WPA3-SAE`, `WPA2/WPA3`, `open`, `enterprise` (802.1X — note it, + those don't import as a simple PSK profile). +- **Vault field** — the exact path the (future) importer reads. `clients//wifi` + + `credentials._password` (and `credentials._ssid`). + +--- + +## Capture a network (do this onsite) + +When you're onsite or working a client's network, ask for the Wi-Fi and record it. What to ask: + +> *"What's the Wi-Fi network name (SSID) and password? Is there a separate staff vs guest +> network? Which one should our machines use when we're onsite?"* + +Then store it — **passwords go in the vault via the `vault` skill, never in chat/tickets/this file.** + +**First network for a client** (creates the file): + +```bash +bash .claude/skills/vault/scripts/vault-helper.sh new clients//wifi \ + --kind note --name " Wi-Fi" --tag client --tag wifi \ + --set staff_ssid="Acme-Staff" --set staff_password="THE_PASSWORD" --set staff_auth="WPA2-PSK" +``` + +**Additional networks on an existing client** (guest, voice, warehouse, second site…): + +```bash +bash .claude/skills/vault/scripts/vault-helper.sh set clients//wifi \ + --set guest_ssid="Acme-Guest" --set guest_password="THE_PASSWORD" +``` + +Everything under `credentials:` is encrypted at rest (SSID + password both), so the entry is +self-contained for the importer. Verify + publish: + +```bash +bash .claude/skills/vault/scripts/vault-helper.sh verify clients//wifi +bash .claude/scripts/sync.sh # or /sync — publishes the vault + wiki +``` + +**Then add a row to the Inventory table above** — SSID / band / location for human reference, +and the vault field. (SSID is duplicated here for readability; the **vault is authoritative** +for what the importer connects with.) + +--- + +## Connect a machine to a client's Wi-Fi + +**Automated importer — PLANNED, not built yet.** The intended end state is a `/wifi import +` step that reads `clients//wifi.sops.yaml`, generates a Windows WLAN profile +per network, and imports it so you auto-connect. Deferred until we have a few real networks +worth importing (decision 2026-07-06). + +**Interim manual method (Windows)** — read the password from the vault, then import a profile: + +```bash +# 1. Read (vault access required; never paste the value anywhere) +bash .claude/scripts/vault.sh get-field clients//wifi credentials.staff_ssid +bash .claude/scripts/vault.sh get-field clients//wifi credentials.staff_password +``` + +Then either type it into the Windows Wi-Fi picker, or script it with `netsh` (build a profile +XML with ``/`` and `` = the password, then +`netsh wlan add profile filename=profile.xml`). Delete the temp XML afterward — it holds the +plaintext key. + +--- + +## Rules + +- **Passwords/PSKs only in the vault.** Never in this file, a session log, a ticket, or chat. +- **Vault path convention:** `clients//wifi.sops.yaml`, fields `credentials._ssid` + / `credentials._password` / optional `credentials._auth`. +- **802.1X / enterprise (RADIUS) networks** don't import as a simple PSK — note the auth + method and any account in the vault, but they need a full profile (cert/credential), not a + passphrase. +- Keep the `` identical to the client's `wiki/clients/.md` slug so this all lines up.