claudetools/wiki/reference/client-wifi.md

Client Wi-Fi Inventory

MANUALLY / SKILL MAINTAINED — /wiki-compile does NOT touch this file (it only compiles clients/, projects/, and systems/ slugs). Edit it directly as networks are discovered.

NO PASSWORDS IN THIS FILE. Wi-Fi passwords are credentials — they live encrypted in the SOPS vault (clients/<slug>/wifi.sops.yaml). This page is the human-readable index of which client has which networks and where; the password column only names the vault path/field, never the value. See reference_client_wifi_inventory.

Purpose: so any of us arriving onsite can connect to a client's Wi-Fi without asking for the name/password again. We build this as we go — whenever someone is onsite or touching a client network, capture the Wi-Fi and add it here + to the vault.

---

Inventory

None captured yet. Add a row per network as you discover them (newest client on top is fine).

Client	Network key	SSID	Band	Auth	Location / scope	Vault field	Notes
example (delete)	staff	Acme-Staff	5	WPA2-PSK	All buildings	clients/acme/wifi → credentials.staff_password	6GHz off; staff net only

Columns:

• Network key — short slug (staff, guest, voice, warehouse) that links the wiki row to the vault fields (<key>_ssid, <key>_password).
• Band — 2.4, 5, 6, or a combo like 2.4/5.
• Auth — WPA2-PSK, WPA3-SAE, WPA2/WPA3, open, enterprise (802.1X — note it, those don't import as a simple PSK profile).
• Vault field — the exact path the (future) importer reads. clients/<slug>/wifi + credentials.<key>_password (and credentials.<key>_ssid).

---

Capture a network (do this onsite)

When you're onsite or working a client's network, ask for the Wi-Fi and record it. What to ask:

"What's the Wi-Fi network name (SSID) and password? Is there a separate staff vs guest network? Which one should our machines use when we're onsite?"

Then store it — passwords go in the vault via the vault skill, never in chat/tickets/this file.

First network for a client (creates the file):

bash .claude/skills/vault/scripts/vault-helper.sh new clients/<slug>/wifi \
  --kind note --name "<Client> Wi-Fi" --tag client --tag wifi \
  --set staff_ssid="Acme-Staff" --set staff_password="THE_PASSWORD" --set staff_auth="WPA2-PSK"

Additional networks on an existing client (guest, voice, warehouse, second site…):

bash .claude/skills/vault/scripts/vault-helper.sh set clients/<slug>/wifi \
  --set guest_ssid="Acme-Guest" --set guest_password="THE_PASSWORD"

Everything under credentials: is encrypted at rest (SSID + password both), so the entry is self-contained for the importer. Verify + publish:

bash .claude/skills/vault/scripts/vault-helper.sh verify clients/<slug>/wifi
bash .claude/scripts/sync.sh            # or /sync — publishes the vault + wiki

Then add a row to the Inventory table above — SSID / band / location for human reference, and the vault field. (SSID is duplicated here for readability; the vault is authoritative for what the importer connects with.)

---

Connect a machine to a client's Wi-Fi

Automated importer — PLANNED, not built yet. The intended end state is a /wifi import <client> step that reads clients/<slug>/wifi.sops.yaml, generates a Windows WLAN profile per network, and imports it so you auto-connect. Deferred until we have a few real networks worth importing (decision 2026-07-06).

Interim manual method (Windows) — read the password from the vault, then import a profile:

# 1. Read (vault access required; never paste the value anywhere)
bash .claude/scripts/vault.sh get-field clients/<slug>/wifi credentials.staff_ssid
bash .claude/scripts/vault.sh get-field clients/<slug>/wifi credentials.staff_password

Then either type it into the Windows Wi-Fi picker, or script it with netsh (build a profile XML with <name>/<SSID> and <keyMaterial> = the password, then netsh wlan add profile filename=profile.xml). Delete the temp XML afterward — it holds the plaintext key.

---

Rules

• Passwords/PSKs only in the vault. Never in this file, a session log, a ticket, or chat.
• Vault path convention: clients/<slug>/wifi.sops.yaml, fields credentials.<key>_ssid / credentials.<key>_password / optional credentials.<key>_auth.
• 802.1X / enterprise (RADIUS) networks don't import as a simple PSK — note the auth method and any account in the vault, but they need a full profile (cert/credential), not a passphrase.
• Keep the <slug> identical to the client's wiki/clients/<slug>.md slug so this all lines up.