106 lines
4.7 KiB
Markdown
106 lines
4.7 KiB
Markdown
# Client Wi-Fi Inventory
|
|
|
|
> **MANUALLY / SKILL MAINTAINED — `/wiki-compile` does NOT touch this file** (it only
|
|
> compiles `clients/`, `projects/`, and `systems/` slugs). Edit it directly as networks
|
|
> are discovered.
|
|
>
|
|
> **NO PASSWORDS IN THIS FILE.** Wi-Fi passwords are credentials — they live encrypted in
|
|
> the SOPS vault (`clients/<slug>/wifi.sops.yaml`). This page is the human-readable index
|
|
> of *which* client has *which* networks and *where*; the password column only names the
|
|
> vault path/field, never the value. See [[reference_client_wifi_inventory]].
|
|
|
|
Purpose: so any of us arriving onsite can connect to a client's Wi-Fi without asking for
|
|
the name/password again. We build this as we go — whenever someone is onsite or touching a
|
|
client network, capture the Wi-Fi and add it here + to the vault.
|
|
|
|
---
|
|
|
|
## Inventory
|
|
|
|
*None captured yet. Add a row per network as you discover them (newest client on top is fine).*
|
|
|
|
| Client | Network key | SSID | Band | Auth | Location / scope | Vault field | Notes |
|
|
|---|---|---|---|---|---|---|---|
|
|
| _example (delete)_ | `staff` | `Acme-Staff` | 5 | WPA2-PSK | All buildings | `clients/acme/wifi` → `credentials.staff_password` | 6GHz off; staff net only |
|
|
|
|
Columns:
|
|
- **Network key** — short slug (`staff`, `guest`, `voice`, `warehouse`) that links the
|
|
wiki row to the vault fields (`<key>_ssid`, `<key>_password`).
|
|
- **Band** — `2.4`, `5`, `6`, or a combo like `2.4/5`.
|
|
- **Auth** — `WPA2-PSK`, `WPA3-SAE`, `WPA2/WPA3`, `open`, `enterprise` (802.1X — note it,
|
|
those don't import as a simple PSK profile).
|
|
- **Vault field** — the exact path the (future) importer reads. `clients/<slug>/wifi` +
|
|
`credentials.<key>_password` (and `credentials.<key>_ssid`).
|
|
|
|
---
|
|
|
|
## Capture a network (do this onsite)
|
|
|
|
When you're onsite or working a client's network, ask for the Wi-Fi and record it. What to ask:
|
|
|
|
> *"What's the Wi-Fi network name (SSID) and password? Is there a separate staff vs guest
|
|
> network? Which one should our machines use when we're onsite?"*
|
|
|
|
Then store it — **passwords go in the vault via the `vault` skill, never in chat/tickets/this file.**
|
|
|
|
**First network for a client** (creates the file):
|
|
|
|
```bash
|
|
bash .claude/skills/vault/scripts/vault-helper.sh new clients/<slug>/wifi \
|
|
--kind note --name "<Client> Wi-Fi" --tag client --tag wifi \
|
|
--set staff_ssid="Acme-Staff" --set staff_password="THE_PASSWORD" --set staff_auth="WPA2-PSK"
|
|
```
|
|
|
|
**Additional networks on an existing client** (guest, voice, warehouse, second site…):
|
|
|
|
```bash
|
|
bash .claude/skills/vault/scripts/vault-helper.sh set clients/<slug>/wifi \
|
|
--set guest_ssid="Acme-Guest" --set guest_password="THE_PASSWORD"
|
|
```
|
|
|
|
Everything under `credentials:` is encrypted at rest (SSID + password both), so the entry is
|
|
self-contained for the importer. Verify + publish:
|
|
|
|
```bash
|
|
bash .claude/skills/vault/scripts/vault-helper.sh verify clients/<slug>/wifi
|
|
bash .claude/scripts/sync.sh # or /sync — publishes the vault + wiki
|
|
```
|
|
|
|
**Then add a row to the Inventory table above** — SSID / band / location for human reference,
|
|
and the vault field. (SSID is duplicated here for readability; the **vault is authoritative**
|
|
for what the importer connects with.)
|
|
|
|
---
|
|
|
|
## Connect a machine to a client's Wi-Fi
|
|
|
|
**Automated importer — PLANNED, not built yet.** The intended end state is a `/wifi import
|
|
<client>` step that reads `clients/<slug>/wifi.sops.yaml`, generates a Windows WLAN profile
|
|
per network, and imports it so you auto-connect. Deferred until we have a few real networks
|
|
worth importing (decision 2026-07-06).
|
|
|
|
**Interim manual method (Windows)** — read the password from the vault, then import a profile:
|
|
|
|
```bash
|
|
# 1. Read (vault access required; never paste the value anywhere)
|
|
bash .claude/scripts/vault.sh get-field clients/<slug>/wifi credentials.staff_ssid
|
|
bash .claude/scripts/vault.sh get-field clients/<slug>/wifi credentials.staff_password
|
|
```
|
|
|
|
Then either type it into the Windows Wi-Fi picker, or script it with `netsh` (build a profile
|
|
XML with `<name>`/`<SSID>` and `<keyMaterial>` = the password, then
|
|
`netsh wlan add profile filename=profile.xml`). Delete the temp XML afterward — it holds the
|
|
plaintext key.
|
|
|
|
---
|
|
|
|
## Rules
|
|
|
|
- **Passwords/PSKs only in the vault.** Never in this file, a session log, a ticket, or chat.
|
|
- **Vault path convention:** `clients/<slug>/wifi.sops.yaml`, fields `credentials.<key>_ssid`
|
|
/ `credentials.<key>_password` / optional `credentials.<key>_auth`.
|
|
- **802.1X / enterprise (RADIUS) networks** don't import as a simple PSK — note the auth
|
|
method and any account in the vault, but they need a full profile (cert/credential), not a
|
|
passphrase.
|
|
- Keep the `<slug>` identical to the client's `wiki/clients/<slug>.md` slug so this all lines up.
|