feat(radius): log WLAN app password renewals

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
feat(radius): WLAN app passwords expire 60 days after last use
2026-11-05 13:16:27 +01:00 · 2026-11-05 13:11:12 +01:00 · 2026-11-05 13:05:27 +01:00 · 2026-11-05 13:02:10 +01:00 · 2026-11-05 12:52:09 +01:00 · 2026-11-05 10:37:22 +00:00
35 changed files with 1373 additions and 148 deletions
@@ -35,25 +35,25 @@ when:
 steps:
  - name: model-selection-tests
    depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.316
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.318
    commands:
      - sh scripts/ci/test-model-selection.sh

  - name: pr-review-mistral-tests
    depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.316
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.318
    commands:
      - sh scripts/ci/test-pr-review-mistral.sh

  - name: promtool-rules-guard-tests
    depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.316
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.318
    commands:
      - sh scripts/ci/test-promtool-rules.sh

  - name: yaml-citations-guard-tests
    depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.316
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.318
    commands:
      - sh scripts/ci/test-yaml-citations.sh

@@ -26,7 +26,7 @@ steps:
    # fetch-models.sh response mapping. No cluster, no secrets, no network — the
    # ci-claude image just provides sh + jq. Keeps the flag-injection regression
    # test from rotting (it exercises the exact injection shapes).
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.316
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.318
    commands:
      - sh scripts/ci/test-model-selection.sh

@@ -70,7 +70,7 @@ steps:
    # this step is skipped — otherwise we'd fork-bomb PRs.
    when:
      - branch: main
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.316
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.318
    environment:
      CLAUDE_CODE_OAUTH_TOKEN:
        from_secret: claude_code_oauth_token
@@ -30,7 +30,7 @@ when:

 steps:
  - name: update-audit-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.316
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.318
    environment:
      CLAUDE_CODE_OAUTH_TOKEN:
        from_secret: claude_code_oauth_token
@@ -134,11 +134,13 @@ Afterwards:

 ## Day-2 notes

- Image bumps: edit `edge_zwavejs_image` / `edge_sml2mqtt_image` in
-  defaults and re-run the play (no flux image-automation out here —
-  deliberate for sml2mqtt, acceptable for zwave-js). If a zwave-js bump
-  changes its Alpine major, also update `edge_zwave_alpine_base` and refresh
-  the preloaded `.so` (see "Logging & eMMC" → zwave-js).
+- Image bumps: Renovate opens a PR for `edge_*_image` in
+  `roles/*/defaults/main.yml` (tag + digest, `customManagers` in
+  `renovate.json`). No pipeline deploys to edge-1, so after the merge run
+  `ansible-playbook plays/install-zwave-gateway.yml` from `ansible/` on a
+  mesh-connected workstation. The play reads the image's Alpine release
+  itself and rebuilds the preloaded `.so` when it changes (see
+  "Logging & eMMC" → zwave-js).
 - open3e / E3onCAN updates: both are pinned to commits in
  `roles/heating-can/defaults/main.yml`, so re-running the play does NOT pick
  up upstream changes -- that is deliberate, these drive the heat pump. The
@@ -190,7 +192,7 @@ journal commit).

 - **Fix:** the `zwave-js` container preloads **`libeatmydata`**
  (`LD_PRELOAD=/usr/lib/libeatmydata.so`, mounted read-only from
-  `zwave-js/libeatmydata.so`). This makes `fsync`/`fdatasync` no-ops *for that
+  `zwave-js/libeatmydata-alpine<X.Y>.so`). This makes `fsync`/`fdatasync` no-ops *for that
  one process*, so the kernel batches the writes via normal writeback (~30 s)
  instead of forcing each one. The WS/MQTT value stream to Home Assistant and
  the on-disk cache are **unchanged** — full data resolution, no re-interview
@@ -199,9 +201,9 @@ journal commit).
  batch it); the only mount-level alternative is putting the cache on tmpfs,
  which makes the *whole* store volatile → re-interview on every restart.
 - **The `.so` is musl** (the image is Alpine-based), extracted from
-  `edge_zwave_alpine_base` — keep that var in sync with the image's Alpine
-  version; to refresh after a major bump, `rm zwave-js/libeatmydata.so` and
-  re-run.
+  `alpine:<X.Y>`, where `X.Y` is read from the image's `/etc/alpine-release`
+  on every run. A new Alpine release gives a new file name, so the play
+  extracts it, recreates the container and deletes the old file.
 - **Durability guard:** because `fsync` is neutralized, a hard power-loss
  during the (rare) settings write could truncate `settings.json`, which holds
  the **Z-Wave network keys**. `edge-zwave-settings-backup.timer` keeps a
@@ -13,12 +13,8 @@ zwave_base_dir: "{{ edge_base_dir }}/zwave-js"
 # survives moving the stick between machines.
 edge_zwave_device: /dev/serial/by-id/usb-Nabu_Casa_ZWA-2_80B54EE15720-if00

-edge_zwavejs_image: ghcr.io/zwave-js/zwave-js-ui:11.21.1
-
-# Alpine version the zwave-js-ui image is built on -- the source for the musl
-# libeatmydata.so preloaded into that container. Keep in sync if the image
-# bumps its Alpine major (check: docker exec zwave-js cat /etc/os-release).
-edge_zwave_alpine_base: alpine:3.22
+# Renovate-tracked (customManagers in renovate.json).
+edge_zwavejs_image: ghcr.io/zwave-js/zwave-js-ui:11.25.2@sha256:ac4874a3cbea61c0c60002a8fd8ae05104cc8eb2eae91aa05bd184972aa06853

 # Secret from inventory/group_vars/edge_host/vault.yml:
 #   edge_zwavejs_session_secret
@@ -15,17 +15,31 @@
    - "{{ zwave_base_dir }}"
    - "{{ zwave_base_dir }}/store"

+# The preloaded .so is musl and must come from the image's own Alpine release.
+- name: Read the Alpine release of the zwave-js-ui image
+  ansible.builtin.command:
+    cmd: docker run --rm --entrypoint cat {{ edge_zwavejs_image }} /etc/alpine-release
+  register: zwave_alpine_release
+  changed_when: false
+  check_mode: false
+
+- name: Name libeatmydata.so after that Alpine release
+  ansible.builtin.set_fact:
+    zwave_alpine_minor: "{{ zwave_alpine_release.stdout.split('.')[:2] | join('.') }}"
+    zwave_libeatmydata: "libeatmydata-alpine{{ zwave_alpine_release.stdout.split('.')[:2] | join('.') }}.so"
+
 - name: Extract musl libeatmydata.so (matches the zwave-js-ui Alpine base)
  ansible.builtin.shell:
    cmd: |
      set -euo pipefail
      tmp="$(mktemp)"
      trap 'rm -f "$tmp"' EXIT
-      docker run --rm --network=host {{ edge_zwave_alpine_base }} \
+      docker run --rm --network=host alpine:{{ zwave_alpine_minor }} \
        sh -c 'apk add --no-cache libeatmydata >/dev/null 2>&1 && cat /usr/lib/libeatmydata.so' > "$tmp"
      test "$(stat -c%s "$tmp")" -ge 8000   # sanity: real .so is ~14 KB, guards against a failed/empty pull
-      install -m 0644 "$tmp" {{ zwave_base_dir }}/libeatmydata.so
-    creates: "{{ zwave_base_dir }}/libeatmydata.so"
+      install -m 0644 "$tmp" {{ zwave_base_dir }}/{{ zwave_libeatmydata }}
+    creates: "{{ zwave_base_dir }}/{{ zwave_libeatmydata }}"
+    executable: /bin/bash
  notify: Restart zwave-js

 # Because fsync is neutralized, a hard power-loss during the (rare) settings
@@ -93,3 +107,18 @@
      zwave-js could not start -- the ZWA-2 radio is not present:
      {{ zwave_compose_up.stderr_lines | select('search', 'device') | list }}
  when: zwave_compose_up.rc != 0
+
+- name: Find libeatmydata.so builds of other Alpine releases
+  ansible.builtin.find:
+    paths: "{{ zwave_base_dir }}"
+    patterns: "libeatmydata*.so"
+    excludes: "{{ zwave_libeatmydata }}"
+  register: zwave_stale_libeatmydata
+
+- name: Remove libeatmydata.so builds of other Alpine releases
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: absent
+  loop: "{{ zwave_stale_libeatmydata.files }}"
+  loop_control:
+    label: "{{ item.path }}"
@@ -31,7 +31,7 @@ services:
      - "{{ edge_zwave_device }}:/dev/zwave"
    volumes:
      # musl libeatmydata.so extracted from the image's Alpine base (ro)
-      - ./libeatmydata.so:/usr/lib/libeatmydata.so:ro
+      - ./{{ zwave_libeatmydata }}:/usr/lib/libeatmydata.so:ro
      # Persistent store: settings.json, device DB, network keys. Path is
      # unchanged from the previous shared project, so nothing is migrated.
      - ./store:/usr/src/app/store
@@ -1,4 +1,4 @@
-FROM node:24-alpine@sha256:8a32c8cf649a49915a66e81e7a609223c708d0adabf288ee3f4077d765542f85
+FROM node:26-alpine@sha256:c6ad9e9c1d80f6eb607c26b4b0a132ff7a2344fad1c78ea3baa2a7d4c8de6d94

 # Default to the latest Claude Code. Pinning a fixed version is the wrong
 # default here: old releases eventually stop working against the API, so a
@@ -1,58 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-	<key>PayloadContent</key>
-	<array>
-		<dict>
-			<key>PayloadType</key>
-			<string>com.apple.wifi.managed</string>
-			<key>PayloadVersion</key>
-			<integer>1</integer>
-			<key>PayloadIdentifier</key>
-			<string>uno.renner.wifi.renner-test.network</string>
-			<key>PayloadUUID</key>
-			<string>c7814579-fc2b-4f38-bcc8-77e1123ab710</string>
-			<key>PayloadDisplayName</key>
-			<string>Renner Test Wi-Fi</string>
-			<key>PayloadOrganization</key>
-			<string>Renner</string>
-			<key>SSID_STR</key>
-			<string>Renner Test</string>
-			<key>HIDDEN_NETWORK</key>
-			<false/>
-			<key>AutoJoin</key>
-			<true/>
-			<key>EncryptionType</key>
-			<string>Any</string>
-			<key>EAPClientConfiguration</key>
-			<dict>
-				<key>OuterIdentity</key>
-				<string>anonymous</string>
-				<key>AcceptEAPTypes</key>
-				<array>
-					<integer>21</integer>
-				</array>
-				<key>TTLSInnerAuthentication</key>
-				<string>PAP</string>
-				<key>TLSTrustedServerNames</key>
-				<array>
-					<string>radius.renner.uno</string>
-				</array>
-			</dict>
-		</dict>
-	</array>
-	<key>PayloadType</key>
-	<string>Configuration</string>
-	<key>PayloadVersion</key>
-	<integer>1</integer>
-	<key>PayloadIdentifier</key>
-	<string>uno.renner.wifi.renner-test</string>
-	<key>PayloadUUID</key>
-	<string>b35513d4-97e5-4804-a77b-5ca1f723a408</string>
-	<key>PayloadDisplayName</key>
-	<string>Renner Test Wi-Fi (802.1X)</string>
-	<key>PayloadOrganization</key>
-	<string>Renner</string>
-</dict>
-</plist>
@@ -4,6 +4,54 @@ FreeRADIUS terminates EAP-TTLS and proxies the inner PAP request to the
 authentik RADIUS outpost `802.1X Radius`. authentik checks the password and
 the access policy and returns the VLAN.

+## Routing by outer identity
+
+FreeRADIUS decides on the outer EAP identity (`User-Name`) of each request,
+before any local EAP processing:
+
+| Outer identity | Path |
+|---|---|
+| `anonymous` or `anonymous@<anything>` (any case) | EAP-TTLS terminated in FreeRADIUS, inner PAP to authentik |
+| anything else | whole EAP conversation (all rounds, `State` included) proxied to the UDM RADIUS for UniFi Endpoint accounts |
+
+UniFi Endpoint clients send their real account name as outer identity; their
+names look like ordinary usernames, so the rule cannot match on name patterns.
+The UDM's Access-Accept/Reject/Challenge goes to the NAS unchanged, including
+its Tunnel-* VLAN and MS-MPPE keys. The "Accept without VLAN is rejected" rule
+applies to the authentik path only. Accounting is answered locally on both
+paths.
+
+The anonymous outer identity is mandatory for authentik clients: without it
+the login goes to the UDM and fails.
+
+UDM target: home server `udm`, `10.2.11.1` UDP 1812 (the UDM on VLAN 11,
+UniFi network "(11) RADIUS"), shared secret `UDM_RADIUS_SECRET` from OpenBao
+`apps/radius`. The UDM RADIUS accepts clients from `10.2.11.0/24` only, not
+from the pod CIDR.
+
+### Path to the UDM
+
+Each FreeRADIUS pod has a second interface `net1` on VLAN 11
+(NetworkAttachmentDefinition `freeradius-udm`,
+`kubernetes/apps/authentik/freeradius-network-attachment.yaml`):
+
+- macvlan on the node link `radius0` (VLAN 11 on `uplink`, no host addresses;
+  VLANConfig in `kubernetes/talos/patches/k8s-{1,2,3}.yaml`). VLAN 11 is in
+  Cilium's `bpf.vlanBypass`, otherwise the tagged frames are dropped on
+  `uplink`.
+- IPv4 leased from the UDM DHCP server (cni-dhcp-daemon), requested without
+  the routers option: `net1` holds only the connected `10.2.11.0/24`, no
+  default route. The proxy socket is not bound to an address; the kernel's
+  route lookup for `10.2.11.1` picks `net1` and its leased address as source.
+- IPv6 disabled on `net1` (VLAN 11 sends router advertisements).
+- The NAS listeners are bound to `eth0` (`interface = eth0`); nothing listens
+  on `net1`.
+- Traffic on `net1` bypasses Cilium; there is no CNP for the UDM hop.
+
+`radius0` must exist on every node before FreeRADIUS pods are scheduled
+there: without it the macvlan ADD fails and the pod stays in
+`ContainerCreating`.
+
 ## authentik objects

 Defined in `kubernetes/apps/authentik/blueprints-configmap.yaml`, key
@@ -95,12 +143,39 @@ For IPv6 set `LIVE_SOURCE` to the workstation's `fd02:50::` address and use
 `fd99::91`. `group-id=[3530]` is VLAN `50`, `tunnel-type=[0000000d]` VLAN,
 `medium=[00000006]` IEEE-802.

-## Client setup (SSID "Renner Test")
+## Client setup (SSID "Renner UniFi")
+
+Setup page: `https://wlan.renner.uno` (behind the Authentik gate, any
+authentik user; `kubernetes/apps/authentik/wlan-setup*.yaml`). It serves the
+Apple profile (caller's username filled in), a Windows file that imports the
+WLAN profile with `netsh`, and the Linux `nmcli` command. None of these carries a password.
+
+Android gets a Passpoint profile (`application/x-wifi-config`) with its own
+app password. "Auf Android installieren" (`/android/install`) signs the user in
+through the authentik OAuth2 application `wlan-setup` (scope
+`goauthentik.io/api`). On `/android/callback`, nginx (njs) exchanges the code,
+creates an app password (`wlan-android-<user>-<timestamp>-<random>`) with the
+user's own access token, and returns the profile in the response to that GET,
+as the Android installer requires. The page stores nothing. Deleting the app
+password in authentik removes that device from the WLAN. The profile matches
+WLANs that advertise Hotspot 2.0 with domain and NAI realm `renner.uno`
+(EAP-TTLS/PAP). Creating the app password needs no admin rights.
+
+App passwords expire when unused. The page creates them with 29 days (the API
+caps new tokens at 30 days unless the group attribute
+`goauthentik.io/user/token-maximum-lifetime` allows more). Every 802.1X login
+with an app password renews it to 60 days: the policy
+`dot1x-app-password-renew` on the `dot1x-login` binding (at most one write per
+day). authentik rejects expired app passwords and deletes them in its
+`clean_expired_models` task. A device that has not connected for 60 days, or a
+profile that was never installed, loses its app password and needs a new
+profile from the page.

 All clients use EAP-TTLS with inner PAP. The server certificate is a public
 Let's Encrypt certificate for `radius.renner.uno`, so no CA needs to be
-installed. Username and password are the authentik credentials. PAP runs
-inside the TLS tunnel to FreeRADIUS and is never sent in clear over the air.
+installed. The 802.1X password stage (`dot1x-password`) accepts the authentik
+password and app passwords. PAP runs inside the TLS tunnel to FreeRADIUS and
+is never sent in clear over the air.

 ### Android

@@ -109,7 +184,8 @@ inside the TLS tunnel to FreeRADIUS and is never sent in clear over the air.
 - CA certificate: Use system certificates
 - Domain: `radius.renner.uno`
 - Identity: authentik username
- Anonymous identity: `anonymous`
+- Anonymous identity: `anonymous` (mandatory; empty sends the login to the
+  UDM, where it fails)
 - Password: authentik password

 ### Linux (NetworkManager)
@@ -119,13 +195,14 @@ inside the TLS tunnel to FreeRADIUS and is never sent in clear over the air.
 - Inner authentication: PAP
 - CA certificate: system bundle (e.g. `/etc/ssl/certs/ca-certificates.crt`)
 - Domain: `radius.renner.uno`
+- Anonymous identity: `anonymous` (mandatory)
 - Username / password: authentik credentials

 ### Windows 11

 Settings > Network & Internet > Wi-Fi > Manage known networks > Add network:

- Network name: `Renner Test`
+- Network name: `Renner UniFi`
 - Security type: WPA2-Enterprise AES
 - EAP method: EAP-TTLS
 - Authentication method: Unencrypted password (PAP)
@@ -141,10 +218,9 @@ wireless network" instead.

 ### Apple (iOS, iPadOS, macOS)

-Apple devices need the configuration profile
-`docs/radius/clients/renner-test.mobileconfig`. Install it via AirDrop, Files
-or Settings (Profile Downloaded). The device asks for username and password on
-the first join. The profile sets security type Any (WPA2/WPA3), outer identity
+Apple devices need a configuration profile; the setup page serves it with the
+username filled in. Install it via Settings (Profile Downloaded). The device
+asks for the password on the first join. The profile sets security type Any (WPA2/WPA3), outer identity
 `anonymous` and trusted server name `radius.renner.uno`; it contains no
 password and no certificate. Apple
 devices may show a one-time "trust certificate" prompt for `radius.renner.uno`
@@ -1483,8 +1483,11 @@ data:
          name: dot1x-password
        state: present
        attrs:
+          # App passwords: the WLAN credential that devices store (Android
+          # Passpoint profiles carry it), created by wlan.renner.uno.
          backends:
            - authentik.core.auth.InbuiltBackend
+            - authentik.core.auth.TokenBackend

      - id: dot1x-login
        model: authentik_stages_user_login.userloginstage
@@ -1506,12 +1509,54 @@ data:
          order: 20
        state: present

-      - model: authentik_flows.flowstagebinding
+      - id: binding-dot1x-login
+        model: authentik_flows.flowstagebinding
        identifiers:
          target: !KeyOf dot1x-flow
          stage: !KeyOf dot1x-login
          order: 100
        state: present
+        attrs:
+          evaluate_on_plan: false
+          re_evaluate_policies: true
+
+      # Sliding expiry: an app password used for 802.1X expires 60 days
+      # after its last use; authentik rejects and deletes expired app
+      # passwords. auth_method_args.token is set by TokenBackend. Always
+      # passes; failure_result true keeps an error from blocking the login.
+      - id: dot1x-app-password-renew
+        model: authentik_policies_expression.expressionpolicy
+        identifiers:
+          name: dot1x-app-password-renew
+        state: present
+        attrs:
+          expression: |
+            from datetime import timedelta
+            from django.utils.timezone import now
+            from authentik.core.models import Token, TokenIntents
+            ref = (request.context.get("auth_method_args") or {}).get("token")
+            if request.context.get("auth_method") == "token" and isinstance(ref, dict):
+                renewed = now() + timedelta(days=60)
+                count = Token.objects.filter(
+                    pk=ref.get("pk"),
+                    user=request.user,
+                    intent=TokenIntents.INTENT_APP_PASSWORD,
+                    expiring=True,
+                    expires__lt=renewed - timedelta(days=1),
+                ).update(expires=renewed)
+                ak_logger.info("dot1x app password", token=ref.get("name"), renewed=count)
+            return True
+
+      - model: authentik_policies.policybinding
+        identifiers:
+          policy: !KeyOf dot1x-app-password-renew
+          target: !KeyOf binding-dot1x-login
+          order: 0
+        state: present
+        attrs:
+          enabled: true
+          negate: false
+          failure_result: true

      - id: dot1x-has-vlan
        model: authentik_policies_expression.expressionpolicy
@@ -1624,3 +1669,43 @@ data:
            kubernetes_httproute_annotations: {}
            kubernetes_httproute_parent_refs: []
            kubernetes_json_patches: null
+
+      # wlan.renner.uno (wlan-setup.yaml): signs the user in and, with the
+      # user's own access token (scope goauthentik.io/api), creates the WLAN
+      # app password for the Android Passpoint profile. Confidential client;
+      # the secret comes from wlan-setup-oauth (wlan-setup-oauth.yaml). No
+      # policy binding: every authentik user may set up the WLAN.
+      - id: wlan-setup-provider
+        model: authentik_providers_oauth2.oauth2provider
+        identifiers:
+          name: WLAN setup
+        state: present
+        attrs:
+          authentication_flow: null
+          authorization_flow: !Find [authentik_flows.flow, [slug, default-provider-authorization-implicit-consent]]
+          invalidation_flow: !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+          client_type: confidential
+          client_id: wlan-setup
+          client_secret: !Env WLAN_SETUP_CLIENT_SECRET
+          grant_types:
+            - authorization_code
+          access_token_validity: minutes=5
+          signing_key: !Find [authentik_crypto.certificatekeypair, [name, authentik Self-signed Certificate]]
+          property_mappings:
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-openid]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-profile]]
+            - !Find [authentik_providers_oauth2.scopemapping, [managed, goauthentik.io/providers/oauth2/scope-authentik_api]]
+          redirect_uris:
+            - url: https://wlan.renner.uno/android/callback
+              matching_mode: strict
+
+      - model: authentik_core.application
+        identifiers:
+          slug: wlan-setup
+        state: present
+        attrs:
+          name: WLAN setup
+          slug: wlan-setup
+          provider: !KeyOf wlan-setup-provider
+          meta_launch_url: https://wlan.renner.uno
+          meta_description: "WLAN setup page; creates WLAN app passwords"
@@ -73,6 +73,10 @@ spec:
      # on an unclean shutdown is not an acceptable trade.
      checkpoint_timeout: "15min"
      max_wal_size: "2GB"
+      # authentik's subclass joins over empty tables get planner costs far above
+      # jit_above_cost; LLVM compilation then takes ~420 ms for a query that
+      # executes in 0.1 ms (every flow start, every RADIUS/LDAP login).
+      jit: "off"
      # zstd, not "on": the boolean spelling resolves to pglz (2016-era, weaker
      # and slower than the lz4/zstd this build also accepts). Compresses the
      # full-page images that dominate WAL volume after each checkpoint.
@@ -1,6 +1,8 @@
-# FreeRADIUS 3.2 config for 802.1X: EAP-TTLS terminated here, inner PAP
-# proxied to the authentik outpost ak-outpost-8021x-radius. Replaces the
-# image's raddb completely. Functional test: tests/radius/run.sh.
+# FreeRADIUS 3.2 config for 802.1X: outer identity anonymous[@...] -> EAP-TTLS
+# terminated here, inner PAP proxied to the authentik outpost
+# ak-outpost-8021x-radius; any other outer identity -> whole EAP conversation
+# proxied to the UDM RADIUS (UniFi Endpoint). Replaces the image's raddb
+# completely. Functional test: tests/radius/run.sh.
 # VLAN contract: docs/radius/dot1x.md.
 apiVersion: v1
 kind: ConfigMap
@@ -32,9 +34,10 @@ data:

    max_request_time = 30
    cleanup_delay = 5
-    # Greater than response_window (proxy.conf): never forward a NAS
-    # retransmit to the outpost. A TTLS inner request sent twice to the home
-    # server leaves a freed request in the proxy hash; radiusd segfaults.
+    # Greater than every home server's response_window (proxy.conf): never
+    # forward a NAS retransmit to a home server. A TTLS inner request sent
+    # twice to the home server leaves a freed request in the proxy hash;
+    # radiusd segfaults.
    proxy_dedup_window = 10
    max_requests = 16384
    hostname_lookups = no
@@ -152,6 +155,42 @@ data:
      nostrip
    }

+    # UDM RADIUS (FreeRADIUS) for UniFi Endpoint accounts; gets the whole
+    # outer EAP conversation. Address: UDM on VLAN 11 "(11) RADIUS", reached
+    # over net1 (freeradius-network-attachment.yaml); the UDM accepts
+    # RADIUS clients from 10.2.11.0/24 only.
+    home_server udm {
+      type = auth
+      ipaddr = 10.2.11.1
+      port = 1812
+      proto = udp
+      secret = $ENV{UDM_RADIUS_SECRET}
+      # RFC 3579: every reply to an EAP request carries Message-Authenticator.
+      require_message_authenticator = yes
+      # Less than proxy_dedup_window (radiusd.conf).
+      response_window = 5
+      zombie_period = 20
+      # Probe with an Access-Request for a user that cannot exist (no
+      # EAP-Message, so no Endpoint login); the reject counts as an answer.
+      # Sent only while zombie or dead.
+      status_check = request
+      username = "udm-status-probe.invalid"
+      password = "not-a-secret"
+      check_interval = 6
+      check_timeout = 4
+      num_answers_to_alive = 3
+    }
+
+    home_server_pool udm {
+      type = fail-over
+      home_server = udm
+    }
+
+    realm udm {
+      auth_pool = udm
+      nostrip
+    }
+
  mods-enabled_always: |
    always ok {
      rcode = ok
@@ -194,35 +233,50 @@ data:

  sites-enabled_default: |
    server default {
+      # NAS listeners on eth0 only; net1 (VLAN 11) carries the UDM proxy
+      # traffic and nothing else.
      listen {
        type = auth
        ipaddr = *
        port = 1812
+        interface = eth0
      }

      listen {
        type = acct
        ipaddr = *
        port = 1813
+        interface = eth0
      }

      listen {
        type = auth
        ipv6addr = ::
        port = 1812
+        interface = eth0
      }

      listen {
        type = acct
        ipv6addr = ::
        port = 1813
+        interface = eth0
      }

      authorize {
-        # EAP-TTLS only.
+        # EAP only.
        if (!&EAP-Message) {
          reject
        }
+        # Outer identity anonymous[@realm]: authentik clients, EAP-TTLS here.
+        # Any other: UniFi Endpoint account (real name as outer identity);
+        # every round goes to the UDM unprocessed.
+        if (&User-Name && &User-Name !~ /^anonymous(@.*)?$/i) {
+          update control {
+            &Proxy-To-Realm := udm
+          }
+          return
+        }
        eap {
          ok = return
          updated = return
@@ -245,12 +299,23 @@ data:
        ok
      }

+      # UDM replies pass unchanged.
      post-auth {
-        update reply {
-          &Cisco-AVPair !* ANY
+        if (&control:Proxy-To-Realm == "udm") {
+          noop
+        }
+        else {
+          update reply {
+            &Cisco-AVPair !* ANY
+          }
        }
        Post-Auth-Type REJECT {
-          eap
+          if (&control:Proxy-To-Realm == "udm") {
+            noop
+          }
+          else {
+            eap
+          }
        }
      }

@@ -259,7 +324,12 @@ data:

      # Runs the TTLS callback that hands the outpost reply back into the tunnel.
      post-proxy {
-        eap
+        if (&control:Proxy-To-Realm == "udm") {
+          noop
+        }
+        else {
+          eap
+        }
      }
    }

@@ -0,0 +1,48 @@
+---
+# FreeRADIUS net1: macvlan on radius0, VLAN 11 "(11) RADIUS" (VLANConfig in
+# kubernetes/talos/patches/k8s-{1,2,3}.yaml). Carries only the proxy traffic
+# to home server `udm` (freeradius-config.yaml): the UDM RADIUS accepts
+# clients from 10.2.11.0/24, not from the pod CIDR. Bypasses Cilium policy.
+# Address leased from the UDM; nothing references it.
+#
+# net1 holds only its connected /24, so the unbound proxy socket reaches the
+# UDM via net1 with the leased source. No sbr: it moves that route into a
+# source-based table, and the proxy would leave via eth0 from the pod IP.
+# skipDefault + subnet-mask: the lease is requested without routers, so no
+# default route lands on net1 (dnsmasq sends only requested options).
+# IPv6 off on net1: VLAN 11 sends RAs (default route, SLAAC); the UDM
+# RADIUS clients are IPv4 only.
+#
+# Requires cni-dhcp-daemon (infrastructure/multus) and VLAN 11 in Cilium's
+# bpf.vlanBypass (infrastructure/cilium/helmrelease.yaml).
+apiVersion: k8s.cni.cncf.io/v1
+kind: NetworkAttachmentDefinition
+metadata:
+  name: freeradius-udm
+  namespace: authentik
+spec:
+  config: |
+    {
+      "cniVersion": "0.3.1",
+      "name": "freeradius-udm",
+      "plugins": [
+        {
+          "type": "macvlan",
+          "master": "radius0",
+          "mode": "bridge",
+          "ipam": {
+            "type": "dhcp",
+            "request": [
+              { "skipDefault": true },
+              { "option": "subnet-mask" }
+            ]
+          }
+        },
+        {
+          "type": "tuning",
+          "sysctl": {
+            "net.ipv6.conf.IFNAME.disable_ipv6": "1"
+          }
+        }
+      ]
+    }
@@ -18,6 +18,9 @@ spec:
    metadata:
      labels:
        app.kubernetes.io/name: freeradius
+      annotations:
+        # net1 on VLAN 11: the path to the UDM RADIUS.
+        k8s.v1.cni.cncf.io/networks: freeradius-udm
    spec:
      enableServiceLinks: false
      affinity:
@@ -89,6 +92,11 @@ spec:
                secretKeyRef:
                  name: radius-secrets
                  key: DOT1X_OUTPOST_SECRET
+            - name: UDM_RADIUS_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: radius-secrets
+                  key: UDM_RADIUS_SECRET
          ports:
            - name: radius
              containerPort: 1812
@@ -69,6 +69,11 @@ spec:
            secretKeyRef:
              name: ak-pg-app
              key: password
+        # Default 0 opens a new Postgres connection per request.
+        - name: AUTHENTIK_POSTGRESQL__CONN_MAX_AGE
+          value: "60"
+        - name: AUTHENTIK_POSTGRESQL__CONN_HEALTH_CHECKS
+          value: "true"
        - name: AUTHENTIK_EMAIL__PASSWORD
          valueFrom:
            secretKeyRef:
@@ -166,10 +171,11 @@ spec:
    worker:
      # Overrides the global key; keep authentik-secrets in the list.
      podAnnotations:
-        secret.reloader.stakater.com/reload: authentik-secrets,radius-secrets
-      # Shared secret of the 802.1X Radius provider, set via `!Env` in
-      # dot1x-radius.yaml. Worker only (blueprint applier); optional so a
-      # missing Secret fails only the dot1x blueprint entry.
+        secret.reloader.stakater.com/reload: authentik-secrets,radius-secrets,wlan-setup-oauth
+      # Shared secret of the 802.1X Radius provider and client secret of the
+      # WLAN setup provider, set via `!Env` in dot1x-radius.yaml. Worker only
+      # (blueprint applier); optional so a missing Secret fails only the
+      # blueprint entries that use it.
      env:
        - name: DOT1X_OUTPOST_SECRET
          valueFrom:
@@ -177,6 +183,12 @@ spec:
              name: radius-secrets
              key: DOT1X_OUTPOST_SECRET
              optional: true
+        - name: WLAN_SETUP_CLIENT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: wlan-setup-oauth
+              key: client_secret
+              optional: true
      resources:
        requests:
          # Same reasoning as server above, and the worker is burstier still:
@@ -13,8 +13,12 @@ resources:
  - radius-cert.yaml
  - radius-externalsecret.yaml
  - freeradius-config.yaml
+  - freeradius-network-attachment.yaml
  - freeradius.yaml
  - freeradius-cnp.yaml
+  - wlan-setup-oauth.yaml
+  - wlan-setup-config.yaml
+  - wlan-setup.yaml
  # ak-pg CNPG Postgres backend (moved here from the retired seed-authentik KS;
  # each carries prune: disabled so ownership transferred without a teardown).
  # authentik has no data PVCs — all state lives in ak-pg. This KS depends on
@@ -0,0 +1,484 @@
+# wlan.renner.uno: setup files for "Renner UniFi" (802.1X, EAP-TTLS/PAP
+# against freeradius, outer identity anonymous, server name radius.renner.uno).
+# Served by wlan-setup (wlan-setup.yaml) behind the Authentik gate; the
+# username comes from X-authentik-username. Only the Android Passpoint profile
+# carries a credential (the format requires it): a per-device authentik app
+# password that the page creates with the user's own OAuth access token.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: wlan-setup
+  namespace: authentik
+data:
+  # The image's nginx.conf plus the njs module and the OAuth client secret
+  # passpoint.js reads from the environment.
+  nginx.conf: |
+    load_module modules/ngx_http_js_module.so;
+
+    env WLAN_SETUP_CLIENT_SECRET;
+
+    worker_processes 1;
+    error_log /var/log/nginx/error.log notice;
+    pid /tmp/nginx.pid;
+
+    events {
+        worker_connections 1024;
+    }
+
+    http {
+        proxy_temp_path /tmp/proxy_temp;
+        client_body_temp_path /tmp/client_temp;
+        fastcgi_temp_path /tmp/fastcgi_temp;
+        uwsgi_temp_path /tmp/uwsgi_temp;
+        scgi_temp_path /tmp/scgi_temp;
+
+        include /etc/nginx/mime.types;
+        default_type application/octet-stream;
+
+        log_format main '$remote_addr - [$time_local] "$request" $status $body_bytes_sent "$http_user_agent"';
+        access_log /var/log/nginx/access.log main;
+
+        sendfile on;
+        keepalive_timeout 65;
+
+        include /etc/nginx/conf.d/*.conf;
+    }
+
+  default.conf: |
+    # Only plain usernames reach a generated file; anything else leaves the
+    # field empty and the device asks for it.
+    map $http_x_authentik_username $wifi_user {
+        "~^[A-Za-z0-9._@+-]{1,64}$" $http_x_authentik_username;
+        default "";
+    }
+
+    js_path /etc/nginx/njs/;
+    js_import passpoint from passpoint.js;
+
+    # authentik-server, resolved once at start; reached only by passpoint.js
+    # subrequests (/_ak/...).
+    upstream authentik {
+        server authentik-server.authentik.svc.cluster.local:80;
+    }
+
+    server {
+        listen 8080;
+        listen [::]:8080;
+        server_tokens off;
+        root /usr/share/nginx/html;
+        add_header Cache-Control "no-store" always;
+
+        location = / {
+            try_files /index.html =404;
+        }
+
+        location = /whoami {
+            default_type text/plain;
+            return 200 $wifi_user;
+        }
+
+        # Apple: com.apple.wifi.managed, TTLS (21) with inner PAP. Fixed
+        # PayloadIdentifier/UUIDs so a reinstall replaces the old profile.
+        location = /renner-unifi.mobileconfig {
+            default_type application/x-apple-aspen-config;
+            add_header Cache-Control "no-store" always;
+            add_header Content-Disposition 'attachment; filename="renner-unifi.mobileconfig"' always;
+            return 200 '<?xml version="1.0" encoding="UTF-8"?>
+    <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+    <plist version="1.0">
+    <dict>
+    	<key>PayloadContent</key>
+    	<array>
+    		<dict>
+    			<key>PayloadType</key>
+    			<string>com.apple.wifi.managed</string>
+    			<key>PayloadVersion</key>
+    			<integer>1</integer>
+    			<key>PayloadIdentifier</key>
+    			<string>uno.renner.wifi.renner-unifi.network</string>
+    			<key>PayloadUUID</key>
+    			<string>824959bf-c55d-4ed2-b569-c33f3759c2b6</string>
+    			<key>PayloadDisplayName</key>
+    			<string>Renner UniFi</string>
+    			<key>PayloadOrganization</key>
+    			<string>Renner</string>
+    			<key>SSID_STR</key>
+    			<string>Renner UniFi</string>
+    			<key>HIDDEN_NETWORK</key>
+    			<false/>
+    			<key>AutoJoin</key>
+    			<true/>
+    			<key>EncryptionType</key>
+    			<string>Any</string>
+    			<key>EAPClientConfiguration</key>
+    			<dict>
+    				<key>UserName</key>
+    				<string>$wifi_user</string>
+    				<key>OuterIdentity</key>
+    				<string>anonymous</string>
+    				<key>AcceptEAPTypes</key>
+    				<array>
+    					<integer>21</integer>
+    				</array>
+    				<key>TTLSInnerAuthentication</key>
+    				<string>PAP</string>
+    				<key>TLSTrustedServerNames</key>
+    				<array>
+    					<string>radius.renner.uno</string>
+    				</array>
+    			</dict>
+    		</dict>
+    	</array>
+    	<key>PayloadType</key>
+    	<string>Configuration</string>
+    	<key>PayloadVersion</key>
+    	<integer>1</integer>
+    	<key>PayloadIdentifier</key>
+    	<string>uno.renner.wifi.renner-unifi</string>
+    	<key>PayloadUUID</key>
+    	<string>7175a2a3-ddd3-42ea-b4ad-b7e5501892f3</string>
+    	<key>PayloadDisplayName</key>
+    	<string>WLAN Renner UniFi</string>
+    	<key>PayloadOrganization</key>
+    	<string>Renner</string>
+    </dict>
+    </plist>
+    ';
+        }
+
+        location = /renner-unifi-wlan.cmd {
+            default_type application/octet-stream;
+            add_header Cache-Control "no-store" always;
+            add_header Content-Disposition 'attachment; filename="renner-unifi-wlan.cmd"' always;
+            try_files /renner-unifi-wlan.cmd =404;
+        }
+
+        # Android: a tap on /android/install starts an authorization-code
+        # sign-in at authentik (the user is already signed in there); the
+        # callback creates the app password as the user and answers the same
+        # navigation with the Passpoint profile (application/x-wifi-config,
+        # base64, no Content-Disposition), as the Android installer requires.
+        location = /android/install {
+            js_content passpoint.install;
+        }
+
+        location = /android/callback {
+            # The query carries the one-time authorization code.
+            access_log off;
+            js_content passpoint.callback;
+        }
+
+        # Subrequests from passpoint.js only. Credential and content type
+        # arrive as arguments and leave as headers; proxy_pass with a variable
+        # URI does not forward the arguments. $arg_* only: subrequests share
+        # the parent's variable cache, so a map would keep its first value.
+        location ~ ^/_ak(/.*)$ {
+            internal;
+            proxy_pass http://authentik$1;
+            # njs reads the whole reply from this buffer (default one page).
+            subrequest_output_buffer_size 256k;
+            # Only the headers set here reach authentik.
+            proxy_pass_request_headers off;
+            proxy_set_header Host auth.renner.uno;
+            proxy_set_header Cookie "";
+            proxy_set_header Authorization "$arg_scheme $arg_cred";
+            proxy_set_header Content-Type $arg_ct;
+            proxy_set_header Accept "application/json";
+        }
+
+        location = /healthz {
+            access_log off;
+            default_type text/plain;
+            return 200 "ok\n";
+        }
+
+        location / {
+            return 404;
+        }
+    }
+
+  # Windows: extracts the WLAN profile (everything after line 8 of itself)
+  # into %TEMP% and imports it for the current user with netsh. EAP-TTLS with
+  # PAPAuthentication, outer identity anonymous, server name
+  # radius.renner.uno, trust anchor ISRG Root X1 (SHA-1 thumbprint; the
+  # Let's Encrypt chain of radius-tls ends there). Windows asks for username
+  # and password on connect. CRLF line endings: cmd.exe needs them.
+  renner-unifi-wlan.cmd: "@echo off\r\nrem WLAN Renner UniFi einrichten (802.1X, Anmeldung mit dem authentik-Konto)\r\nset \"WLANXML=%TEMP%\\renner-unifi-wlan.xml\"\r\nmore +8 \"%~f0\" > \"%WLANXML%\"\r\nnetsh wlan add profile filename=\"%WLANXML%\" user=current\r\ndel \"%WLANXML%\"\r\nnetsh wlan connect name=\"Renner UniFi\"\r\npause & exit /b\r\n<?xml version=\"1.0\"?><WLANProfile xmlns=\"http://www.microsoft.com/networking/WLAN/profile/v1\"><name>Renner UniFi</name><SSIDConfig><SSID><hex>52656E6E657220556E694669</hex><name>Renner UniFi</name></SSID><nonBroadcast>false</nonBroadcast></SSIDConfig><connectionType>ESS</connectionType><connectionMode>auto</connectionMode><MSM><security><authEncryption><authentication>WPA2</authentication><encryption>AES</encryption><useOneX>true</useOneX></authEncryption><OneX xmlns=\"http://www.microsoft.com/networking/OneX/v1\"><cacheUserData>true</cacheUserData><authMode>user</authMode><EAPConfig><EapHostConfig xmlns=\"http://www.microsoft.com/provisioning/EapHostConfig\"><EapMethod><Type xmlns=\"http://www.microsoft.com/provisioning/EapCommon\">21</Type><VendorId xmlns=\"http://www.microsoft.com/provisioning/EapCommon\">0</VendorId><VendorType xmlns=\"http://www.microsoft.com/provisioning/EapCommon\">0</VendorType><AuthorId xmlns=\"http://www.microsoft.com/provisioning/EapCommon\">311</AuthorId></EapMethod><Config xmlns=\"http://www.microsoft.com/provisioning/EapHostConfig\"><EapTtls xmlns=\"http://www.microsoft.com/provisioning/EapTtlsConnectionPropertiesV1\"><ServerValidation><ServerNames>radius.renner.uno</ServerNames><TrustedRootCAHash>ca bd 2a 79 a1 07 6a 31 f2 1d 25 36 35 cb 03 9d 43 29 a5 e8</TrustedRootCAHash><DisablePrompt>false</DisablePrompt></ServerValidation><Phase2Authentication><PAPAuthentication/></Phase2Authentication><Phase1Identity><IdentityPrivacy>true</IdentityPrivacy><AnonymousIdentity>anonymous</AnonymousIdentity></Phase1Identity></EapTtls></Config></EapHostConfig></EAPConfig></OneX></security></MSM></WLANProfile>\r\n"
+
+  # Android Passpoint R1 provisioning (source.android.com, Passpoint): the
+  # body is base64 of a MIME multipart with the PPS MO and the trust anchor.
+  # HomeSP FQDN and realm renner.uno match the Hotspot 2.0 domain and NAI realm
+  # the Passpoint WLAN announces; EAP-TTLS (21) with inner PAP. Trust anchor
+  # ISRG Root X1 (the radius-tls chain ends there), AAA server name
+  # radius.renner.uno (Extension/Android/AAAServerTrustedNames, as Android's
+  # PpsMoParser expects it). The credential is a new app password per install,
+  # created as the user with the access token of the "WLAN setup" OAuth client
+  # (authorization code, scope goauthentik.io/api). It starts with 29 days
+  # (below the 30-day token cap); each 802.1X login renews it to 60 days
+  # (policy dot1x-app-password-renew).
+  passpoint.js: |
+    const ISRG_ROOT_X1 = "MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygch77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6UA5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sWT8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyHB5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UCB5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUvKBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWnOlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTnjh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbwqHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CIrU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkqhkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZLubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KKNFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7UrTkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdCjNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVcoyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPAmRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57demyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc=";
+    const USER = /^[A-Za-z0-9._@+-]{1,64}$/;
+
+    function b64(s) { return Buffer.from(s).toString("base64"); }
+    function node(name, inner) { return "<Node><NodeName>" + name + "</NodeName>" + inner + "</Node>"; }
+    function leaf(name, value) { return node(name, "<Value>" + value + "</Value>"); }
+
+    function profile(user, password) {
+        const pps = '<MgmtTree xmlns="syncml:dmddf1.2"><VerDTD>1.2</VerDTD>' +
+            node("PerProviderSubscription",
+                "<RTProperties><Type><DDFName>urn:wfa:mo:hotspot2dot0-perprovidersubscription:1.0</DDFName></Type></RTProperties>" +
+                node("i001",
+                    node("HomeSP", leaf("FriendlyName", "Renner") + leaf("FQDN", "renner.uno")) +
+                    node("Credential",
+                        leaf("Realm", "renner.uno") +
+                        node("UsernamePassword",
+                            leaf("Username", user) +
+                            leaf("Password", b64(password)) +
+                            node("EAPMethod", leaf("EAPType", "21") + leaf("InnerMethod", "PAP")))) +
+                    node("Extension", node("Android",
+                        node("AAAServerTrustedNames", leaf("FQDN", "radius.renner.uno")))))) +
+            "</MgmtTree>";
+        const mime = "Content-Type: multipart/mixed; boundary={boundary}\r\n" +
+            "Content-Transfer-Encoding: base64\r\n\r\n" +
+            "--{boundary}\r\n" +
+            "Content-Type: application/x-passpoint-profile\r\n" +
+            "Content-Transfer-Encoding: base64\r\n\r\n" +
+            b64(pps) + "\r\n" +
+            "--{boundary}\r\n" +
+            "Content-Type: application/x-x509-ca-cert\r\n" +
+            "Content-Transfer-Encoding: base64\r\n\r\n" +
+            ISRG_ROOT_X1 + "\r\n" +
+            "--{boundary}--\r\n";
+        return b64(mime);
+    }
+
+    const CLIENT_ID = "wlan-setup";
+    const REDIRECT_URI = "https://wlan.renner.uno/android/callback";
+    const AUTHORIZE = "https://auth.renner.uno/application/o/authorize/";
+    const STATE_COOKIE = "wlan_oauth_state";
+    const LIFETIME_DAYS = 29;
+
+    function random() {
+        const bytes = new Uint8Array(24);
+        crypto.getRandomValues(bytes);
+        return Buffer.from(bytes).toString("base64url");
+    }
+
+    function cookie(r, name) {
+        const all = r.headersIn["Cookie"] || "";
+        const parts = all.split(";");
+        for (let n = 0; n < parts.length; n++) {
+            const part = parts[n];
+            const i = part.indexOf("=");
+            if (i > 0 && part.substring(0, i).trim() === name) return part.substring(i + 1).trim();
+        }
+        return "";
+    }
+
+    function form(fields) {
+        return Object.keys(fields).map(k => encodeURIComponent(k) + "=" + encodeURIComponent(fields[k])).join("&");
+    }
+
+    const FORM = "application/x-www-form-urlencoded";
+    const JSON_CT = "application/json";
+    const CRED = /^[A-Za-z0-9._~+\/=-]+$/;
+
+    // authentik call through the internal /_ak location; the arguments
+    // become the Authorization and Content-Type headers there (raw, nginx
+    // does not decode $arg_*).
+    async function ak(r, method, path, scheme, cred, ct, body) {
+        if (!CRED.test(cred)) throw new Error(method + " " + path + ": no credential");
+        const args = "scheme=" + scheme + "&cred=" + cred + "&ct=" + ct;
+        const opts = { method: method, args: args };
+        if (body !== undefined) opts.body = body;
+        const reply = await r.subrequest("/_ak" + path, opts);
+        if (reply.status < 200 || reply.status > 299) {
+            throw new Error(method + " " + path + " -> " + reply.status + " " + reply.responseText.substring(0, 300));
+        }
+        return JSON.parse(reply.responseText);
+    }
+
+    function install(r) {
+        const state = random();
+        r.headersOut["Set-Cookie"] = STATE_COOKIE + "=" + state +
+            "; Path=/android/; Max-Age=300; HttpOnly; Secure; SameSite=Lax";
+        r.return(302, AUTHORIZE + "?" + form({
+            response_type: "code",
+            client_id: CLIENT_ID,
+            redirect_uri: REDIRECT_URI,
+            scope: "openid profile goauthentik.io/api",
+            state: state,
+        }));
+    }
+
+    async function callback(r) {
+        try {
+            const state = cookie(r, STATE_COOKIE);
+            if (!state || r.args.state !== state || !r.args.code) { r.return(400, "Bitte die Einrichtung neu starten.\n"); return; }
+            const client = Buffer.from(CLIENT_ID + ":" + process.env.WLAN_SETUP_CLIENT_SECRET).toString("base64");
+            const grant = await ak(r, "POST", "/application/o/token/", "Basic", client, FORM, form({
+                grant_type: "authorization_code",
+                code: r.args.code,
+                redirect_uri: REDIRECT_URI,
+            }));
+            const access = grant.access_token;
+            const me = await ak(r, "GET", "/api/v3/core/users/me/", "Bearer", access, "");
+            const user = me.user.username;
+            if (!USER.test(user) || user !== r.headersIn["X-authentik-username"]) { r.return(403); return; }
+
+            const now = new Date();
+            const stamp = now.toISOString().replace(/[-:]/g, "").replace(/\..*$/, "");
+            const identifier = "wlan-android-" + user.replace(/[^A-Za-z0-9-]/g, "-").toLowerCase() + "-" + stamp + "-" + random().substring(0, 6).replace(/[^A-Za-z0-9]/g, "x");
+            const expires = new Date(now.getTime() + LIFETIME_DAYS * 86400000).toISOString();
+            await ak(r, "POST", "/api/v3/core/tokens/", "Bearer", access, JSON_CT, JSON.stringify({
+                identifier: identifier,
+                intent: "app_password",
+                description: "WLAN Android, " + now.toISOString().substring(0, 10) + " (wlan.renner.uno)",
+                expiring: true,
+                expires: expires,
+            }));
+            const key = (await ak(r, "GET", "/api/v3/core/tokens/" + identifier + "/view_key/", "Bearer", access, "")).key;
+
+            r.headersOut["Set-Cookie"] = STATE_COOKIE + "=; Path=/android/; Max-Age=0; HttpOnly; Secure; SameSite=Lax";
+            r.headersOut["Content-Type"] = "application/x-wifi-config";
+            r.headersOut["Content-Transfer-Encoding"] = "base64";
+            r.return(200, profile(user, key));
+        } catch (e) {
+            r.error("wlan-setup android: " + e.message);
+            r.return(502, "Die Einrichtung ist fehlgeschlagen.\n");
+        }
+    }
+
+    export default { install, callback };
+
+  index.html: |
+    <!doctype html>
+    <html lang="de">
+    <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>WLAN einrichten</title>
+    <style>
+      :root { --bg: #ffffff; --fg: #1d1d1f; --muted: #5f6368; --card: #f4f5f7; --accent: #0b63ce; --code: #e9ebef; }
+      @media (prefers-color-scheme: dark) {
+        :root { --bg: #121314; --fg: #e8eaed; --muted: #9aa0a6; --card: #1e1f22; --accent: #7cacf8; --code: #2a2b2f; }
+      }
+      * { box-sizing: border-box; }
+      body { margin: 0; background: var(--bg); color: var(--fg); font: 16px/1.5 system-ui, -apple-system, "Segoe UI", Roboto, sans-serif; }
+      main { max-width: 42rem; margin: 0 auto; padding: 1.5rem 1rem 3rem; }
+      h1 { font-size: 1.6rem; margin: 0 0 .25rem; }
+      h2 { font-size: 1.15rem; margin: 0 0 .5rem; }
+      p { margin: .5rem 0; }
+      .muted { color: var(--muted); }
+      section { background: var(--card); border-radius: 12px; padding: 1rem 1.1rem; margin: 1rem 0; }
+      section.current { outline: 2px solid var(--accent); }
+      a.button, button { display: inline-block; background: var(--accent); color: #fff; border: 0; border-radius: 8px; padding: .6rem 1rem; font: inherit; text-decoration: none; cursor: pointer; }
+      @media (prefers-color-scheme: dark) { a.button, button { color: #121314; } }
+      ol { padding-left: 1.3rem; margin: .5rem 0; }
+      pre { background: var(--code); border-radius: 8px; padding: .75rem; overflow-x: auto; white-space: pre-wrap; word-break: break-all; font-size: .85rem; margin: .5rem 0; }
+      details > summary { cursor: pointer; color: var(--accent); margin: 1.5rem 0 .5rem; }
+    </style>
+    </head>
+    <body>
+    <main>
+      <h1>WLAN einrichten</h1>
+      <p>WLAN <strong>Renner UniFi</strong>. Anmeldung mit deinem Konto <strong id="user">…</strong> und deinem authentik-Passwort.</p>
+
+      <div id="detected"></div>
+
+      <details id="others">
+        <summary>Andere Geräte</summary>
+        <div id="rest"></div>
+      </details>
+
+      <template id="t-android">
+        <section data-os="android">
+          <h2>Android</h2>
+          <p><a class="button" href="/android/install">Auf Android installieren</a></p>
+          <p class="muted">Das Gerät bekommt ein eigenes WLAN-App-Passwort in deinem authentik-Konto; dort gelöscht, ist das Gerät aus dem WLAN.</p>
+        </section>
+      </template>
+
+      <template id="t-apple">
+        <section data-os="apple">
+          <h2>iPhone, iPad, Mac</h2>
+          <p><a class="button" href="/renner-unifi.mobileconfig">Profil laden</a></p>
+          <ol>
+            <li>iPhone/iPad: Einstellungen → „Profil geladen“ → Installieren. Mac: Systemeinstellungen → Allgemein → Geräteverwaltung → Profil doppelklicken.</li>
+            <li>Beim ersten Verbinden mit „Renner UniFi“ dein Passwort eingeben.</li>
+          </ol>
+        </section>
+      </template>
+
+      <template id="t-windows">
+        <section data-os="windows">
+          <h2>Windows</h2>
+          <p><a class="button" href="/renner-unifi-wlan.cmd">Einrichtungsdatei laden</a></p>
+          <ol>
+            <li>Die geladene Datei doppelklicken. Fragt Windows nach („Der Computer wurde durch Windows geschützt“): „Weitere Informationen“ → „Trotzdem ausführen“.</li>
+            <li>Beim Verbinden Benutzername <strong class="u">…</strong> und dein Passwort eingeben.</li>
+          </ol>
+        </section>
+      </template>
+
+      <template id="t-linux">
+        <section data-os="linux">
+          <h2>Linux (NetworkManager)</h2>
+          <p>Im Terminal ausführen, danach fragt NetworkManager nach dem Passwort:</p>
+          <pre id="nmcli"></pre>
+          <p><button type="button" id="copy-nmcli">Befehl kopieren</button></p>
+        </section>
+      </template>
+    </main>
+    <script>
+    (function () {
+      var ua = navigator.userAgent;
+      var os = "other";
+      if (/Android/i.test(ua)) os = "android";
+      else if (/iPhone|iPad|iPod|Macintosh/i.test(ua)) os = "apple";
+      else if (/Windows/i.test(ua)) os = "windows";
+      else if (/Linux|X11/i.test(ua)) os = "linux";
+
+      var detected = document.getElementById("detected");
+      var rest = document.getElementById("rest");
+      ["android", "apple", "windows", "linux"].forEach(function (name) {
+        var node = document.getElementById("t-" + name).content.cloneNode(true);
+        if (name === os) { node.querySelector("section").classList.add("current"); detected.appendChild(node); }
+        else rest.appendChild(node);
+      });
+      if (os === "other") document.getElementById("others").open = true;
+
+      var currentUser = "";
+      function quote(s) { return "'" + s.replace(/'/g, "'\\''") + "'"; }
+      function render(user) {
+        currentUser = user;
+        var shown = user || "(dein Benutzername)";
+        document.getElementById("user").textContent = shown;
+        document.querySelectorAll(".u").forEach(function (el) { el.textContent = shown; });
+        document.getElementById("nmcli").textContent =
+          "nmcli connection add type wifi con-name 'Renner UniFi' ssid 'Renner UniFi' " +
+          "wifi-sec.key-mgmt wpa-eap 802-1x.eap ttls 802-1x.phase2-auth pap " +
+          "802-1x.anonymous-identity anonymous 802-1x.identity " + quote(user || "BENUTZERNAME") + " " +
+          "802-1x.domain-suffix-match radius.renner.uno 802-1x.system-ca-certs yes " +
+          "802-1x.password-flags 2 && nmcli --ask connection up 'Renner UniFi'";
+      }
+      render("");
+      fetch("/whoami", { credentials: "same-origin" })
+        .then(function (r) { return r.ok ? r.text() : ""; })
+        .then(function (t) { render(t.trim()); })
+        .catch(function () {});
+
+
+      document.getElementById("copy-nmcli").addEventListener("click", function () {
+        var text = document.getElementById("nmcli").textContent;
+        var btn = this;
+        navigator.clipboard.writeText(text).then(function () {
+          btn.textContent = "Kopiert";
+          setTimeout(function () { btn.textContent = "Befehl kopieren"; }, 2000);
+        });
+      });
+    })();
+    </script>
+    </body>
+    </html>
@@ -0,0 +1,32 @@
+# Client secret of the "WLAN setup" OAuth2 provider (dot1x-radius blueprint).
+# Generated once; the authentik worker reads it as WLAN_SETUP_CLIENT_SECRET
+# for the blueprint, wlan-setup reads it for the code exchange.
+apiVersion: generators.external-secrets.io/v1alpha1
+kind: Password
+metadata:
+  name: wlan-setup-oauth
+  namespace: authentik
+spec:
+  length: 64
+  digits: 16
+  symbols: 0
+  allowRepeat: true
+  noUpper: false
+  secretKeys:
+    - client_secret
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: wlan-setup-oauth
+  namespace: authentik
+spec:
+  refreshPolicy: CreatedOnce
+  target:
+    name: wlan-setup-oauth
+  dataFrom:
+    - sourceRef:
+        generatorRef:
+          apiVersion: generators.external-secrets.io/v1alpha1
+          kind: Password
+          name: wlan-setup-oauth
@@ -0,0 +1,163 @@
+# wlan.renner.uno: setup page for the 802.1X WLAN "Renner UniFi" (Apple
+# profile, Windows import file, Linux nmcli command, Android Passpoint profile
+# with its own app password; config and files in wlan-setup-config.yaml).
+# Public, so a device can reach it before it is in the WLAN (mobile data,
+# Renner Gast). Any Authentik user passes the gate (no group); the page stores
+# no user credentials.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: wlan-setup
+  namespace: authentik
+  labels:
+    app.kubernetes.io/name: wlan-setup
+  annotations:
+    configmap.reloader.stakater.com/reload: wlan-setup
+    secret.reloader.stakater.com/reload: wlan-setup-oauth
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: wlan-setup
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: wlan-setup
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 101
+        runAsGroup: 101
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: nginx
+          image: nginxinc/nginx-unprivileged:1.31-alpine@sha256:b5047b9b76845eac124358373c6852377c52e4b05834a47647e955dd91cb8f1e
+          env:
+            # Client secret of the "WLAN setup" OAuth2 provider (passpoint.js).
+            - name: WLAN_SETUP_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: wlan-setup-oauth
+                  key: client_secret
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          resources:
+            requests:
+              cpu: 5m
+              memory: 16Mi
+            limits:
+              memory: 64Mi
+          volumeMounts:
+            # subPath: replaced on rollout, which the reloader annotation
+            # triggers on every ConfigMap change.
+            - name: main
+              mountPath: /etc/nginx/nginx.conf
+              subPath: nginx.conf
+              readOnly: true
+            - name: config
+              mountPath: /etc/nginx/conf.d
+              readOnly: true
+            - name: njs
+              mountPath: /etc/nginx/njs
+              readOnly: true
+            - name: html
+              mountPath: /usr/share/nginx/html
+              readOnly: true
+            # pid file and temp paths of the unprivileged image.
+            - name: tmp
+              mountPath: /tmp
+      volumes:
+        - name: main
+          configMap:
+            name: wlan-setup
+            items:
+              - key: nginx.conf
+                path: nginx.conf
+        - name: config
+          configMap:
+            name: wlan-setup
+            items:
+              - key: default.conf
+                path: default.conf
+        - name: njs
+          configMap:
+            name: wlan-setup
+            items:
+              - key: passpoint.js
+                path: passpoint.js
+        - name: html
+          configMap:
+            name: wlan-setup
+            items:
+              - key: index.html
+                path: index.html
+              - key: renner-unifi-wlan.cmd
+                path: renner-unifi-wlan.cmd
+        - name: tmp
+          emptyDir:
+            medium: Memory
+            sizeLimit: 16Mi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: wlan-setup
+  namespace: authentik
+  labels:
+    app.kubernetes.io/name: wlan-setup
+spec:
+  ipFamilyPolicy: PreferDualStack
+  selector:
+    app.kubernetes.io/name: wlan-setup
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+      protocol: TCP
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: wlan-setup
+  namespace: authentik
+  labels:
+    # Public: Cloudflare CNAME → NetBird proxy → Traefik.
+    dns.renner.uno/public: "true"
+    netbird.renner.uno/public: "true"
+  annotations:
+    traefik.ingress.kubernetes.io/router.middlewares: authentik-gate@kubernetescrd
+    cert-manager.io/cluster-issuer: letsencrypt-cluster
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - wlan.renner.uno
+      secretName: wlan-setup-tls
+  rules:
+    - host: wlan.renner.uno
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: wlan-setup
+                port:
+                  number: 80
@@ -64,7 +64,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: shelly-manager
-          image: gitea.renner.uno/konairius/shelly-manager:2026-11-02-1412 # {"$imagepolicy": "flux-system:shelly-manager"}
+          image: gitea.renner.uno/konairius/shelly-manager:2026-11-05-0732 # {"$imagepolicy": "flux-system:shelly-manager"}
          imagePullPolicy: IfNotPresent
          ports:
            - name: http
@@ -128,7 +128,7 @@ spec:
              memory: 32Mi
      containers:
        - name: home-assistant
-          image: ghcr.io/home-assistant/home-assistant:2026.10.4 # {"$imagepolicy": "flux-system:home-assistant"}
+          image: ghcr.io/home-assistant/home-assistant:2026.11.0 # {"$imagepolicy": "flux-system:home-assistant"}
          env:
            - name: TZ
              value: Europe/Berlin
@@ -32,7 +32,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: immich-machine-learning
-          image: ghcr.io/immich-app/immich-machine-learning:v3.3.5 # {"$imagepolicy": "flux-system:immich-machine-learning"}
+          image: ghcr.io/immich-app/immich-machine-learning:v3.3.6 # {"$imagepolicy": "flux-system:immich-machine-learning"}
          ports:
            - name: http
              containerPort: 3003
@@ -87,7 +87,7 @@ spec:
              mountPath: /ca
      containers:
        - name: immich-server
-          image: ghcr.io/immich-app/immich-server:v3.3.5 # {"$imagepolicy": "flux-system:immich-server"}
+          image: ghcr.io/immich-app/immich-server:v3.3.6 # {"$imagepolicy": "flux-system:immich-server"}
          ports:
            - name: http
              containerPort: 3001
@@ -134,7 +134,7 @@ spec:
        # is a device-bricking class of risk. Bumps are a reviewed, manual
        # act — see kubernetes/infrastructure/image-automation/README.md.
        - name: terminus
-          image: ghcr.io/usetrmnl/terminus:0.79.0 # {"$imagepolicy": "flux-system:terminus"}
+          image: ghcr.io/usetrmnl/terminus:0.80.0 # {"$imagepolicy": "flux-system:terminus"}
          ports:
            - name: http
              containerPort: 2345
@@ -197,7 +197,7 @@ spec:
            capabilities:
              drop: ["ALL"]
        - name: sidekiq
-          image: ghcr.io/usetrmnl/terminus:0.79.0 # {"$imagepolicy": "flux-system:terminus"}
+          image: ghcr.io/usetrmnl/terminus:0.80.0 # {"$imagepolicy": "flux-system:terminus"}
          command: ["bundle", "exec", "sidekiq", "-r", "./config/sidekiq.rb"]
          envFrom:
            - configMapRef:
@@ -95,19 +95,20 @@ spec:
      # VLAN-tagged frames, accounted as "VLAN traffic disallowed by VLAN
      # filter" in cilium_drop_count_total.
      #
-      # Only VLAN 30 (v30iot) needs listing. Cilium attaches to devices that
-      # carry an address, so it sees mgmt0's frames already untagged by the
-      # 8021q layer — nothing for a VLAN filter to match. ens19 is deliberately
-      # address-less, so its frames only meet the filter on the shared parent,
-      # still tagged. Adding 40 would change nothing and would touch the
-      # datapath carrying etcd and the API.
+      # Only the address-less macvlan parents need listing: VLAN 30 (ens19,
+      # v30iot) and VLAN 11 (radius0, freeradius-udm). Cilium attaches to
+      # devices that carry an address, so it sees mgmt0's frames already
+      # untagged by the 8021q layer — nothing for a VLAN filter to match.
+      # ens19 and radius0 are deliberately address-less, so their frames only
+      # meet the filter on the shared parent, still tagged. Adding 40 would
+      # change nothing and would touch the datapath carrying etcd and the API.
      #
      # The symptom when this is wrong is not a DHCP timeout: a tc-layer drop
      # reaches an AF_PACKET sender as ENOBUFS, so the CNI dhcp plugin reports
      # "no buffer space available" (#592).
      #
      # Same three-copy problem as policyMapMax above. Takes an agent restart.
-      vlanBypass: [30]
+      vlanBypass: [30, 11]
      # Let pods reach the cluster's own LoadBalancer external IPs; Cilium
      # redirects the socket directly to the backend pod instead of sending
      # traffic out to the VIP and back (which fails with L2 announcements).
@@ -8,6 +8,10 @@ machine:
    # 10.2.30.0/24 route makes node replies bypass the UDM and breaks every
    # DNATed flow.
    net.ipv6.conf.ens19.disable_ipv6: "1"
+    # radius0 (VLAN 11) is LINK ONLY as well: the macvlan parent for the
+    # FreeRADIUS attachment. VLAN 11 announces RAs; the node must not
+    # autoconfigure from them.
+    net.ipv6.conf.radius0.disable_ipv6: "1"
    # These two sit on the untagged fallback network, where nothing may run.
    # Left enabled they autoconfigure a ULA and an IPv6 default route from its
    # RAs, which ties with mgmt0's and costs the cluster IPv6 egress.
@@ -168,6 +172,17 @@ vlanID: 30
 parent: uplink
 up: true
 ---
+# VLAN 11, UniFi "(11) RADIUS": link only, no addresses, no DHCP. Macvlan
+# parent of the freeradius-udm attachment
+# (kubernetes/apps/authentik/freeradius-network-attachment.yaml), which names
+# it as `master`; renaming this link means editing that too.
+apiVersion: v1alpha1
+kind: VLANConfig
+name: radius0
+vlanID: 11
+parent: uplink
+up: true
+---
 # Pod network, VLAN 48. Node-to-node only: the VXLAN overlay rides it once the
 # kubelet node IP moves here, and nothing on it is routed off the switch.
 #
@@ -7,6 +7,8 @@ machine:
    # macvlan parent for the v30iot pod attachments; host addresses on that L2
    # make node replies bypass the UDM and break every UDM-DNATed flow.
    net.ipv6.conf.ens19.disable_ipv6: "1"
+    # radius0 (VLAN 11): link only — see k8s-1.yaml.
+    net.ipv6.conf.radius0.disable_ipv6: "1"
    # Same for the physical ports on the untagged fallback network: left
    # enabled they take an IPv6 default route from its RAs and cost the
    # cluster IPv6 egress.
@@ -115,6 +117,14 @@ vlanID: 30
 parent: uplink
 up: true
 ---
+# VLAN 11, "(11) RADIUS": link only, no host addressing — see k8s-1.yaml.
+apiVersion: v1alpha1
+kind: VLANConfig
+name: radius0
+vlanID: 11
+parent: uplink
+up: true
+---
 # Pod network, VLAN 48. Node-to-node only, statically addressed, no gateway
 # and no DHCP — see k8s-1.yaml.
 apiVersion: v1alpha1
@@ -4,6 +4,8 @@ machine:
  sysctls:
    # v30iot NIC carries no host addressing — see k8s-1.yaml.
    net.ipv6.conf.ens19.disable_ipv6: "1"
+    # radius0 (VLAN 11): link only — see k8s-1.yaml.
+    net.ipv6.conf.radius0.disable_ipv6: "1"
    # Same for the physical ports on the untagged fallback network — see
    # k8s-1.yaml.
    net.ipv6.conf.uplink.disable_ipv6: "1"
@@ -102,6 +104,14 @@ vlanID: 30
 parent: uplink
 up: true
 ---
+# VLAN 11, "(11) RADIUS": link only, no host addressing — see k8s-1.yaml.
+apiVersion: v1alpha1
+kind: VLANConfig
+name: radius0
+vlanID: 11
+parent: uplink
+up: true
+---
 # Pod network, VLAN 48. Node-to-node only, statically addressed, no gateway
 # and no DHCP — see k8s-1.yaml.
 apiVersion: v1alpha1
@@ -7,7 +7,8 @@
    "flux",
    "kubernetes",
    "woodpecker",
-    "dockerfile"
+    "dockerfile",
+    "custom.regex"
  ],
  "ignorePaths": [
    "kubernetes/clusters/homelab/flux-system/**",
@@ -23,6 +24,20 @@
      "/^kubernetes/.+\\.ya?ml$/"
    ]
  },
+  "customManagers": [
+    {
+      "customType": "regex",
+      "description": "Container images of the Ansible roles: `edge_<name>_image: <image>:<tag>@<digest>` in ansible/roles/*/defaults/main.yml. No other manager reads these files.",
+      "managerFilePatterns": [
+        "/^ansible/roles/[^/]+/defaults/main\\.ya?ml$/"
+      ],
+      "matchStrings": [
+        "(?:^|\\n)edge_[a-z0-9_]+_image:[ \\t]*[\"']?(?<depName>[^\\s:@\"']+):(?<currentValue>[^\\s@\"']+)(?:@(?<currentDigest>sha256:[a-f0-9]{64}))?"
+      ],
+      "datasourceTemplate": "docker",
+      "versioningTemplate": "docker"
+    }
+  ],
  "packageRules": [
    {
      "description": "Flux image automation (kubernetes/infrastructure/image-automation) already bumps these images. Renovate must not open a second, competing update. Keep this list equal to the ImageRepository images there.",
@@ -134,6 +149,20 @@
      "groupName": "CI non-major",
      "groupSlug": "ci-minor-patch"
    },
+    {
+      "description": "Edge-host images (ansible/): no pipeline deploys them, the play runs from a workstation after the merge. One PR of its own, so the merge and the play run go together.",
+      "matchFileNames": [
+        "ansible/**"
+      ],
+      "matchUpdateTypes": [
+        "patch",
+        "minor",
+        "digest",
+        "pin"
+      ],
+      "groupName": "edge hosts (ansible)",
+      "groupSlug": "edge-hosts-ansible"
+    },
    {
      "description": "Stateful apps and the CNI: one PR each, never in a group (REN-315). A git revert does not undo a DB migration or a CNI change, so each needs its own review and, where it can disrupt the cluster, a window.",
      "matchUpdateTypes": [
@@ -7,9 +7,11 @@ tests/radius/run.sh
 Runs the production FreeRADIUS config from
 `kubernetes/apps/authentik/freeradius-config.yaml` (rendered through the
 projected volume in `freeradius.yaml`, same image, args and secret env names)
-in Docker against a mock authentik outpost, and drives it with `eapol_test`
-(EAP-TTLS, inner PAP) as a NAS in the test client ranges `10.2.50.0/24` and
-`fd02:50::/64`. The v6 cases (`v6-*`) hit the IPv6 listeners and client `test6`.
+in Docker against a mock authentik outpost and a mock UDM RADIUS, and drives
+it with `eapol_test` (EAP-TTLS, inner PAP) as a NAS in the test client ranges
+`10.2.50.0/24` and `fd02:50::/64`. The v6 cases (`v6-*`) hit the IPv6
+listeners and client `test6`. Cases use outer identity `anonymous` unless
+noted.

 | Case | Expected |
 |---|---|
@@ -17,12 +19,25 @@ in Docker against a mock authentik outpost, and drives it with `eapol_test`
 | `vlan-avpair` (outpost sends only `Cisco-AV-Pair = "dot1x-vlan=50"`) | SUCCESS, Tunnel-* VLAN 50, no Cisco-AV-Pair |
 | `novlan` (Accept without VLAN) | FAILURE (Access-Reject) |
 | wrong password / unknown user (Reject without Message-Authenticator) | FAILURE (Access-Reject) within 1 s |
-| Accounting-Request | answered locally, nothing sent to the outpost |
+| Accounting-Request | answered locally, nothing sent to the outpost or the UDM |
+| `anon-realm` (outer identity `Anonymous@Example.Org`) | local TTLS, as `vlan-tunnel` |
+| `udm-accept`, `v6-udm-accept` (outer identity = account name) | both EAP rounds reach the mock UDM (second with its `State`); its Access-Accept reaches the NAS with Tunnel-* VLAN 200 and MS-MPPE keys unchanged |
+| `udm-reject` | the mock UDM's Access-Reject reaches the NAS within 1 s |
+| all `anonymous` cases | never reach the mock UDM |
+| `recovery` | outpost stalls until marked dead, then returns: login succeeds within 20 s |

 Pieces:

 - `mock_outpost.py`: stand-in outpost on UDP 1812, reachable under the
  outpost Service FQDN through a Docker network alias.
+- `mock_udm.py`: stand-in UDM RADIUS at the `udm` home server address from
+  `proxy.conf` (`10.2.11.1`), on a second internal bridge `radtest-udm` (that
+  address's /24, no host address). FreeRADIUS gets a second interface there,
+  as `net1` in the pod: only the connected /24, no default route, and the
+  proxy socket picks it by route lookup. The macvlan/DHCP attachment itself
+  is not tested. Answers round 1 with Challenge + `State` +
+  EAP-TTLS Start (or Reject for `endpoint-reject`), round 2 with Accept +
+  EAP-Success; terminates no EAP.
 - `eapol.Dockerfile`: `eapol_test` from Debian `eapoltest`.
 - Docker network `radtest`: internal bridge on `10.2.50.0/24` and
  `fd02:50::/64` with no host address (`inhibit_ipv4`,
@@ -15,7 +15,6 @@ import socket
 import struct

 SECRET = os.environ["MOCK_SECRET"].encode()
-PASSWORD = os.environ["MOCK_PASSWORD"].encode()

 ACCESS_REQUEST, ACCESS_ACCEPT, ACCESS_REJECT = 1, 2, 3
 ATTR_USER_NAME, ATTR_USER_PASSWORD, ATTR_MESSAGE_AUTHENTICATOR = 1, 2, 80
@@ -85,6 +84,7 @@ def build_reply(code, ident, req_auth, attrs, with_ma):


 def main():
+    password = os.environ["MOCK_PASSWORD"].encode()
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.bind(("0.0.0.0", 1812))
    print("mock outpost listening on udp/1812", flush=True)
@@ -100,7 +100,7 @@ def main():
        attrs = parse_attrs(packet[20:])
        user = next((v for t, _, v in attrs if t == ATTR_USER_NAME), b"")
        enc = next((v for t, _, v in attrs if t == ATTR_USER_PASSWORD), b"")
-        password_ok = decrypt_password(enc, req_auth) == PASSWORD
+        password_ok = decrypt_password(enc, req_auth) == password
        ma = request_ma_ok(packet, attrs)
        if password_ok and user in REPLIES:
            out = build_reply(ACCESS_ACCEPT, ident, req_auth, REPLIES[user], True)
@@ -0,0 +1,120 @@
+"""Stand-in for the UDM RADIUS (UDP 1812) that UniFi Endpoint logins go to.
+
+Terminates nothing; logs what arrives and answers just enough EAP to prove
+that FreeRADIUS proxies the whole conversation:
+  round 1 (EAP-Response/Identity, no State)
+    identity endpoint-reject  Access-Reject + EAP-Failure
+    any other identity        Access-Challenge + State + EAP-Request/TTLS-Start
+  round 2 (State from round 1)
+    Access-Accept + EAP-Success, Tunnel-* VLAN 200, MS-MPPE-Recv-Key 0x11 * 32,
+    MS-MPPE-Send-Key 0x22 * 32
+  no EAP-Message (status probe), unknown State  Access-Reject
+All replies carry Message-Authenticator and echo Proxy-State.
+"""
+
+import hashlib
+import os
+import socket
+import struct
+
+from mock_outpost import ATTR_USER_NAME, attr, build_reply, parse_attrs, request_ma_ok, vsa
+
+SECRET = os.environ["MOCK_SECRET"].encode()
+
+ACCESS_REQUEST, ACCESS_ACCEPT, ACCESS_REJECT, ACCESS_CHALLENGE = 1, 2, 3, 11
+ATTR_STATE, ATTR_PROXY_STATE, ATTR_EAP_MESSAGE = 24, 33, 79
+EAP_REQUEST, EAP_RESPONSE, EAP_SUCCESS, EAP_FAILURE = 1, 2, 3, 4
+EAP_IDENTITY, EAP_TTLS = 1, 21
+
+STATE = b"udm-mock-state-1"
+RECV_KEY = b"\x11" * 32
+SEND_KEY = b"\x22" * 32
+TUNNEL_VLAN_200 = (
+    attr(64, b"\x00\x00\x00\x0d")  # Tunnel-Type = VLAN
+    + attr(65, b"\x00\x00\x00\x06")  # Tunnel-Medium-Type = IEEE-802
+    + attr(81, b"200")  # Tunnel-Private-Group-Id = "200"
+)
+
+
+def mppe_key(key, req_auth, salt):
+    """RFC 2548 2.4.2 encryption of an MS-MPPE key."""
+    plain = bytes([len(key)]) + key
+    plain += b"\x00" * (-len(plain) % 16)
+    out, last = b"", req_auth + salt
+    for i in range(0, len(plain), 16):
+        b = hashlib.md5(SECRET + last).digest()
+        chunk = bytes(p ^ k for p, k in zip(plain[i : i + 16], b))
+        out += chunk
+        last = chunk
+    return salt + out
+
+
+def eap(code, ident, payload=b""):
+    return struct.pack("!BBH", code, ident, 4 + len(payload)) + payload
+
+
+def main():
+    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+    sock.bind(("0.0.0.0", 1812))
+    print("mock udm listening on udp/1812", flush=True)
+    while True:
+        packet, peer = sock.recvfrom(4096)
+        if len(packet) < 20:
+            continue
+        code, ident, _length = struct.unpack("!BBH", packet[:4])
+        req_auth = packet[4:20]
+        if code != ACCESS_REQUEST:
+            print(f"peer={peer[0]} code={code} ignored", flush=True)
+            continue
+        attrs = parse_attrs(packet[20:])
+        user = next((v for t, _, v in attrs if t == ATTR_USER_NAME), b"").decode(errors="replace")
+        state = next((v for t, _, v in attrs if t == ATTR_STATE), None)
+        eap_msg = b"".join(v for t, _, v in attrs if t == ATTR_EAP_MESSAGE)
+        echo = b"".join(attr(ATTR_PROXY_STATE, v) for t, _, v in attrs if t == ATTR_PROXY_STATE)
+        ma = request_ma_ok(packet, attrs)
+
+        if len(eap_msg) < 5:
+            reply = build_reply(ACCESS_REJECT, ident, req_auth, echo, True)
+            print(f"peer={peer[0]} probe user={user} request_ma={ma} -> reject", flush=True)
+        elif state is None:
+            eap_id = eap_msg[1]
+            eap_ok = eap_msg[0] == EAP_RESPONSE and eap_msg[4] == EAP_IDENTITY
+            identity = eap_msg[5:].decode(errors="replace")
+            if identity == "endpoint-reject":
+                body = attr(ATTR_EAP_MESSAGE, eap(EAP_FAILURE, eap_id))
+                reply = build_reply(ACCESS_REJECT, ident, req_auth, echo + body, True)
+                result = "reject"
+            else:
+                body = attr(ATTR_STATE, STATE) + attr(
+                    ATTR_EAP_MESSAGE, eap(EAP_REQUEST, (eap_id + 1) & 0xFF, bytes([EAP_TTLS, 0x20]))
+                )
+                reply = build_reply(ACCESS_CHALLENGE, ident, req_auth, echo + body, True)
+                result = "challenge"
+            print(
+                f"peer={peer[0]} round=1 user={user} eap_identity_response={eap_ok} "
+                f"eap_identity={identity} request_ma={ma} -> {result}",
+                flush=True,
+            )
+        elif state == STATE:
+            eap_id = eap_msg[1]
+            eap_type = eap_msg[4]
+            body = (
+                TUNNEL_VLAN_200
+                + vsa(311, 17, mppe_key(RECV_KEY, req_auth, b"\x80\x01"))
+                + vsa(311, 16, mppe_key(SEND_KEY, req_auth, b"\x80\x02"))
+                + attr(ATTR_EAP_MESSAGE, eap(EAP_SUCCESS, eap_id))
+            )
+            reply = build_reply(ACCESS_ACCEPT, ident, req_auth, echo + body, True)
+            print(
+                f"peer={peer[0]} round=2 user={user} state_ok=True eap_type={eap_type} "
+                f"request_ma={ma} -> accept",
+                flush=True,
+            )
+        else:
+            reply = build_reply(ACCESS_REJECT, ident, req_auth, echo, True)
+            print(f"peer={peer[0]} user={user} state={state.hex()} unknown -> reject", flush=True)
+        sock.sendto(reply, peer)
+
+
+if __name__ == "__main__":
+    main()
@@ -10,6 +10,7 @@ deploy="$app/freeradius.yaml"
 config="$app/freeradius-config.yaml"

 net=radtest
+net_udm=radtest-udm
 # test client ranges from clients.conf
 subnet=10.2.50.0/24
 subnet6=fd02:50::/64
@@ -32,7 +33,10 @@ cleanup() {
  local ids=()
  mapfile -t ids < <(docker ps -aq --filter name='^radtest-')
  if ((${#ids[@]} > 0)); then docker rm -f "${ids[@]}" >/dev/null; fi
-  if [[ -n "$(docker network ls -q --filter name="^${net}\$")" ]]; then docker network rm "$net" >/dev/null; fi
+  local n
+  for n in "$net" "$net_udm"; do
+    if [[ -n "$(docker network ls -q --filter name="^${n}\$")" ]]; then docker network rm "$n" >/dev/null; fi
+  done
  local vols=()
  mapfile -t vols < <(docker volume ls -q --filter name='^radtest-')
  if ((${#vols[@]} > 0)); then docker volume rm "${vols[@]}" >/dev/null; fi
@@ -147,14 +151,26 @@ start() {
  docker network create --internal --subnet "$subnet" --ipv6 --subnet "$subnet6" \
    -o com.docker.network.bridge.inhibit_ipv4=true \
    -o com.docker.network.bridge.gateway_mode_ipv6=isolated "$net" >/dev/null
-  local bridge
-  bridge="br-$(docker network inspect -f '{{printf "%.12s" .Id}}' "$net")"
-  if [[ -n "$(ip -4 -o addr show dev "$bridge")" ]] \
-    || [[ -n "$(ip -6 -o addr show dev "$bridge" scope global)" ]] \
-    || [[ -n "$(ip -6 route show dev "$bridge" "$subnet6")" ]]; then
-    echo "bridge $bridge got a host address or route in a test range; aborting" >&2
-    exit 1
-  fi
+  # UDM home server address from proxy.conf; its /24 is a second internal
+  # bridge (gateway address moved off the UDM's).
+  ip_udm="$(awk '$1 == "home_server" && $2 == "udm" {f=1} f && $1 == "ipaddr" {print $3; exit}' "$work/raddb/proxy.conf")"
+  docker network create --internal --subnet "${ip_udm%.*}.0/24" --gateway "${ip_udm%.*}.254" \
+    -o com.docker.network.bridge.inhibit_ipv4=true "$net_udm" >/dev/null
+  local bridge n
+  for n in "$net" "$net_udm"; do
+    bridge="br-$(docker network inspect -f '{{printf "%.12s" .Id}}' "$n")"
+    if [[ -n "$(ip -4 -o addr show dev "$bridge")" ]] \
+      || [[ -n "$(ip -6 -o addr show dev "$bridge" scope global)" ]] \
+      || [[ -n "$(ip -6 route show dev "$bridge" "$subnet6")" ]]; then
+      echo "bridge $bridge got a host address or route in a test range; aborting" >&2
+      exit 1
+    fi
+  done
+
+  docker run -d --name radtest-udm --network "$net_udm" --ip "$ip_udm" \
+    -e MOCK_SECRET=dummy-udm_radius_secret \
+    -v "$here/mock_outpost.py:/mock/mock_outpost.py:ro" -v "$here/mock_udm.py:/mock/mock_udm.py:ro" \
+    "$mock_image" python3 -u /mock/mock_udm.py >/dev/null

  docker run -d --name radtest-mock --network "$net" --ip "$ip_mock" \
    --network-alias "$outpost_fqdn" \
@@ -167,14 +183,14 @@ start() {

  # Same restrictions as the pod.
  mount_opts freeradius
-  local run_opts=(--network "$net" "${pod_opts[@]}" "${secret_env[@]}" "${mounts[@]}")
+  local run_opts=("${pod_opts[@]}" "${secret_env[@]}" "${mounts[@]}")
  local confdir="" i
  for i in "${!args[@]}"; do
    if [[ "${args[$i]}" == -d ]]; then confdir="${args[$((i + 1))]}"; fi
  done

  echo "--- radiusd -XC (config check)"
-  if docker run --rm "${run_opts[@]}" "$image" radiusd -XC -d "$confdir" >"$work/configcheck.log" 2>&1 \
+  if docker run --rm --network "$net" "${run_opts[@]}" "$image" radiusd -XC -d "$confdir" >"$work/configcheck.log" 2>&1 \
    && grep -q "Configuration appears to be OK" "$work/configcheck.log"; then
    pass "radiusd -XC: Configuration appears to be OK"
  else
@@ -183,7 +199,13 @@ start() {
    exit 1
  fi

-  docker run -d --name radtest-freeradius --ip "$ip_radius" --ip6 "$ip6_radius" "${run_opts[@]}" "$image" "${args[@]}" >/dev/null
+  # Interface names as in the pod: eth0 the NAS side (the listeners bind to
+  # it), net1 the UDM side. Docker attaches networks in no fixed order.
+  docker create --name radtest-freeradius "${run_opts[@]}" \
+    --network "name=$net,ip=$ip_radius,ip6=$ip6_radius,driver-opt=com.docker.network.endpoint.ifname=eth0" \
+    "$image" "${args[@]}" >/dev/null
+  docker network connect --driver-opt com.docker.network.endpoint.ifname=net1 "$net_udm" radtest-freeradius
+  docker start radtest-freeradius >/dev/null
  sleep 2
  if [[ "$(docker inspect -f '{{.State.Running}}' radtest-freeradius)" != true ]]; then
    docker logs radtest-freeradius
@@ -203,13 +225,13 @@ start() {
  fi
 }

-eapol_conf() { # case user password
+eapol_conf() { # case user password [outer-identity]
  cat >"$work/eapol/$1.conf" <<EOF
 network={
  key_mgmt=WPA-EAP
  eap=TTLS
  identity="$2"
-  anonymous_identity="anonymous"
+  anonymous_identity="${4:-anonymous}"
  password="$3"
  phase2="auth=PAP"
  ca_cert="/eapol/ca.pem"
@@ -233,9 +255,9 @@ attr_value() { # case attr-number
  accept_attrs "$1" | awk -v a="Attribute $2 " 'index($0, a){getline; sub(/^ *Value: /, ""); print; exit}'
 }

-check_accept() { # case user server
+check_accept() { # case user server [outer-identity]
  local c="$1"
-  eapol_conf "$c" "$2" "$password"
+  eapol_conf "$c" "$2" "$password" "${4:-}"
  eapol "$c" 5 "$3"
  if [[ "$(tail -n 1 "$work/$c.out")" == SUCCESS ]]; then pass "$c: SUCCESS"; else fail "$c: SUCCESS"; fi
  [[ "$(attr_value "$c" 81)" =~ ^(00)?3530$ ]] && pass "$c: Tunnel-Private-Group-Id 50" \
@@ -252,9 +274,9 @@ check_accept() { # case user server
  fi
 }

-check_reject() { # case user password timeout server
+check_reject() { # case user password timeout server [outer-identity]
  local c="$1"
-  eapol_conf "$c" "$2" "$3"
+  eapol_conf "$c" "$2" "$3" "${6:-}"
  eapol "$c" "$4" "$5"
  if [[ "$(tail -n 1 "$work/$c.out")" == FAILURE ]] && grep -q "RADIUS message: code=3 (Access-Reject)" "$work/$c.out" \
    && ! grep -q "EAPOL test timed out" "$work/$c.out"; then
@@ -264,6 +286,40 @@ check_reject() { # case user password timeout server
  fi
 }

+udm_log() { docker logs radtest-udm 2>&1; }
+
+# Non-anonymous outer identity: the whole EAP conversation goes to the mock
+# UDM, its Access-Accept reaches the NAS unchanged.
+check_udm_accept() { # case user server
+  local c="$1" u="$2"
+  eapol_conf "$c" "$u" "$password" "$u"
+  eapol "$c" 3 "$3"
+  udm_log | grep -q "round=1 user=$u eap_identity_response=True eap_identity=$u request_ma=True -> challenge" \
+    && pass "$c: EAP-Response/Identity forwarded to the UDM" || fail "$c: EAP-Response/Identity forwarded to the UDM"
+  udm_log | grep -q "round=2 user=$u state_ok=True eap_type=21 request_ma=True -> accept" \
+    && pass "$c: second round forwarded with the UDM's State" || fail "$c: second round forwarded with the UDM's State"
+  grep -q "RADIUS message: code=2 (Access-Accept)" "$work/$c.out" \
+    && pass "$c: UDM Access-Accept reaches the NAS" || fail "$c: UDM Access-Accept reaches the NAS"
+  [[ "$(attr_value "$c" 81)" =~ ^(00)?323030$ ]] && pass "$c: Tunnel-Private-Group-Id 200" \
+    || fail "$c: Tunnel-Private-Group-Id 200 (got '$(attr_value "$c" 81)')"
+  [[ "$(attr_value "$c" 64)" == 0000000d ]] && pass "$c: Tunnel-Type VLAN" \
+    || fail "$c: Tunnel-Type VLAN (got '$(attr_value "$c" 64)')"
+  [[ "$(attr_value "$c" 65)" == 00000006 ]] && pass "$c: Tunnel-Medium-Type IEEE-802" \
+    || fail "$c: Tunnel-Medium-Type IEEE-802 (got '$(attr_value "$c" 65)')"
+  local k
+  for k in "Recv-Key (crypt)|11" "Send-Key (sign)|22"; do
+    grep -qF "MS-MPPE-${k%|*} - hexdump(len=32): $(printf "${k#*|} %.0s" {1..31})${k#*|}" "$work/$c.out" \
+      && pass "$c: MS-MPPE-${k%% *} unchanged" || fail "$c: MS-MPPE-${k%% *} unchanged"
+  done
+}
+
+check_udm_reject() { # case user server
+  local c="$1" u="$2"
+  check_reject "$c" "$u" "$password" 1 "$3" "$u"
+  udm_log | grep -q "round=1 user=$u eap_identity_response=True eap_identity=$u request_ma=True -> reject" \
+    && pass "$c: decided by the UDM" || fail "$c: decided by the UDM"
+}
+
 check_accounting() { # case server
  printf 'Acct-Status-Type = Start\nUser-Name = "acct-test"\nAcct-Session-Id = "%s"\n' \
    "$1" >"$work/eapol/$1.txt"
@@ -338,6 +394,13 @@ main() {
  check_reject unknown-user bad "$password" 1 "$ip_radius"
  check_accounting acct "$ip_radius"

+  # Outer identity routing: anonymous[@realm] (any case) -> local TTLS,
+  # anything else -> UDM.
+  check_accept anon-realm vlan-tunnel "$ip_radius" "Anonymous@Example.Org"
+  check_udm_accept udm-accept endpoint-accept "$ip_radius"
+  check_udm_reject udm-reject endpoint-reject "$ip_radius"
+  check_udm_accept v6-udm-accept v6-endpoint-accept "$ip6_radius"
+
  # IPv6 listeners and clients
  check_accept v6-vlan-avpair vlan-avpair "$ip6_radius"
  check_reject v6-novlan novlan "$password" 5 "$ip6_radius"
@@ -353,9 +416,16 @@ main() {
    pass "no accounting forwarded to the outpost"
  fi

+  if udm_log | grep -Eiq "eap_identity=anonymous|user=(vlan-|novlan|bad|anonymous)|code=4"; then
+    fail "anonymous logins and accounting never reach the UDM"
+  else
+    pass "anonymous logins and accounting never reach the UDM"
+  fi
+
  if ((fails > 0)) || [[ "${RADTEST_DEBUG:-0}" == 1 ]]; then
    echo "--- freeradius log"; docker logs radtest-freeradius 2>&1
    echo "--- mock outpost log"; docker logs radtest-mock 2>&1
+    echo "--- mock udm log"; udm_log
    for o in "$work"/*.out; do echo "--- $(basename "$o")"; cat "$o"; done
  fi
  echo
Author	SHA1	Message	Date
claude-botandClaude Opus 5.5	6c2c278f65	feat(radius): log WLAN app password renewals ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-05 13:16:27 +01:00
claude-botandClaude Opus 5.5	21625685b4	feat(radius): WLAN app passwords expire 60 days after last use ci/woodpecker/pr/ci-scripts-test Pipeline failed Details ci/woodpecker/pr/ci-manifests-test Pipeline was canceled Details New app passwords start with 29 days (below the 30-day API cap, so no group attribute is needed). The expression policy dot1x-app-password-renew, re-evaluated on the dot1x-login binding, renews the app password that TokenBackend matched to 60 days on each 802.1X login (at most one write per day; always passes, failure_result true). authentik rejects expired app passwords and deletes them in clean_expired_models (every 5 min). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-05 13:11:12 +01:00
claude-botandClaude Opus 5.5	29da21c28f	docs(radius): app password lifetime cap is 30 days without the attribute ci/woodpecker/pr/ci-scripts-test Pipeline is pending Details ci/woodpecker/pr/ci-manifests-test Pipeline was canceled Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-05 13:05:27 +01:00
claude-botandClaude Opus 5.5	c781e263fc	fix(radius): wlan-setup authentik subrequests take large replies ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was canceled Details - subrequest_output_buffer_size 256k: users/me with groups, avatar and permissions exceeds the one-page default and was cut off. - proxy_pass_request_headers off: browser headers (Accept-Encoding, User-Agent, X-authentik-*) no longer reach authentik. - Random suffix on the app password identifier, so two installs in the same second do not collide. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-05 13:02:10 +01:00
claude-botandClaude Opus 5.5	b1be3181ef	feat(radius): Android WLAN profile with a per-device app password ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details wlan.renner.uno signs the user in through the new authentik OAuth2 application wlan-setup (confidential, scope goauthentik.io/api). The callback exchanges the code (client_secret_basic), creates an app password with the user's own access token (10 years) and returns the Passpoint profile carrying it in the response to the user's GET. The page asks for no password and stores nothing; deleting the app password in authentik removes the device. - dot1x-password stage also accepts app passwords (TokenBackend). - Client secret: ESO Password generator wlan-setup-oauth, read by the authentik worker (blueprint) and by wlan-setup. - authentik calls go through an internal nginx location; headers come from $arg_* because subrequests share the parent's variable cache. - Reloader annotations on the wlan-setup Deployment metadata. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-05 12:52:09 +01:00
k.renner	08b087337e	Merge pull request 'feat(radius): Android Passpoint profile on the WLAN setup page' (#1565 ) from feat/wlan-setup-passpoint into main ci/woodpecker/cron/e2e Pipeline failed Details ci/woodpecker/cron/security-scan Pipeline was successful Details Reviewed-on: #1565 Reviewed-by: Review Bot <review-bot@renner.uno>	2026-11-05 10:37:22 +00:00
claude-botandClaude Opus 5.5	8610853a6b	feat(radius): serve the Android Passpoint profile from nginx ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details Android starts its Passpoint installer only for a profile fetched with a user-triggered GET and Content-Type application/x-wifi-config; a browser-generated blob does not qualify. The page now POSTs the password to /android/prepare, where njs builds the profile and stores it in a shared dict (120 s, bound to the caller's username) under a random token; the link /android/profile/<token> delivers it once. AAAServerTrustedNames moves under Extension/Android, the only place Android's PpsMoParser accepts it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-05 11:32:21 +01:00
claude-botandClaude Opus 5.5	1b724ef114	feat(radius): Android Passpoint profile on the WLAN setup page ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details The Android section takes the password, builds a Passpoint R1 profile (application/x-wifi-config: PPS MO with HomeSP FQDN and realm renner.uno, EAP-TTLS with inner PAP, AAA server name radius.renner.uno, ISRG Root X1 as trust anchor) in the browser and hands it to Android as a blob. The password is not sent to any server. Matches WLANs that advertise Hotspot 2.0 with domain and NAI realm renner.uno. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-05 10:52:51 +01:00
k.renner	ee1a421dc0	Merge pull request 'feat(radius): WLAN setup page wlan.renner.uno for "Renner UniFi"' (#1564 ) from feat/wlan-setup-page into main Reviewed-on: #1564 Reviewed-by: Review Bot <review-bot@renner.uno>	2026-11-05 09:02:04 +00:00
claude-botandClaude Opus 5.5	1e66d793d5	feat(radius): WLAN setup page wlan.renner.uno for "Renner UniFi" ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details nginx behind the Authentik gate (any user, public) serving: - Apple profile (TTLS/PAP, outer identity anonymous, trusted server name radius.renner.uno) with the caller's username from X-authentik-username, - a Windows .cmd that imports the WLAN profile via netsh (TTLS/PAP, server name radius.renner.uno, trust anchor ISRG Root X1), - the Linux nmcli command. No file carries a password. Usernames outside [A-Za-z0-9._@+-] are left blank instead of being put into a generated file. The Renner Test profile is removed; that SSID no longer exists. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-05 09:56:10 +01:00
security-bot	0996609ce4	chore(image-automation): bump gitea.renner.uno/konairius/shelly-manager:2026-11-05-0732 Updates managed by image-automation-controller.	2026-11-05 07:51:27 +00:00
k.renner	4b27a5f273	Merge pull request 'chore(ci): bump ci-claude image to 2.1.318' (#1563 ) from ci-image/claude-2.1.318 into main Reviewed-on: #1563	2026-11-05 07:36:53 +00:00
claude-bot	ea195d0e4f	chore(ci): bump ci-claude image to 2.1.318 ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details	2026-11-05 07:31:22 +00:00
k.renner	1ae259e474	Merge pull request 'chore(deps): update node.js to v26' (#1546 ) from renovate/node-26.x into main ci/woodpecker/push/build-ci-images Pipeline was successful Details ci/woodpecker/push/ci-claude-refresh Pipeline was successful Details Reviewed-on: #1546	2026-11-05 07:29:19 +00:00
k.renner	796d8459b6	Merge pull request 'fix(zwave-gateway): zwave-js-ui 11.25.2 (Server-Schema 51), Renovate für edge_*_image' (#1562 ) from fix/zwave-js-ui-11.25.2-renovate into main Reviewed-on: #1562 Reviewed-by: Review Bot <review-bot@renner.uno>	2026-11-04 20:54:36 +00:00
security-bot	a6be8247eb	chore(image-automation): bump ghcr.io/usetrmnl/terminus:0.80.0 Updates managed by image-automation-controller.	2026-11-04 20:51:49 +00:00
hermes-bot	826042f3ea	fix(zwave-gateway): zwave-js-ui 11.25.2, Renovate for edge images ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details Home Assistant 2026.11.0 requires Z-Wave JS Server schema 51. zwave-js-ui 11.21.1 ships @zwave-js/server 3.10 (schema 50), so the zwave_js entry is stuck in setup_retry. 11.24.2 is the first release on @zwave-js/server ^3.11.0 (schema 51); bump to the current 11.25.2, pinned by digest. 11.25.2 is built on Alpine 3.23 (was 3.22). The role now reads the Alpine release from the image and names the musl libeatmydata.so after it, instead of a hand-synced edge_zwave_alpine_base: Renovate bumps the image from now on, and the old `creates:` never refreshed the .so. Builds for other Alpine releases are removed. Renovate never read ansible/roles//defaults/main.yml: enabledManagers had no custom.regex and there were no customManagers. Add one for edge_<name>_image (docker datasource and versioning), and give ansible/* updates their own PR, since the play runs from a workstation after the merge (no Ansible pipeline since `0c1fb0a2`).	2026-11-04 20:46:03 +00:00
security-bot	aa2543369c	chore(image-automation): bump ghcr.io/immich-app/immich-server:v3.3.6 Updates managed by image-automation-controller.	2026-11-04 18:24:23 +00:00
security-bot	5add98190f	chore(image-automation): bump ghcr.io/immich-app/immich-machine-learning:v3.3.6 Updates managed by image-automation-controller.	2026-11-04 18:18:59 +00:00
security-bot	1643b305b2	chore(image-automation): bump ghcr.io/home-assistant/home-assistant:2026.11.0 Updates managed by image-automation-controller.	2026-11-04 17:55:55 +00:00
k.renner	657e3d0d92	Merge pull request 'feat(radius): proxy UniFi Endpoint logins to the UDM over VLAN 11' (#1561 ) from feat/radius-proxy-vlan11 into main Reviewed-on: #1561	2026-11-04 14:10:09 +00:00
k.renner	ac2d5d13a1	Merge pull request 'feat(network): VLAN 11 link radius0 on the nodes, Cilium VLAN bypass' (#1560 ) from feat/vlan11-radius0-base into main Reviewed-on: #1560	2026-11-04 14:07:19 +00:00
claude-botandClaude Opus 5.5	ed3be3156b	feat(network): VLAN 11 link radius0 on the nodes, Cilium VLAN bypass ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details VLAN 11 "(11) RADIUS" carries the FreeRADIUS proxy traffic to the UDM RADIUS, which accepts clients from its own networks only. - Talos k8s-{1,2,3}: VLANConfig radius0 (VLAN 11 on uplink), link only, no addresses, IPv6 disabled (VLAN 11 sends RAs). - Cilium bpf.vlanBypass [30, 11]: radius0 is address-less like ens19, so its tagged frames meet the VLAN filter on uplink (#592). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-04 15:05:23 +01:00
claude-botandClaude Opus 5.5	05d2fcac71	feat(radius): proxy UniFi Endpoint logins to the UDM over VLAN 11 ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details The UDM RADIUS rejects the pod CIDR as an unknown client; it accepts 10.2.11.0/24. FreeRADIUS pods get net1 on VLAN 11 "(11) RADIUS" and the udm home server moves to 10.2.11.1. - Talos k8s-{1,2,3}: VLANConfig radius0 (VLAN 11 on uplink), no addresses, IPv6 disabled on the host link. - Cilium bpf.vlanBypass gains 11: radius0 is address-less like ens19, so its tagged frames meet the VLAN filter on uplink (#592). - NAD freeradius-udm: macvlan on radius0, DHCP IPAM requesting only subnet-mask (skipDefault), so the lease has no router and net1 holds only the connected /24. No sbr: it moves that route into a source table, and the unbound proxy socket would then reach the UDM via eth0 from the pod IP. tuning disables IPv6 on net1 (VLAN 11 sends RAs). - NAS listeners bound to eth0, so nothing listens on net1. - CNP freeradius-udm-egress removed: net1 traffic bypasses Cilium. - Harness: FreeRADIUS interfaces named eth0/net1 explicitly; Docker attaches networks in no fixed order, and the eth0 bind exposed it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-04 15:02:37 +01:00
k.renner	697856cbf8	Merge pull request 'feat(radius): forward UniFi Endpoint logins to the UDM RADIUS' (#1559 ) from feat/radius-udm-forward into main Reviewed-on: #1559 Reviewed-by: Review Bot <review-bot@renner.uno>	2026-11-04 12:20:57 +00:00
k.renner	4962af5ed1	Merge pull request 'docs(radius): UniFi objects and live login check for the 802.1X test' (#1558 ) from docs/radius-live-test into main Reviewed-on: #1558	2026-11-04 12:15:30 +00:00
claude-botandClaude Opus 5.5	bc698ea22d	feat(radius): forward non-anonymous EAP logins to the UDM RADIUS ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details Outer identity anonymous[@realm] (any case) keeps the local EAP-TTLS -> authentik path. Any other outer identity is a UniFi Endpoint account: the outer server proxies every EAP round to new home server udm (10.2.47.1:1812, UDM_RADIUS_SECRET) without local EAP processing; post-proxy/post-auth leave UDM replies untouched. Endpoint account names look like ordinary usernames, so routing keys on the anonymous identity, not a name pattern. home_server udm: response_window 5 < proxy_dedup_window 10, require_message_authenticator yes (RFC 3579, EAP replies), status_check request with a user name that cannot exist. CNP freeradius-udm-egress allows only 10.2.47.1/32 UDP 1812. Harness: mock_udm.py on a second internal bridge at the udm address from proxy.conf. Asserts both EAP rounds (State included) reach it, its Accept reaches the NAS with Tunnel-* VLAN 200 and MS-MPPE keys intact, its Reject passes, and anonymous logins and accounting never reach it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-04 13:13:07 +01:00
k.renner	73dd6f6362	Merge pull request 'perf(authentik): disable Postgres JIT, persistent DB connections' (#1557 ) from fix/authentik-pg-latency into main ci/woodpecker/cron/e2e Pipeline failed Details ci/woodpecker/cron/security-scan Pipeline was successful Details Reviewed-on: #1557	2026-11-04 08:56:56 +00:00
claude-botandClaude Opus 5.5	7434894f14	perf(authentik): disable Postgres JIT, persistent DB connections ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-04 09:52:41 +01:00
renovate-bot	335c423ca6	chore(deps): update node.js to v26 ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details	2026-11-04 03:05:56 +00:00