# Client Wi-Fi Inventory

> **MANUALLY / SKILL MAINTAINED — `/wiki-compile` does NOT touch this file** (it only
> compiles `clients/`, `projects/`, and `systems/` slugs). Edit it directly as networks
> are discovered.
>
> **NO PASSWORDS IN THIS FILE.** Wi-Fi passwords are credentials — they live encrypted in
> the SOPS vault (`clients/<slug>/wifi.sops.yaml`). This page is the human-readable index
> of *which* client has *which* networks and *where*; the password column only names the
> vault path/field, never the value. See [[reference_client_wifi_inventory]].

Purpose: so any of us arriving onsite can connect to a client's Wi-Fi without asking for
the name/password again. We build this as we go — whenever someone is onsite or touching a
client network, capture the Wi-Fi and add it here + to the vault.

---

## Inventory

*None captured yet. Add a row per network as you discover them (newest client on top is fine).*

| Client | Network key | SSID | Band | Auth | Location / scope | Vault field | Notes |
|---|---|---|---|---|---|---|---|
| _example (delete)_ | `staff` | `Acme-Staff` | 5 | WPA2-PSK | All buildings | `clients/acme/wifi` → `credentials.staff_password` | 6GHz off; staff net only |

Columns:
- **Network key** — short slug (`staff`, `guest`, `voice`, `warehouse`) that links the
  wiki row to the vault fields (`<key>_ssid`, `<key>_password`).
- **Band** — `2.4`, `5`, `6`, or a combo like `2.4/5`.
- **Auth** — `WPA2-PSK`, `WPA3-SAE`, `WPA2/WPA3`, `open`, `enterprise` (802.1X — note it,
  those don't import as a simple PSK profile).
- **Vault field** — the exact path the (future) importer reads. `clients/<slug>/wifi` +
  `credentials.<key>_password` (and `credentials.<key>_ssid`).

---

## Capture a network (do this onsite)

When you're onsite or working a client's network, ask for the Wi-Fi and record it. What to ask:

> *"What's the Wi-Fi network name (SSID) and password? Is there a separate staff vs guest
> network? Which one should our machines use when we're onsite?"*

Then store it — **passwords go in the vault via the `vault` skill, never in chat/tickets/this file.**

**First network for a client** (creates the file):

```bash
bash .claude/skills/vault/scripts/vault-helper.sh new clients/<slug>/wifi \
  --kind note --name "<Client> Wi-Fi" --tag client --tag wifi \
  --set staff_ssid="Acme-Staff" --set staff_password="THE_PASSWORD" --set staff_auth="WPA2-PSK"
```

**Additional networks on an existing client** (guest, voice, warehouse, second site…):

```bash
bash .claude/skills/vault/scripts/vault-helper.sh set clients/<slug>/wifi \
  --set guest_ssid="Acme-Guest" --set guest_password="THE_PASSWORD"
```

Everything under `credentials:` is encrypted at rest (SSID + password both), so the entry is
self-contained for the importer. Verify + publish:

```bash
bash .claude/skills/vault/scripts/vault-helper.sh verify clients/<slug>/wifi
bash .claude/scripts/sync.sh            # or /sync — publishes the vault + wiki
```

**Then add a row to the Inventory table above** — SSID / band / location for human reference,
and the vault field. (SSID is duplicated here for readability; the **vault is authoritative**
for what the importer connects with.)

---

## Connect a machine to a client's Wi-Fi

**Automated importer — PLANNED, not built yet.** The intended end state is a `/wifi import
<client>` step that reads `clients/<slug>/wifi.sops.yaml`, generates a Windows WLAN profile
per network, and imports it so you auto-connect. Deferred until we have a few real networks
worth importing (decision 2026-07-06).

**Interim manual method (Windows)** — read the password from the vault, then import a profile:

```bash
# 1. Read (vault access required; never paste the value anywhere)
bash .claude/scripts/vault.sh get-field clients/<slug>/wifi credentials.staff_ssid
bash .claude/scripts/vault.sh get-field clients/<slug>/wifi credentials.staff_password
```

Then either type it into the Windows Wi-Fi picker, or script it with `netsh` (build a profile
XML with `<name>`/`<SSID>` and `<keyMaterial>` = the password, then
`netsh wlan add profile filename=profile.xml`). Delete the temp XML afterward — it holds the
plaintext key.

---

## Rules

- **Passwords/PSKs only in the vault.** Never in this file, a session log, a ticket, or chat.
- **Vault path convention:** `clients/<slug>/wifi.sops.yaml`, fields `credentials.<key>_ssid`
  / `credentials.<key>_password` / optional `credentials.<key>_auth`.
- **802.1X / enterprise (RADIUS) networks** don't import as a simple PSK — note the auth
  method and any account in the vault, but they need a full profile (cert/credential), not a
  passphrase.
- Keep the `<slug>` identical to the client's `wiki/clients/<slug>.md` slug so this all lines up.