refactor(pacman-cache): own role instead of common

The pacman cache policy is its own concern, not base configuration of
every host. The new role pacman-cache runs in install-edge-host after
common and before docker-install; common is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.woodpecker/build-ci-images.yml

@@ -41,6 +41,7 @@ when:
       - "ci/images/**"
       - "secret-rotator/**"
       - "review-bot/**"
+      - "wlan-setup/**"
       - ".woodpecker/build-ci-images.yml"
   - event: deployment
     evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "build-ci-images"'
@@ -197,6 +198,31 @@ steps:
           --destination gitea.renner.uno/gitea_admin/review-bot:$TAG \
           --destination gitea.renner.uno/gitea_admin/review-bot:latest
 
+  # wlan-setup: the Go service behind wlan.renner.uno (802.1X/Passpoint setup page with per-device
+  # authentik app passwords). Runs after Gitea is up, so no ghcr mirror.
+  - name: build-wlan-setup
+    image: registry.gitlab.com/gitlab-ci-utils/container-images/kaniko:v1.25.20-debug@sha256:28af5a3bd9c51fedb353ad91de735eda53592b5c06a34e7f5a9550334725d7f7
+    directory: wlan-setup
+    when:
+      - event: deployment
+      - event: push
+        path: ["wlan-setup/**", ".woodpecker/build-ci-images.yml"]
+    environment:
+      GITEA_USER: gitea_admin
+      GITEA_TOKEN:
+        from_secret: ci_images_token
+    commands:
+      - mkdir -p /kaniko/.docker
+      - AUTH=$(printf '%s:%s' "$GITEA_USER" "$GITEA_TOKEN" | base64 | tr -d '\n')
+      - printf '{"auths":{"gitea.renner.uno":{"auth":"%s"}}}' "$AUTH" > /kaniko/.docker/config.json
+      - TAG=$(date +%Y-%m-%d-%H%M)
+      - |
+        /kaniko/executor \
+          --context . \
+          --dockerfile Containerfile \
+          --destination gitea.renner.uno/gitea_admin/wlan-setup:$TAG \
+          --destination gitea.renner.uno/gitea_admin/wlan-setup:latest
+
   # Runtime image, not CI tooling: a general-purpose alpine + jq base for
   # workloads that need to read JSON from a shell script. Named for what it IS,
   # not for who uses it — its first consumer is the zigbee2mqtt seed-data init

.woodpecker/wlan-setup-test.yml

@@ -0,0 +1,13 @@
+# Tests for the wlan-setup Go service (wlan-setup/). Offline: the tests run against a fake
+# authentik server, so the step needs no secret and no network beyond the module cache.
+when:
+  - event: pull_request
+    path: ["wlan-setup/**", ".woodpecker/wlan-setup-test.yml"]
+
+steps:
+  - name: go-test
+    image: golang:1.27.3-bookworm@sha256:d9b6a1beb9474adc2a1ce842573639b44b2a0dd49b6669f51d3821baf9ec37c9
+    commands:
+      - test -z "$(gofmt -l wlan-setup)"
+      - go -C wlan-setup vet ./...
+      - go -C wlan-setup test -race ./...

ansible/docs/edge-host.md

@@ -29,7 +29,7 @@ Build and boot the dedicated installer image — see
 `images/edge-host-iso/README.md`. Short version:
 
 1. `sudo pacman -S archiso && sudo images/edge-host-iso/build.sh`
-2. Write ISO to a USB stick, boot the target box from it, run `edge-install`
+2. Write ISO to a USB stick, boot the target box from it, run `edge-install <hostname>`
    (partitions the internal disk — NVMe if present, else the eMMC; the
    installer autodetects — installs the ansible-ready base system with SSH
    keys, DHCP, docker — asks for confirmation before wiping).
@@ -164,7 +164,9 @@ role keeps logs off local flash and monitors wear:
 - **Docker logs to journald** (`docker-daemon.json`, `log-driver: journald`)
   instead of unbounded json files under `/var/lib/docker/containers`. Both
   compose services inherit it; `docker logs` still works.
-- **Grafana Alloy ships the journal to Loki** (`edge-alloy.service`). Its
+- **Grafana Alloy ships the journal to Loki** (`edge-alloy.service`, which
+  runs the upstream `grafana/alloy` image with `/run/log/journal` mounted
+  read-only; Arch's `grafana-alloy` package has no `loki.source.journal`). Its
   WAL/positions sit on `/run/alloy` (tmpfs), so the agent writes nothing to
   the eMMC either. Net effect: no log writes hit local flash — the trade-off
   is that logs are RAM-only and lost on reboot unless already shipped.

ansible/inventory/pve_hosts.yml

@@ -22,6 +22,7 @@ proxy-2.renner.uno ansible_host=proxy-2.nb.renner.uno ansible_user=root
 # sub-interface. Nothing here assumes any peripheral is attached.
 [edge_host]
 edge-1.iot.renner.uno ansible_user=root
+edge-2.iot.renner.uno ansible_user=root
 
 # Synology NAS (DSM): nas-1 RS1221+ on site, nas-2 DS1522+ off site.
 [synology_nas]
@@ -73,6 +74,7 @@ proxy-1.renner.uno
 proxy-2.renner.uno
 netbird.renner.uno
 edge-1.iot.renner.uno
+edge-2.iot.renner.uno
 nas-1.renner.uno
 nas-2.renner.uno
 

ansible/plays/install-edge-host.yml

@@ -34,6 +34,7 @@
   roles:
     - certificates
     - common
+    - pacman-cache
     - edge-flash-wear
     - docker-install
     - edge-log-shipper

ansible/plays/install-ntp-ha.yml

@@ -83,6 +83,9 @@
       edge-1.iot.renner.uno:
         priority: 70
         state: "BACKUP"
+      edge-2.iot.renner.uno:
+        priority: 60
+        state: "BACKUP"
 
   roles:
     - role: chrony-ntp-server

ansible/roles/edge-log-shipper/defaults/main.yml

@@ -7,7 +7,9 @@
 
 edge_alloy_config_file: /etc/alloy/edge.alloy
 edge_alloy_http_port: 12345
-edge_alloy_bin: /usr/bin/grafana-alloy   # Arch `grafana-alloy` pkg names the binary this, not `alloy`
+# Upstream image: Arch's grafana-alloy 1.21 is built without
+# loki.source.journal. Renovate-tracked (customManagers in renovate.json).
+edge_alloy_image: grafana/alloy:v1.21.3@sha256:8ab871206bd2d8f89277f53abffee5f452a293980788d52f85fa183a87a505a4
 edge_loki_push_url: "https://loki.renner.uno/loki/api/v1/push"
 edge_loki_username: edge-1
 edge_alloy_labels:

ansible/roles/edge-log-shipper/tasks/main.yml

@@ -6,15 +6,18 @@
 # directly, so one journal source covers everything. Alloy s storage/WAL sits
 # on /run (tmpfs) so it does not write to flash either.
 
-- name: Install grafana-alloy
+# Alloy runs from the upstream image (see edge-alloy.service); the Arch package
+# lacks journal support.
+- name: Remove the grafana-alloy package
   ansible.builtin.package:
     name: grafana-alloy
-    state: present
+    state: absent
 
 - name: Create alloy system group
   ansible.builtin.group:
     name: alloy
     system: true
+  register: edge_alloy_group
 
 - name: Create alloy system user
   ansible.builtin.user:
@@ -24,6 +27,25 @@
     system: true
     create_home: false
     shell: /usr/bin/nologin
+  register: edge_alloy_user
+
+- name: Look up the systemd-journal group
+  ansible.builtin.getent:
+    database: group
+    key: systemd-journal
+
+- name: Set the container identity
+  ansible.builtin.set_fact:
+    edge_alloy_uid: "{{ edge_alloy_user.uid }}"
+    edge_alloy_gid: "{{ edge_alloy_group.gid }}"
+    edge_alloy_journal_gid: "{{ ansible_facts.getent_group['systemd-journal'][1] }}"
+
+- name: Pull the alloy image
+  ansible.builtin.command:
+    argv: [docker, pull, "{{ edge_alloy_image }}"]
+  register: edge_alloy_pull
+  changed_when: "'Downloaded newer image' in edge_alloy_pull.stdout"
+  notify: Restart alloy
 
 - name: Create alloy config directory
   ansible.builtin.file:

ansible/roles/edge-log-shipper/templates/edge-alloy.service.j2

@@ -1,32 +1,35 @@
 [Unit]
-Description=Grafana Alloy (edge-1 log shipper -> Loki)
+Description=Grafana Alloy (journal -> Loki)
 Documentation=https://grafana.com/docs/alloy/
-After=network-online.target
+After=docker.service network-online.target
+Requires=docker.service
 Wants=network-online.target
 
 [Service]
 Type=simple
-User=alloy
-Group=alloy
-# Read the (volatile) systemd journal.
-SupplementaryGroups=systemd-journal
-# WAL + positions on tmpfs so the agent never writes to the eMMC. %t is the
-# runtime dir root (/run); RuntimeDirectory creates /run/alloy owned by us.
-RuntimeDirectory=alloy
-ExecStart={{ edge_alloy_bin }} run \
+# WAL + positions on tmpfs so the agent never writes to the eMMC.
+ExecStartPre=/usr/bin/install -d -o alloy -g alloy -m 0750 /run/alloy
+ExecStartPre=-/usr/bin/docker rm -f edge-alloy
+# Attached run with --log-driver none: the container's output reaches the
+# journal once, through this unit.
+ExecStart=/usr/bin/docker run --rm --name edge-alloy \
+  --log-driver none \
+  --network host \
+  --user {{ edge_alloy_uid }}:{{ edge_alloy_gid }} \
+  --group-add {{ edge_alloy_journal_gid }} \
+  --read-only --tmpfs /tmp \
+  --cap-drop ALL --security-opt no-new-privileges \
+  -v /run/log/journal:/run/log/journal:ro \
+  -v /etc/machine-id:/etc/machine-id:ro \
+  -v {{ edge_alloy_config_file }}:/etc/alloy/config.alloy:ro \
+  -v /run/alloy:/var/lib/alloy \
+  {{ edge_alloy_image }} run \
   --server.http.listen-addr=127.0.0.1:{{ edge_alloy_http_port }} \
-  --storage.path=%t/alloy \
-  {{ edge_alloy_config_file }}
-ExecReload=/bin/kill -HUP $MAINPID
-Restart=on-failure
+  --storage.path=/var/lib/alloy \
+  /etc/alloy/config.alloy
+ExecStop=/usr/bin/docker stop edge-alloy
+Restart=always
 RestartSec=10s
-LimitNOFILE=65536
-
-# Hardening (bare metal, no LXC namespace limits here).
-NoNewPrivileges=yes
-ProtectSystem=strict
-ProtectHome=yes
-PrivateTmp=yes
 
 [Install]
 WantedBy=multi-user.target

ansible/roles/mqtt-bridge/defaults/main.yml

@@ -16,7 +16,7 @@ edge_mqtt_bridge_cafile: /etc/ssl/certs/ca-certificates.crt
 # kubernetes/apps/home-assistant/mqtt-accounts.yaml). The controller pushes
 # its password to edge-mqtt-cred and rotates it when the bridge reports
 # "not connected"; there is no copy in ansible-vault.
-edge_mqtt_bridge_account: edge-1
+edge_mqtt_bridge_account: "{{ inventory_hostname_short }}"
 # HTTPS port of edge-mqtt-cred (esp32 device API, mTLS). Only a client
 # certificate from the MQTT CA with this CN is accepted.
 edge_mqtt_cred_port: 8443

ansible/roles/mqtt-bridge/templates/edge-1-bridge.conf.in.j2

@@ -7,7 +7,7 @@ connection {{ edge_mqtt_bridge_account }}
 address {{ edge_mqtt_cluster_host }}:{{ edge_mqtt_cluster_tls_port }}
 bridge_cafile {{ edge_mqtt_bridge_cafile }}
 bridge_insecure false
-remote_clientid edge1-bridge
+remote_clientid {{ edge_mqtt_bridge_account | replace('-', '') }}-bridge
 cleansession false
 try_private true
 restart_timeout 5 30

ansible/roles/pacman-cache/files/pacman-cache.hook

@@ -0,0 +1,14 @@
+# Managed by ansible (roles/pacman-cache).
+# Downloaded packages are not kept; older versions come from the Arch Linux
+# Archive.
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Type = Package
+Target = *
+
+[Action]
+Description = Removing downloaded packages from the cache...
+When = PostTransaction
+Exec = /usr/bin/find /var/cache/pacman/pkg -mindepth 1 -delete

ansible/roles/pacman-cache/tasks/main.yml

@@ -0,0 +1,21 @@
+---
+# Keep the pacman package cache empty. pacman keeps every downloaded package;
+# on a 7 GB eMMC root the cache grows to gigabytes. Arch hosts only.
+
+- name: Ensure the pacman hook directory exists
+  ansible.builtin.file:
+    path: /etc/pacman.d/hooks
+    state: directory
+    mode: "0755"
+
+- name: Empty the package cache after every transaction
+  ansible.builtin.copy:
+    src: pacman-cache.hook
+    dest: /etc/pacman.d/hooks/pacman-cache.hook
+    mode: "0644"
+
+- name: Empty the package cache
+  ansible.builtin.command:
+    argv: [find, /var/cache/pacman/pkg, -mindepth, "1", -delete, -print]
+  register: pacman_cache_clean
+  changed_when: pacman_cache_clean.stdout | length > 0

ansible/roles/ssh-ca/tasks/main.yml

@@ -143,6 +143,12 @@
     group: root
     mode: "0644"
 
+- name: Install sudo
+  ansible.builtin.package:
+    name: sudo
+    state: present
+  when: not ssh_ca_synouser.stat.exists
+
 - name: Install the Claude sudo rules
   ansible.builtin.template:
     src: sudoers-claude.j2

docs/radius/dot1x.md

@@ -154,22 +154,31 @@ For IPv6 set `LIVE_SOURCE` to the workstation's `fd02:50::` address and use
 ## Client setup (SSID "Renner UniFi")
 
 Setup page: `https://wlan.renner.uno` (behind the Authentik gate, any
-authentik user; `kubernetes/apps/authentik/wlan-setup*.yaml`). Android and
-Apple get Passpoint profiles with their own app password; Windows gets a file
-that imports the WLAN profile with `netsh`, Linux an `nmcli` command
-(NetworkManager has no Passpoint support). The Windows and Linux setups carry
-no password.
+authentik user), served by the Go service `wlan-setup/`
+(`kubernetes/apps/authentik/wlan-setup*.yaml`). Android, Apple and Windows get
+Passpoint profiles with their own app password; Linux an `nmcli` command
+(NetworkManager has no Passpoint support) that carries no password.
 
-Passpoint (Android, Apple): `/<platform>/install` (`android` or `apple`) signs
-the user in through the authentik OAuth2 application `wlan-setup` (scope
-`goauthentik.io/api`). On `/<platform>/callback`, nginx (njs) exchanges the
+Passpoint: `/<platform>/install` (`android`, `apple` or `windows`) signs the
+user in through the authentik OAuth2 application `wlan-setup` (scope
+`goauthentik.io/api`). On `/<platform>/callback`, the service exchanges the
 code, creates an app password (`wlan-<platform>-<user>-<timestamp>-<random>`)
-with the user's own access token, and returns the profile in the response to
-that GET: Android `application/x-wifi-config` (as its installer requires),
-Apple a `.mobileconfig`. The page stores nothing. Deleting the app password in
-authentik removes that device from the WLAN. The profiles match WLANs that
-advertise Hotspot 2.0 with domain and NAI realm `renner.uno` (EAP-TTLS/PAP),
-i.e. "Renner UniFi". Creating the app password needs no admin rights.
+with the user's own access token, and hands out the profile:
+
+- Android: `application/x-wifi-config` in the response to that GET, as its
+  installer requires.
+- Apple: a `.mobileconfig` download.
+- Windows: a CarrierProvisioning XML signed with XML-DSig (enveloped, C14N
+  1.0, rsa-sha1, chain in KeyInfo) by the Let's Encrypt certificate
+  `wlan-setup-signing`; kept for 5 minutes under a single-use token. The
+  browser is sent to `ms-settings:wifi-provisioning?uri=https://wlan.renner.uno/windows/profile/<token>`;
+  Windows Settings fetches it (Ingress `wlan-setup-provisioning`, without the
+  gate) and offers "Add".
+
+The service stores nothing else. Deleting the app password in authentik removes
+that device from the WLAN. The profiles match WLANs that advertise Hotspot 2.0
+with domain and NAI realm `renner.uno` (EAP-TTLS/PAP), i.e. "Renner UniFi".
+Creating the app password needs no admin rights.
 
 App passwords expire when unused. The page creates them with 29 days (the API
 caps new tokens at 30 days unless the group attribute
@@ -203,7 +212,9 @@ Passpoint profile from the setup page ("Auf Android installieren").
 
 ### Windows 11
 
-Settings > Network & Internet > Wi-Fi > Manage known networks > Add network:
+Passpoint profile from the setup page ("Auf Windows installieren"). Manual
+setup without the page: Settings > Network & Internet > Wi-Fi > Manage known
+networks > Add network:
 
 - Network name: `Renner UniFi`
 - Security type: WPA3-Enterprise AES

images/edge-host-iso/README.md

@@ -42,10 +42,11 @@ for the CA key; rebuild the ISO after a CA rotation.
 2. Boot the target from it (UEFI, Secure Boot off; one-time F12/setup
    visit if the box doesn't already boot USB first)
 3. Either on the console (auto-login as root) or headless —
-   `ssh root@<dhcp-ip>` with an owner certificate — run `edge-install`. It auto-detects the internal disk
-   (NVMe, else eMMC — covers the Wyse 3040 — else first non-USB disk),
-   shows the target and requires typing the hostname before wiping
-   anything. Override with `edge-install /dev/sdY`.
+   `ssh root@<dhcp-ip>` with an owner certificate — run
+   `edge-install <hostname>` (e.g. `edge-install edge-2`). It auto-detects
+   the internal disk (NVMe, else eMMC — covers the Wyse 3040 — else first
+   non-USB disk), shows the target and requires typing the hostname before
+   wiping anything. Override with `edge-install <hostname> /dev/sdY`.
 4. Reboot. Confirm the box is reachable by name — `ssh root@<host>` — before
    going further; it is identified by name everywhere and its address is
    never recorded. Then add it to `[edge_host]` in

images/edge-host-iso/airootfs/usr/local/bin/edge-install

@@ -1,13 +1,19 @@
 #!/usr/bin/env bash
-# Installer for edge-1 (bare-metal edge host, replaces the k8s-edge VM).
+# Installer for the bare-metal edge hosts (edge-1, edge-2, ...).
 # Runs from the edge-host ISO live environment. WIPES the target disk.
-# Usage: edge-install [disk]
-# Default: the internal disk — first NVMe, else eMMC (Wyse 3040), else
+# Usage: edge-install <hostname> [disk]
+# Default disk: the internal disk — first NVMe, else eMMC (Wyse 3040), else
 # the first non-USB, non-optical disk. The live USB stick itself is
 # excluded via the ISO9660 label mount.
 set -euo pipefail
 
-HOST=edge-1
+usage() { echo "usage: edge-install <hostname> [disk]"; exit 1; }
+[ $# -ge 1 ] && [ $# -le 2 ] || usage
+HOST=$1
+# RFC 1123 label: what systemd-networkd sends as the DHCP hostname.
+[[ "$HOST" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]] \
+  || { echo "invalid hostname: $HOST"; exit 1; }
+shift
 
 detect_disk() {
   # eMMC needs mmc_block before any /dev/mmcblk* exists (see
@@ -51,7 +57,7 @@ mount --mkdir "$(part 1)" /mnt/boot
 
 # Everything the edge-host ansible role expects to find; the role itself
 # is applied over SSH after first boot (see ansible/docs/edge-host.md).
-pacstrap -K /mnt base linux linux-firmware intel-ucode openssh python git \
+pacstrap -K /mnt base linux linux-firmware intel-ucode openssh sudo python git \
   docker docker-compose
 
 genfstab -U /mnt >> /mnt/etc/fstab

kubernetes/apps/authentik/blueprints-configmap.yaml

@@ -1700,6 +1700,8 @@ data:
               matching_mode: strict
             - url: https://wlan.renner.uno/apple/callback
               matching_mode: strict
+            - url: https://wlan.renner.uno/windows/callback
+              matching_mode: strict
 
       - model: authentik_core.application
         identifiers:

kubernetes/apps/authentik/gate-sync.yaml

@@ -105,7 +105,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: controller
-          image: gitea.renner.uno/gitea_admin/authentik-gate-sync:2026-11-01-1059 # {"$imagepolicy": "flux-system:authentik-gate-sync"}
+          image: gitea.renner.uno/gitea_admin/authentik-gate-sync:2026-11-05-1355 # {"$imagepolicy": "flux-system:authentik-gate-sync"}
           securityContext:
             allowPrivilegeEscalation: false
             readOnlyRootFilesystem: true

kubernetes/apps/authentik/kustomization.yaml

@@ -17,7 +17,7 @@ resources:
   - freeradius.yaml
   - freeradius-cnp.yaml
   - wlan-setup-oauth.yaml
-  - wlan-setup-config.yaml
+  - wlan-setup-signing-cert.yaml
   - wlan-setup.yaml
   # ak-pg CNPG Postgres backend (moved here from the retired seed-authentik KS;
   # each carries prune: disabled so ownership transferred without a teardown).

kubernetes/apps/authentik/wlan-setup-config.yaml

@@ -1,482 +0,0 @@
-# wlan.renner.uno: setup files for "Renner UniFi" (802.1X, EAP-TTLS/PAP
-# against freeradius, outer identity anonymous, server name radius.renner.uno).
-# Served by wlan-setup (wlan-setup.yaml) behind the Authentik gate; the
-# username comes from X-authentik-username. The Android and Apple Passpoint
-# profiles carry a credential: a per-device authentik app password that the
-# page creates with the user's own OAuth access token.
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: wlan-setup
-  namespace: authentik
-data:
-  # The image's nginx.conf plus the njs module and the OAuth client secret
-  # passpoint.js reads from the environment.
-  nginx.conf: |
-    load_module modules/ngx_http_js_module.so;
-
-    env WLAN_SETUP_CLIENT_SECRET;
-
-    worker_processes 1;
-    error_log /var/log/nginx/error.log notice;
-    pid /tmp/nginx.pid;
-
-    events {
-        worker_connections 1024;
-    }
-
-    http {
-        proxy_temp_path /tmp/proxy_temp;
-        client_body_temp_path /tmp/client_temp;
-        fastcgi_temp_path /tmp/fastcgi_temp;
-        uwsgi_temp_path /tmp/uwsgi_temp;
-        scgi_temp_path /tmp/scgi_temp;
-
-        include /etc/nginx/mime.types;
-        default_type application/octet-stream;
-
-        log_format main '$remote_addr - [$time_local] "$request" $status $body_bytes_sent "$http_user_agent"';
-        access_log /var/log/nginx/access.log main;
-
-        sendfile on;
-        keepalive_timeout 65;
-
-        include /etc/nginx/conf.d/*.conf;
-    }
-
-  default.conf: |
-    # Only plain usernames reach a generated file; anything else leaves the
-    # field empty and the device asks for it.
-    map $http_x_authentik_username $wifi_user {
-        "~^[A-Za-z0-9._@+-]{1,64}$" $http_x_authentik_username;
-        default "";
-    }
-
-    js_path /etc/nginx/njs/;
-    js_import passpoint from passpoint.js;
-
-    # authentik-server, resolved once at start; reached only by passpoint.js
-    # subrequests (/_ak/...).
-    upstream authentik {
-        server authentik-server.authentik.svc.cluster.local:80;
-    }
-
-    server {
-        listen 8080;
-        listen [::]:8080;
-        server_tokens off;
-        root /usr/share/nginx/html;
-        add_header Cache-Control "no-store" always;
-
-        location = / {
-            try_files /index.html =404;
-        }
-
-        location = /whoami {
-            default_type text/plain;
-            return 200 $wifi_user;
-        }
-
-        location = /renner-unifi-wlan.cmd {
-            default_type application/octet-stream;
-            add_header Cache-Control "no-store" always;
-            add_header Content-Disposition 'attachment; filename="renner-unifi-wlan.cmd"' always;
-            try_files /renner-unifi-wlan.cmd =404;
-        }
-
-        # Android and Apple: a tap on /<platform>/install starts an
-        # authorization-code sign-in at authentik (the user is already signed
-        # in there); the callback creates the app password as the user and
-        # answers the same navigation with the Passpoint profile. Android:
-        # application/x-wifi-config, base64, no Content-Disposition, as its
-        # installer requires. Apple: a .mobileconfig download.
-        location ~ ^/(android|apple)/install$ {
-            js_content passpoint.install;
-        }
-
-        location ~ ^/(android|apple)/callback$ {
-            # The query carries the one-time authorization code.
-            access_log off;
-            js_content passpoint.callback;
-        }
-
-        # Subrequests from passpoint.js only. Credential and content type
-        # arrive as arguments and leave as headers; proxy_pass with a variable
-        # URI does not forward the arguments. $arg_* only: subrequests share
-        # the parent's variable cache, so a map would keep its first value.
-        location ~ ^/_ak(/.*)$ {
-            internal;
-            proxy_pass http://authentik$1;
-            # njs reads the whole reply from this buffer (default one page).
-            subrequest_output_buffer_size 256k;
-            # Only the headers set here reach authentik.
-            proxy_pass_request_headers off;
-            proxy_set_header Host auth.renner.uno;
-            proxy_set_header Cookie "";
-            proxy_set_header Authorization "$arg_scheme $arg_cred";
-            proxy_set_header Content-Type $arg_ct;
-            proxy_set_header Accept "application/json";
-        }
-
-        location = /healthz {
-            access_log off;
-            default_type text/plain;
-            return 200 "ok\n";
-        }
-
-        location / {
-            return 404;
-        }
-    }
-
-  # Windows: extracts the WLAN profile (everything after line 8 of itself)
-  # into %TEMP% and imports it for the current user with netsh. EAP-TTLS with
-  # PAPAuthentication, outer identity anonymous, server name
-  # radius.renner.uno, trust anchor ISRG Root X1 (SHA-1 thumbprint; the
-  # Let's Encrypt chain of radius-tls ends there). Windows asks for username
-  # and password on connect. CRLF line endings: cmd.exe needs them.
-  renner-unifi-wlan.cmd: "@echo off\r\nrem WLAN Renner UniFi einrichten (802.1X, Anmeldung mit dem authentik-Konto)\r\nset \"WLANXML=%TEMP%\\renner-unifi-wlan.xml\"\r\nmore +8 \"%~f0\" > \"%WLANXML%\"\r\nnetsh wlan add profile filename=\"%WLANXML%\" user=current\r\ndel \"%WLANXML%\"\r\nnetsh wlan connect name=\"Renner UniFi\"\r\npause & exit /b\r\n<?xml version=\"1.0\"?><WLANProfile xmlns=\"http://www.microsoft.com/networking/WLAN/profile/v1\"><name>Renner UniFi</name><SSIDConfig><SSID><hex>52656E6E657220556E694669</hex><name>Renner UniFi</name></SSID><nonBroadcast>false</nonBroadcast></SSIDConfig><connectionType>ESS</connectionType><connectionMode>auto</connectionMode><MSM><security><authEncryption><authentication>WPA2</authentication><encryption>AES</encryption><useOneX>true</useOneX></authEncryption><OneX xmlns=\"http://www.microsoft.com/networking/OneX/v1\"><cacheUserData>true</cacheUserData><authMode>user</authMode><EAPConfig><EapHostConfig xmlns=\"http://www.microsoft.com/provisioning/EapHostConfig\"><EapMethod><Type xmlns=\"http://www.microsoft.com/provisioning/EapCommon\">21</Type><VendorId xmlns=\"http://www.microsoft.com/provisioning/EapCommon\">0</VendorId><VendorType xmlns=\"http://www.microsoft.com/provisioning/EapCommon\">0</VendorType><AuthorId xmlns=\"http://www.microsoft.com/provisioning/EapCommon\">311</AuthorId></EapMethod><Config xmlns=\"http://www.microsoft.com/provisioning/EapHostConfig\"><EapTtls xmlns=\"http://www.microsoft.com/provisioning/EapTtlsConnectionPropertiesV1\"><ServerValidation><ServerNames>radius.renner.uno</ServerNames><TrustedRootCAHash>ca bd 2a 79 a1 07 6a 31 f2 1d 25 36 35 cb 03 9d 43 29 a5 e8</TrustedRootCAHash><DisablePrompt>false</DisablePrompt></ServerValidation><Phase2Authentication><PAPAuthentication/></Phase2Authentication><Phase1Identity><IdentityPrivacy>true</IdentityPrivacy><AnonymousIdentity>anonymous</AnonymousIdentity></Phase1Identity></EapTtls></Config></EapHostConfig></EAPConfig></OneX></security></MSM></WLANProfile>\r\n"
-
-  # Android Passpoint R1 provisioning (source.android.com, Passpoint): the
-  # body is base64 of a MIME multipart with the PPS MO and the trust anchor.
-  # HomeSP FQDN and realm renner.uno match the Hotspot 2.0 domain and NAI realm
-  # the Passpoint WLAN announces; EAP-TTLS (21) with inner PAP. Trust anchor
-  # ISRG Root X1 (the radius-tls chain ends there), AAA server name
-  # radius.renner.uno (Extension/Android/AAAServerTrustedNames, as Android's
-  # PpsMoParser expects it). The credential is a new app password per install,
-  # created as the user with the access token of the "WLAN setup" OAuth client
-  # (authorization code, scope goauthentik.io/api). It starts with 29 days
-  # (below the 30-day token cap); each 802.1X login renews it to 60 days
-  # (policy dot1x-app-password-renew).
-  # Apple: com.apple.wifi.managed with IsHotspot, DomainName and NAIRealmNames
-  # renner.uno (no SSID: Passpoint matching), TTLS (21) with inner PAP, outer
-  # identity anonymous, trusted server name radius.renner.uno, username and
-  # app password. Fixed PayloadIdentifier/UUIDs so a reinstall replaces the
-  # previous profile.
-  passpoint.js: |
-    const ISRG_ROOT_X1 = "MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygch77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6UA5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sWT8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyHB5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UCB5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUvKBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWnOlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTnjh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbwqHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CIrU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkqhkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZLubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KKNFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7UrTkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdCjNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVcoyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPAmRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57demyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc=";
-    const USER = /^[A-Za-z0-9._@+-]{1,64}$/;
-
-    function b64(s) { return Buffer.from(s).toString("base64"); }
-    function node(name, inner) { return "<Node><NodeName>" + name + "</NodeName>" + inner + "</Node>"; }
-    function leaf(name, value) { return node(name, "<Value>" + value + "</Value>"); }
-
-    function profile(user, password) {
-        const pps = '<MgmtTree xmlns="syncml:dmddf1.2"><VerDTD>1.2</VerDTD>' +
-            node("PerProviderSubscription",
-                "<RTProperties><Type><DDFName>urn:wfa:mo:hotspot2dot0-perprovidersubscription:1.0</DDFName></Type></RTProperties>" +
-                node("i001",
-                    node("HomeSP", leaf("FriendlyName", "Renner") + leaf("FQDN", "renner.uno")) +
-                    node("Credential",
-                        leaf("Realm", "renner.uno") +
-                        node("UsernamePassword",
-                            leaf("Username", user) +
-                            leaf("Password", b64(password)) +
-                            node("EAPMethod", leaf("EAPType", "21") + leaf("InnerMethod", "PAP")))) +
-                    node("Extension", node("Android",
-                        node("AAAServerTrustedNames", leaf("FQDN", "radius.renner.uno")))))) +
-            "</MgmtTree>";
-        const mime = "Content-Type: multipart/mixed; boundary={boundary}\r\n" +
-            "Content-Transfer-Encoding: base64\r\n\r\n" +
-            "--{boundary}\r\n" +
-            "Content-Type: application/x-passpoint-profile\r\n" +
-            "Content-Transfer-Encoding: base64\r\n\r\n" +
-            b64(pps) + "\r\n" +
-            "--{boundary}\r\n" +
-            "Content-Type: application/x-x509-ca-cert\r\n" +
-            "Content-Transfer-Encoding: base64\r\n\r\n" +
-            ISRG_ROOT_X1 + "\r\n" +
-            "--{boundary}--\r\n";
-        return b64(mime);
-    }
-
-    function xml(s) {
-        return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-    }
-
-    function mobileconfig(user, password) {
-        return '<?xml version="1.0" encoding="UTF-8"?>\n' +
-            '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n' +
-            '<plist version="1.0"><dict>' +
-            '<key>PayloadContent</key><array><dict>' +
-            '<key>PayloadType</key><string>com.apple.wifi.managed</string>' +
-            '<key>PayloadVersion</key><integer>1</integer>' +
-            '<key>PayloadIdentifier</key><string>uno.renner.wifi.renner-unifi.network</string>' +
-            '<key>PayloadUUID</key><string>824959bf-c55d-4ed2-b569-c33f3759c2b6</string>' +
-            '<key>PayloadDisplayName</key><string>Renner UniFi</string>' +
-            '<key>PayloadOrganization</key><string>Renner</string>' +
-            '<key>IsHotspot</key><true/>' +
-            '<key>DomainName</key><string>renner.uno</string>' +
-            '<key>NAIRealmNames</key><array><string>renner.uno</string></array>' +
-            '<key>DisplayedOperatorName</key><string>Renner</string>' +
-            '<key>ServiceProviderRoamingEnabled</key><false/>' +
-            '<key>AutoJoin</key><true/>' +
-            '<key>EncryptionType</key><string>Any</string>' +
-            '<key>EAPClientConfiguration</key><dict>' +
-            '<key>UserName</key><string>' + xml(user) + '</string>' +
-            '<key>UserPassword</key><string>' + xml(password) + '</string>' +
-            '<key>OuterIdentity</key><string>anonymous</string>' +
-            '<key>AcceptEAPTypes</key><array><integer>21</integer></array>' +
-            '<key>TTLSInnerAuthentication</key><string>PAP</string>' +
-            '<key>TLSTrustedServerNames</key><array><string>radius.renner.uno</string></array>' +
-            '</dict></dict></array>' +
-            '<key>PayloadType</key><string>Configuration</string>' +
-            '<key>PayloadVersion</key><integer>1</integer>' +
-            '<key>PayloadIdentifier</key><string>uno.renner.wifi.renner-unifi</string>' +
-            '<key>PayloadUUID</key><string>7175a2a3-ddd3-42ea-b4ad-b7e5501892f3</string>' +
-            '<key>PayloadDisplayName</key><string>WLAN Renner UniFi</string>' +
-            '<key>PayloadOrganization</key><string>Renner</string>' +
-            '</dict></plist>\n';
-    }
-
-    const PLATFORMS = {
-        android: { label: "Android" },
-        apple: { label: "Apple" },
-    };
-
-    // "android" or "apple" from /<platform>/install or /<platform>/callback.
-    function platform(r) {
-        return r.uri.split("/")[1];
-    }
-
-    function redirectUri(name) {
-        return "https://wlan.renner.uno/" + name + "/callback";
-    }
-
-    const CLIENT_ID = "wlan-setup";
-    const AUTHORIZE = "https://auth.renner.uno/application/o/authorize/";
-    const STATE_COOKIE = "wlan_oauth_state";
-    const LIFETIME_DAYS = 29;
-
-    function random() {
-        const bytes = new Uint8Array(24);
-        crypto.getRandomValues(bytes);
-        return Buffer.from(bytes).toString("base64url");
-    }
-
-    function cookie(r, name) {
-        const all = r.headersIn["Cookie"] || "";
-        const parts = all.split(";");
-        for (let n = 0; n < parts.length; n++) {
-            const part = parts[n];
-            const i = part.indexOf("=");
-            if (i > 0 && part.substring(0, i).trim() === name) return part.substring(i + 1).trim();
-        }
-        return "";
-    }
-
-    function form(fields) {
-        return Object.keys(fields).map(k => encodeURIComponent(k) + "=" + encodeURIComponent(fields[k])).join("&");
-    }
-
-    const FORM = "application/x-www-form-urlencoded";
-    const JSON_CT = "application/json";
-    const CRED = /^[A-Za-z0-9._~+\/=-]+$/;
-
-    // authentik call through the internal /_ak location; the arguments
-    // become the Authorization and Content-Type headers there (raw, nginx
-    // does not decode $arg_*).
-    async function ak(r, method, path, scheme, cred, ct, body) {
-        if (!CRED.test(cred)) throw new Error(method + " " + path + ": no credential");
-        const args = "scheme=" + scheme + "&cred=" + cred + "&ct=" + ct;
-        const opts = { method: method, args: args };
-        if (body !== undefined) opts.body = body;
-        const reply = await r.subrequest("/_ak" + path, opts);
-        if (reply.status < 200 || reply.status > 299) {
-            throw new Error(method + " " + path + " -> " + reply.status + " " + reply.responseText.substring(0, 300));
-        }
-        return JSON.parse(reply.responseText);
-    }
-
-    function install(r) {
-        const name = platform(r);
-        const state = random();
-        r.headersOut["Set-Cookie"] = STATE_COOKIE + "=" + state +
-            "; Path=/" + name + "/; Max-Age=300; HttpOnly; Secure; SameSite=Lax";
-        r.return(302, AUTHORIZE + "?" + form({
-            response_type: "code",
-            client_id: CLIENT_ID,
-            redirect_uri: redirectUri(name),
-            scope: "openid profile goauthentik.io/api",
-            state: state,
-        }));
-    }
-
-    async function callback(r) {
-        const name = platform(r);
-        try {
-            const state = cookie(r, STATE_COOKIE);
-            if (!state || r.args.state !== state || !r.args.code) { r.return(400, "Bitte die Einrichtung neu starten.\n"); return; }
-            const client = Buffer.from(CLIENT_ID + ":" + process.env.WLAN_SETUP_CLIENT_SECRET).toString("base64");
-            const grant = await ak(r, "POST", "/application/o/token/", "Basic", client, FORM, form({
-                grant_type: "authorization_code",
-                code: r.args.code,
-                redirect_uri: redirectUri(name),
-            }));
-            const access = grant.access_token;
-            const me = await ak(r, "GET", "/api/v3/core/users/me/", "Bearer", access, "");
-            const user = me.user.username;
-            if (!USER.test(user) || user !== r.headersIn["X-authentik-username"]) { r.return(403); return; }
-
-            const now = new Date();
-            const stamp = now.toISOString().replace(/[-:]/g, "").replace(/\..*$/, "");
-            const identifier = "wlan-" + name + "-" + user.replace(/[^A-Za-z0-9-]/g, "-").toLowerCase() + "-" + stamp + "-" + random().substring(0, 6).replace(/[^A-Za-z0-9]/g, "x");
-            const expires = new Date(now.getTime() + LIFETIME_DAYS * 86400000).toISOString();
-            await ak(r, "POST", "/api/v3/core/tokens/", "Bearer", access, JSON_CT, JSON.stringify({
-                identifier: identifier,
-                intent: "app_password",
-                description: "WLAN " + PLATFORMS[name].label + ", " + now.toISOString().substring(0, 10) + " (wlan.renner.uno)",
-                expiring: true,
-                expires: expires,
-            }));
-            const key = (await ak(r, "GET", "/api/v3/core/tokens/" + identifier + "/view_key/", "Bearer", access, "")).key;
-
-            r.headersOut["Set-Cookie"] = STATE_COOKIE + "=; Path=/" + name + "/; Max-Age=0; HttpOnly; Secure; SameSite=Lax";
-            if (name === "apple") {
-                r.headersOut["Content-Type"] = "application/x-apple-aspen-config";
-                r.headersOut["Content-Disposition"] = 'attachment; filename="renner-unifi.mobileconfig"';
-                r.return(200, mobileconfig(user, key));
-            } else {
-                r.headersOut["Content-Type"] = "application/x-wifi-config";
-                r.headersOut["Content-Transfer-Encoding"] = "base64";
-                r.return(200, profile(user, key));
-            }
-        } catch (e) {
-            r.error("wlan-setup " + name + ": " + e.message);
-            r.return(502, "Die Einrichtung ist fehlgeschlagen.\n");
-        }
-    }
-
-    export default { install, callback };
-
-  index.html: |
-    <!doctype html>
-    <html lang="de">
-    <head>
-    <meta charset="utf-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1">
-    <title>WLAN einrichten</title>
-    <style>
-      :root { --bg: #ffffff; --fg: #1d1d1f; --muted: #5f6368; --card: #f4f5f7; --accent: #0b63ce; --code: #e9ebef; }
-      @media (prefers-color-scheme: dark) {
-        :root { --bg: #121314; --fg: #e8eaed; --muted: #9aa0a6; --card: #1e1f22; --accent: #7cacf8; --code: #2a2b2f; }
-      }
-      * { box-sizing: border-box; }
-      body { margin: 0; background: var(--bg); color: var(--fg); font: 16px/1.5 system-ui, -apple-system, "Segoe UI", Roboto, sans-serif; }
-      main { max-width: 42rem; margin: 0 auto; padding: 1.5rem 1rem 3rem; }
-      h1 { font-size: 1.6rem; margin: 0 0 .25rem; }
-      h2 { font-size: 1.15rem; margin: 0 0 .5rem; }
-      p { margin: .5rem 0; }
-      .muted { color: var(--muted); }
-      section { background: var(--card); border-radius: 12px; padding: 1rem 1.1rem; margin: 1rem 0; }
-      section.current { outline: 2px solid var(--accent); }
-      a.button, button { display: inline-block; background: var(--accent); color: #fff; border: 0; border-radius: 8px; padding: .6rem 1rem; font: inherit; text-decoration: none; cursor: pointer; }
-      @media (prefers-color-scheme: dark) { a.button, button { color: #121314; } }
-      ol { padding-left: 1.3rem; margin: .5rem 0; }
-      pre { background: var(--code); border-radius: 8px; padding: .75rem; overflow-x: auto; white-space: pre-wrap; word-break: break-all; font-size: .85rem; margin: .5rem 0; }
-      details > summary { cursor: pointer; color: var(--accent); margin: 1.5rem 0 .5rem; }
-    </style>
-    </head>
-    <body>
-    <main>
-      <h1>WLAN einrichten</h1>
-      <p>WLAN <strong>Renner UniFi</strong> für dein Konto <strong id="user">…</strong>. Android, iPhone, iPad und Mac bekommen ein eigenes WLAN-App-Passwort; Windows und Linux melden sich mit deinem authentik-Passwort an.</p>
-
-      <div id="detected"></div>
-
-      <details id="others">
-        <summary>Andere Geräte</summary>
-        <div id="rest"></div>
-      </details>
-
-      <template id="t-android">
-        <section data-os="android">
-          <h2>Android</h2>
-          <p><a class="button" href="/android/install">Auf Android installieren</a></p>
-          <p class="muted">Das Gerät bekommt ein eigenes WLAN-App-Passwort in deinem authentik-Konto; dort gelöscht, ist das Gerät aus dem WLAN.</p>
-        </section>
-      </template>
-
-      <template id="t-apple">
-        <section data-os="apple">
-          <h2>iPhone, iPad, Mac</h2>
-          <p><a class="button" href="/apple/install">Profil laden</a></p>
-          <ol>
-            <li>iPhone/iPad: Einstellungen → „Profil geladen“ → Installieren. Mac: Systemeinstellungen → Allgemein → Geräteverwaltung → Profil doppelklicken.</li>
-            <li>Das Gerät verbindet sich danach selbst mit „Renner UniFi“.</li>
-          </ol>
-          <p class="muted">Das Gerät bekommt ein eigenes WLAN-App-Passwort in deinem authentik-Konto; dort gelöscht, ist das Gerät aus dem WLAN.</p>
-        </section>
-      </template>
-
-      <template id="t-windows">
-        <section data-os="windows">
-          <h2>Windows</h2>
-          <p><a class="button" href="/renner-unifi-wlan.cmd">Einrichtungsdatei laden</a></p>
-          <ol>
-            <li>Die geladene Datei doppelklicken. Fragt Windows nach („Der Computer wurde durch Windows geschützt“): „Weitere Informationen“ → „Trotzdem ausführen“.</li>
-            <li>Beim Verbinden Benutzername <strong class="u">…</strong> und dein Passwort eingeben.</li>
-          </ol>
-        </section>
-      </template>
-
-      <template id="t-linux">
-        <section data-os="linux">
-          <h2>Linux (NetworkManager)</h2>
-          <p>Im Terminal ausführen, danach fragt NetworkManager nach dem Passwort:</p>
-          <pre id="nmcli"></pre>
-          <p><button type="button" id="copy-nmcli">Befehl kopieren</button></p>
-        </section>
-      </template>
-    </main>
-    <script>
-    (function () {
-      var ua = navigator.userAgent;
-      var os = "other";
-      if (/Android/i.test(ua)) os = "android";
-      else if (/iPhone|iPad|iPod|Macintosh/i.test(ua)) os = "apple";
-      else if (/Windows/i.test(ua)) os = "windows";
-      else if (/Linux|X11/i.test(ua)) os = "linux";
-
-      var detected = document.getElementById("detected");
-      var rest = document.getElementById("rest");
-      ["android", "apple", "windows", "linux"].forEach(function (name) {
-        var node = document.getElementById("t-" + name).content.cloneNode(true);
-        if (name === os) { node.querySelector("section").classList.add("current"); detected.appendChild(node); }
-        else rest.appendChild(node);
-      });
-      if (os === "other") document.getElementById("others").open = true;
-
-      var currentUser = "";
-      function quote(s) { return "'" + s.replace(/'/g, "'\\''") + "'"; }
-      function render(user) {
-        currentUser = user;
-        var shown = user || "(dein Benutzername)";
-        document.getElementById("user").textContent = shown;
-        document.querySelectorAll(".u").forEach(function (el) { el.textContent = shown; });
-        document.getElementById("nmcli").textContent =
-          "nmcli connection add type wifi con-name 'Renner UniFi' ssid 'Renner UniFi' " +
-          "wifi-sec.key-mgmt wpa-eap 802-1x.eap ttls 802-1x.phase2-auth pap " +
-          "802-1x.anonymous-identity anonymous 802-1x.identity " + quote(user || "BENUTZERNAME") + " " +
-          "802-1x.domain-suffix-match radius.renner.uno 802-1x.system-ca-certs yes " +
-          "802-1x.password-flags 2 && nmcli --ask connection up 'Renner UniFi'";
-      }
-      render("");
-      fetch("/whoami", { credentials: "same-origin" })
-        .then(function (r) { return r.ok ? r.text() : ""; })
-        .then(function (t) { render(t.trim()); })
-        .catch(function () {});
-
-
-      document.getElementById("copy-nmcli").addEventListener("click", function () {
-        var text = document.getElementById("nmcli").textContent;
-        var btn = this;
-        navigator.clipboard.writeText(text).then(function () {
-          btn.textContent = "Kopiert";
-          setTimeout(function () { btn.textContent = "Befehl kopieren"; }, 2000);
-        });
-      });
-    })();
-    </script>
-    </body>
-    </html>

kubernetes/apps/authentik/wlan-setup-signing-cert.yaml

@@ -0,0 +1,21 @@
+---
+# Signs the Windows Wi-Fi provisioning XML of wlan.renner.uno (XML-DSig in the
+# wlan-setup service). Issued via the cluster-wide Cloudflare DNS-01
+# ClusterIssuer.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: wlan-setup-signing
+  namespace: authentik
+spec:
+  secretName: wlan-setup-signing
+  issuerRef:
+    name: letsencrypt-cluster
+    kind: ClusterIssuer
+  dnsNames:
+    - wlan.renner.uno
+  privateKey:
+    algorithm: RSA
+    size: 2048
+    encoding: PKCS8
+    rotationPolicy: Always

kubernetes/apps/authentik/wlan-setup.yaml

@@ -1,9 +1,9 @@
-# wlan.renner.uno: setup page for the 802.1X WLAN "Renner UniFi" (Apple
-# profile, Windows import file, Linux nmcli command, Android Passpoint profile
-# with its own app password; config and files in wlan-setup-config.yaml).
+# wlan.renner.uno: setup page for the 802.1X WLAN "Renner UniFi", served by the
+# wlan-setup Go service (wlan-setup/). Android, Apple and Windows get Passpoint
+# profiles with a per-device authentik app password; Linux an nmcli command.
 # Public, so a device can reach it before it is in the WLAN (mobile data,
-# Renner Gast). Any Authentik user passes the gate (no group); the page stores
-# no user credentials.
+# Renner Gast). Any Authentik user passes the gate (no group); the service
+# stores no user credentials beyond the 5-minute single-use Windows profile.
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -12,7 +12,6 @@ metadata:
   labels:
     app.kubernetes.io/name: wlan-setup
   annotations:
-    configmap.reloader.stakater.com/reload: wlan-setup
     secret.reloader.stakater.com/reload: wlan-setup-oauth
 spec:
   replicas: 1
@@ -27,15 +26,17 @@ spec:
       automountServiceAccountToken: false
       securityContext:
         runAsNonRoot: true
-        runAsUser: 101
-        runAsGroup: 101
+        runAsUser: 65534
+        runAsGroup: 65534
+        # Group of the signing key files (defaultMode 0440).
+        fsGroup: 65534
         seccompProfile:
           type: RuntimeDefault
       containers:
-        - name: nginx
-          image: nginxinc/nginx-unprivileged:1.31-alpine@sha256:b5047b9b76845eac124358373c6852377c52e4b05834a47647e955dd91cb8f1e
+        - name: wlan-setup
+          image: gitea.renner.uno/gitea_admin/wlan-setup:2026-11-05-1517 # {"$imagepolicy": "flux-system:wlan-setup"}
           env:
-            # Client secret of the "WLAN setup" OAuth2 provider (passpoint.js).
+            # Client secret of the "WLAN setup" OAuth2 provider.
             - name: WLAN_SETUP_CLIENT_SECRET
               valueFrom:
                 secretKeyRef:
@@ -65,55 +66,21 @@ spec:
             limits:
               memory: 64Mi
           volumeMounts:
-            # subPath: replaced on rollout, which the reloader annotation
-            # triggers on every ConfigMap change.
-            - name: main
-              mountPath: /etc/nginx/nginx.conf
-              subPath: nginx.conf
+            # Key and chain that sign the Windows provisioning XML; read per
+            # request, so cert-manager renewals need no restart.
+            - name: signing
+              mountPath: /etc/wlan-signing
               readOnly: true
-            - name: config
-              mountPath: /etc/nginx/conf.d
-              readOnly: true
-            - name: njs
-              mountPath: /etc/nginx/njs
-              readOnly: true
-            - name: html
-              mountPath: /usr/share/nginx/html
-              readOnly: true
-            # pid file and temp paths of the unprivileged image.
-            - name: tmp
-              mountPath: /tmp
       volumes:
-        - name: main
-          configMap:
-            name: wlan-setup
+        - name: signing
+          secret:
+            secretName: wlan-setup-signing
+            defaultMode: 0440
             items:
-              - key: nginx.conf
-                path: nginx.conf
-        - name: config
-          configMap:
-            name: wlan-setup
-            items:
-              - key: default.conf
-                path: default.conf
-        - name: njs
-          configMap:
-            name: wlan-setup
-            items:
-              - key: passpoint.js
-                path: passpoint.js
-        - name: html
-          configMap:
-            name: wlan-setup
-            items:
-              - key: index.html
-                path: index.html
-              - key: renner-unifi-wlan.cmd
-                path: renner-unifi-wlan.cmd
-        - name: tmp
-          emptyDir:
-            medium: Memory
-            sizeLimit: 16Mi
+              - key: tls.key
+                path: tls.key
+              - key: tls.crt
+                path: tls.crt
 ---
 apiVersion: v1
 kind: Service
@@ -161,3 +128,30 @@ spec:
                 name: wlan-setup
                 port:
                   number: 80
+---
+# Without the gate: Windows Settings fetches the signed provisioning XML
+# without the browser's session; the single-use token in the path is the only
+# gate. Traefik reaches the pods through the CNP wlan-setup-gate that
+# gate-sync creates for the Ingress above.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: wlan-setup-provisioning
+  namespace: authentik
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - wlan.renner.uno
+      secretName: wlan-setup-tls
+  rules:
+    - host: wlan.renner.uno
+      http:
+        paths:
+          - path: /windows/profile/
+            pathType: Prefix
+            backend:
+              service:
+                name: wlan-setup
+                port:
+                  number: 80

kubernetes/apps/cloudflare-lb-sync/deployment.yaml

@@ -30,7 +30,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: controller
-          image: gitea.renner.uno/gitea_admin/cloudflare-lb-sync:2026-10-29-1355 # {"$imagepolicy": "flux-system:cloudflare-lb-sync"}
+          image: gitea.renner.uno/gitea_admin/cloudflare-lb-sync:2026-11-05-1401 # {"$imagepolicy": "flux-system:cloudflare-lb-sync"}
           env:
             - name: CLOUDFLARE_API_TOKEN
               valueFrom:

kubernetes/apps/gitea-mcp/deployment.yaml

@@ -23,7 +23,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: gitea-mcp
-          image: docker.gitea.com/gitea-mcp-server:1.12.0 # {"$imagepolicy": "flux-system:gitea-mcp"}
+          image: docker.gitea.com/gitea-mcp-server:1.13.0 # {"$imagepolicy": "flux-system:gitea-mcp"}
           # Image has no ENTRYPOINT (binary is in CMD), so args alone would replace it.
           command:
             - /app/gitea-mcp

kubernetes/apps/home-assistant/mqtt-accounts.yaml

@@ -61,6 +61,11 @@
   # No sml2mqtt/#: the SML meter reader is retired for good (owner,
   # 2026-09-19; grid data comes from the E380 on the CAN bus).
   acl: ["readwrite open3e/#"]
+# edge-2's local mosquitto bridge, same role and pinning as edge-1.
+- name: edge-2
+  auth: password
+  deliver: {esp32: "https://edge-2.iot.renner.uno:8443"}
+  acl: ["readwrite open3e/#"]
 # Shellies (REN-1017): one password account per device, pushed by the
 # controller through shelly-manager's per-device API. Name shelly-<id> =
 # shelly-manager device id. ACL as the former shared user `shellies`

kubernetes/apps/home-assistant/zigbee2mqtt-deployment.yaml

@@ -66,7 +66,7 @@ spec:
           # (machine.registries.mirrors, applied by bootstrap.sh), and containerd
           # keeps the repository path when it falls through — so the path has to
           # exist on both registries. Steady state still pulls from Gitea.
-          image: gitea.renner.uno/konairius/alpine-jq:2026-10-29-1348 # {"$imagepolicy": "flux-system:alpine-jq"}
+          image: gitea.renner.uno/konairius/alpine-jq:2026-11-05-1353 # {"$imagepolicy": "flux-system:alpine-jq"}
           command:
             - sh
             - -c

kubernetes/apps/kuma-sync/deployment.yaml

@@ -30,7 +30,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: controller
-          image: gitea.renner.uno/gitea_admin/kuma-sync:2026-10-30-1314 # {"$imagepolicy": "flux-system:kuma-sync"}
+          image: gitea.renner.uno/gitea_admin/kuma-sync:2026-11-05-1355 # {"$imagepolicy": "flux-system:kuma-sync"}
           env:
             - name: KUMA_URL
               value: https://kuma.renner.uno

kubernetes/apps/paperless/gotenberg.yaml

@@ -22,7 +22,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: gotenberg
-          image: gotenberg/gotenberg:8.39.0 # {"$imagepolicy": "flux-system:gotenberg"}
+          image: gotenberg/gotenberg:8.40.0 # {"$imagepolicy": "flux-system:gotenberg"}
           args:
             - "gotenberg"
             - "--chromium-disable-javascript=true"

kubernetes/apps/paperless/paperless.yaml

@@ -155,7 +155,7 @@ spec:
           # exist on both registries — hence konairius/, which matches the ghcr
           # namespace. Steady state still pulls from Gitea and never leaves the
           # network.
-          image: gitea.renner.uno/konairius/alpine-openssl:2026-10-29-1348 # {"$imagepolicy": "flux-system:alpine-openssl"}
+          image: gitea.renner.uno/konairius/alpine-openssl:2026-11-05-1353 # {"$imagepolicy": "flux-system:alpine-openssl"}
           command:
             - sh
             - -c

kubernetes/apps/review-bot/deployment.yaml

@@ -32,7 +32,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: review-bot
-          image: gitea.renner.uno/gitea_admin/review-bot:2026-11-02-1054 # {"$imagepolicy": "flux-system:review-bot"}
+          image: gitea.renner.uno/gitea_admin/review-bot:2026-11-05-1350 # {"$imagepolicy": "flux-system:review-bot"}
           env:
             - name: GITEA_URL
               value: https://gitea.renner.uno

kubernetes/apps/trmnl/renderer.yaml

@@ -184,7 +184,7 @@ spec:
           # (machine.registries.mirrors, applied by bootstrap.sh), and containerd
           # keeps the repository path, so it has to exist on both registries.
           # Steady state still pulls from Gitea.
-          image: gitea.renner.uno/konairius/alpine-jq:2026-10-29-1348 # {"$imagepolicy": "flux-system:alpine-jq"}
+          image: gitea.renner.uno/konairius/alpine-jq:2026-11-05-1353 # {"$imagepolicy": "flux-system:alpine-jq"}
           command:
             - sh
             - -c

kubernetes/infrastructure/image-automation/README.md

@@ -46,6 +46,7 @@ existing `flux-system` GitRepository whose Secret was created by
 | authentik-gate-sync | `YYYY-MM-DD-HHMM` | In-house (build-ci-images.yml); newest tag wins |
 | kuma-sync | `YYYY-MM-DD-HHMM` | In-house (build-ci-images.yml); newest tag wins |
 | cloudflare-lb-sync | `YYYY-MM-DD-HHMM` | In-house (build-ci-images.yml); newest tag wins |
+| wlan-setup | `YYYY-MM-DD-HHMM` | In-house (build-ci-images.yml); newest tag wins |
 | secret-rotator | `YYYY-MM-DD` | In-house (build-ci-images.yml); newest tag wins; staged: only the Home Assistant rotation CronJobs carry the marker so far |
 | gatus | `5.x` | v-prefix filter |
 | velero-plugin-for-aws | `1.13.x` | Tight: must match velero server major.minor |

kubernetes/infrastructure/image-automation/kustomization.yaml

@@ -42,5 +42,6 @@ resources:
   - velero-plugin-for-aws.yaml
   - vsftpd.yaml
   - wiki.yaml
+  - wlan-setup.yaml
   - woodpecker.yaml
   - wyoming.yaml

kubernetes/infrastructure/image-automation/wlan-setup.yaml

@@ -0,0 +1,23 @@
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageRepository
+metadata:
+  name: wlan-setup
+  namespace: flux-system
+spec:
+  image: gitea.renner.uno/gitea_admin/wlan-setup
+  interval: 30m
+---
+# build-ci-images.yml tags each build YYYY-MM-DD-HHMM; newest wins.
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImagePolicy
+metadata:
+  name: wlan-setup
+  namespace: flux-system
+spec:
+  imageRepositoryRef:
+    name: wlan-setup
+  filterTags:
+    pattern: '^\d{4}-\d{2}-\d{2}-\d{4}$'
+  policy:
+    alphabetical:
+      order: asc

kubernetes/infrastructure/multus/cni-plugins-installer.yaml

@@ -73,7 +73,7 @@ spec:
           # No imagePullSecret: the ghcr namespace is private and its credential
           # is in machine.registries too, because a Secret would have to come
           # from OpenBao, which needs Ceph, which needs these binaries.
-          image: gitea.renner.uno/konairius/cni-plugins:2026-10-29-1348 # {"$imagepolicy": "flux-system:cni-plugins"}
+          image: gitea.renner.uno/konairius/cni-plugins:2026-11-05-1353 # {"$imagepolicy": "flux-system:cni-plugins"}
           command:
             - sh
             - -c

kubernetes/infrastructure/netbird-ingress/daemonset.yaml

@@ -76,6 +76,10 @@ spec:
               value: "netbird-ingress-$(NODE_NAME)"
             - name: NB_LOG_LEVEL
               value: "info"
+            # stdout only; the image default also writes client.log into the
+            # 16Mi state tmpfs.
+            - name: NB_LOG_FILE
+              value: "console"
             # rootless image needs a writable HOME for its state.
             - name: USER
               value: "netbird"

kubernetes/infrastructure/network-policies/home-assistant-ns.yaml

@@ -516,6 +516,7 @@ spec:
               - matchPattern: "*"
     - toFQDNs:
         - matchName: "edge-1.iot.renner.uno"
+        - matchName: "edge-2.iot.renner.uno"
       toPorts:
         - ports:
             - port: "8443"

kubernetes/infrastructure/openbao/rotation/home-assistant.yaml

@@ -71,7 +71,7 @@ spec:
               type: RuntimeDefault
           containers:
             - name: rotate
-              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-11-02 # {"$imagepolicy": "flux-system:secret-rotator"}
+              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-11-05 # {"$imagepolicy": "flux-system:secret-rotator"}
               args: ["ha-token"]
               securityContext:
                 allowPrivilegeEscalation: false
@@ -133,7 +133,7 @@ spec:
               type: RuntimeDefault
           containers:
             - name: rotate
-              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-11-02 # {"$imagepolicy": "flux-system:secret-rotator"}
+              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-11-05 # {"$imagepolicy": "flux-system:secret-rotator"}
               args: ["ha-token"]
               securityContext:
                 allowPrivilegeEscalation: false
@@ -195,7 +195,7 @@ spec:
               type: RuntimeDefault
           containers:
             - name: rotate
-              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-11-02 # {"$imagepolicy": "flux-system:secret-rotator"}
+              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-11-05 # {"$imagepolicy": "flux-system:secret-rotator"}
               args: ["ha-token"]
               securityContext:
                 allowPrivilegeEscalation: false

kubernetes/infrastructure/velero/backup-verify-cronjob.yaml

@@ -32,7 +32,7 @@ spec:
               type: RuntimeDefault
           containers:
             - name: backup-verify
-              image: gitea.renner.uno/gitea_admin/ci-backup-verify:2026-10-29 # {"$imagepolicy": "flux-system:backup-verify"}
+              image: gitea.renner.uno/gitea_admin/ci-backup-verify:2026-11-05 # {"$imagepolicy": "flux-system:backup-verify"}
               command: ["bash", "/script/backup-verify.sh"]
               env:
                 - name: HOME

wlan-setup/.gitignore

@@ -0,0 +1 @@
+/wlan-setup

wlan-setup/Containerfile

@@ -0,0 +1,23 @@
+# wlan-setup — static Go binary in a FROM-scratch image.
+#
+# Nothing in the final image but the binary and the CA bundle (the binary has no shell and no
+# package manager to patch or to exec).
+FROM golang:1.27.3-bookworm@sha256:d9b6a1beb9474adc2a1ce842573639b44b2a0dd49b6669f51d3821baf9ec37c9 AS build
+
+WORKDIR /build
+COPY go.mod go.sum ./
+RUN go mod download
+COPY *.go index.html ./
+
+RUN go vet ./... \
+ && CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /wlan-setup .
+
+FROM scratch
+COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=build /wlan-setup /wlan-setup
+
+# Matches runAsUser in the Deployment. There is no /etc/passwd in a scratch image, so this is a
+# bare uid by necessity.
+USER 65534:65534
+EXPOSE 8080
+ENTRYPOINT ["/wlan-setup"]

wlan-setup/authentik.go

@@ -0,0 +1,169 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"regexp"
+	"strings"
+)
+
+// authentikHost is the Host header of every call: authentik routes by it.
+const authentikHost = "auth.renner.uno"
+
+// maxReply bounds what is read of an authentik reply.
+const maxReply = 1 << 20
+
+var credential = regexp.MustCompile(`^[A-Za-z0-9._~+/=-]+$`)
+
+// Authentik calls authentik's OAuth and API endpoints at its internal address.
+type Authentik struct {
+	base   string
+	secret string
+	http   *http.Client
+}
+
+// call sends one request and decodes the JSON reply into out. Errors name the method, path and
+// status, never the credential or the request body.
+func (a *Authentik) call(ctx context.Context, method, path, auth, contentType string, body []byte, out any) error {
+	var rd io.Reader
+	if body != nil {
+		rd = bytes.NewReader(body)
+	}
+	req, err := http.NewRequestWithContext(ctx, method, a.base+path, rd)
+	if err != nil {
+		return fmt.Errorf("%s %s: %w", method, path, err)
+	}
+	req.Host = authentikHost
+	req.Header.Set("Authorization", auth)
+	req.Header.Set("Accept", "application/json")
+	if contentType != "" {
+		req.Header.Set("Content-Type", contentType)
+	}
+	resp, err := a.http.Do(req)
+	if err != nil {
+		return fmt.Errorf("%s %s: %w", method, path, err)
+	}
+	defer resp.Body.Close()
+	data, err := io.ReadAll(io.LimitReader(resp.Body, maxReply+1))
+	if err != nil {
+		return fmt.Errorf("%s %s: reading the reply: %w", method, path, err)
+	}
+	if len(data) > maxReply {
+		return fmt.Errorf("%s %s -> %d: reply larger than %d bytes", method, path, resp.StatusCode, maxReply)
+	}
+	if resp.StatusCode < 200 || resp.StatusCode > 299 {
+		return fmt.Errorf("%s %s -> %d %s", method, path, resp.StatusCode, snippet(data))
+	}
+	if err := json.Unmarshal(data, out); err != nil {
+		return fmt.Errorf("%s %s: decoding the reply: %w", method, path, err)
+	}
+	return nil
+}
+
+func snippet(b []byte) string {
+	s := strings.ToValidUTF8(string(b), "?")
+	if len(s) > 300 {
+		s = s[:300]
+	}
+	return s
+}
+
+func bearer(token string) (string, error) {
+	if !credential.MatchString(token) {
+		return "", fmt.Errorf("no access token")
+	}
+	return "Bearer " + token, nil
+}
+
+// Exchange trades the authorization code for an access token.
+func (a *Authentik) Exchange(ctx context.Context, code, redirectURI string) (string, error) {
+	basic := "Basic " + base64.StdEncoding.EncodeToString([]byte(clientID+":"+a.secret))
+	body := form("grant_type", "authorization_code", "code", code, "redirect_uri", redirectURI)
+	var grant struct {
+		AccessToken string `json:"access_token"`
+	}
+	if err := a.call(ctx, http.MethodPost, "/application/o/token/", basic, "application/x-www-form-urlencoded",
+		[]byte(body), &grant); err != nil {
+		return "", err
+	}
+	if !credential.MatchString(grant.AccessToken) {
+		return "", fmt.Errorf("POST /application/o/token/: no access token in the reply")
+	}
+	return grant.AccessToken, nil
+}
+
+// Username returns the username of the access token's user.
+func (a *Authentik) Username(ctx context.Context, token string) (string, error) {
+	auth, err := bearer(token)
+	if err != nil {
+		return "", err
+	}
+	var me struct {
+		User struct {
+			Username string `json:"username"`
+		} `json:"user"`
+	}
+	if err := a.call(ctx, http.MethodGet, "/api/v3/core/users/me/", auth, "", nil, &me); err != nil {
+		return "", err
+	}
+	return me.User.Username, nil
+}
+
+type tokenRequest struct {
+	Identifier  string `json:"identifier"`
+	Intent      string `json:"intent"`
+	Description string `json:"description"`
+	Expiring    bool   `json:"expiring"`
+	Expires     string `json:"expires"`
+}
+
+// AppPassword creates an app password as the token's user and returns its key.
+func (a *Authentik) AppPassword(ctx context.Context, token string, t tokenRequest) (string, error) {
+	auth, err := bearer(token)
+	if err != nil {
+		return "", err
+	}
+	body, err := json.Marshal(t)
+	if err != nil {
+		return "", err
+	}
+	var created json.RawMessage
+	if err := a.call(ctx, http.MethodPost, "/api/v3/core/tokens/", auth, "application/json", body, &created); err != nil {
+		return "", err
+	}
+	var view struct {
+		Key string `json:"key"`
+	}
+	path := "/api/v3/core/tokens/" + url.PathEscape(t.Identifier) + "/view_key/"
+	if err := a.call(ctx, http.MethodGet, path, auth, "", nil, &view); err != nil {
+		return "", err
+	}
+	if view.Key == "" {
+		return "", fmt.Errorf("GET %s: no key in the reply", path)
+	}
+	return view.Key, nil
+}
+
+// form encodes key/value pairs in the given order, like encodeURIComponent.
+func form(pairs ...string) string {
+	var b strings.Builder
+	for i := 0; i+1 < len(pairs); i += 2 {
+		if i > 0 {
+			b.WriteByte('&')
+		}
+		b.WriteString(escape(pairs[i]))
+		b.WriteByte('=')
+		b.WriteString(escape(pairs[i+1]))
+	}
+	return b.String()
+}
+
+func escape(s string) string {
+	return strings.ReplaceAll(url.QueryEscape(s), "+", "%20")
+}

wlan-setup/config.go

@@ -0,0 +1,51 @@
+package main
+
+import (
+	"errors"
+	"net/url"
+	"strings"
+)
+
+// Config is the service configuration, read from the environment.
+type Config struct {
+	ClientSecret string
+	// AuthentikURL is where the calls go; they carry Host auth.renner.uno.
+	AuthentikURL string
+	AuthorizeURL string
+	PublicURL    string
+	SigningKey   string
+	SigningCert  string
+	Listen       string
+}
+
+func loadConfig(getenv func(string) string) (Config, error) {
+	get := func(key, def string) string {
+		if v := strings.TrimSpace(getenv(key)); v != "" {
+			return v
+		}
+		return def
+	}
+	c := Config{
+		ClientSecret: strings.TrimSpace(getenv("WLAN_SETUP_CLIENT_SECRET")),
+		AuthentikURL: strings.TrimRight(get("AUTHENTIK_INTERNAL_URL", "http://authentik-server.authentik.svc.cluster.local"), "/"),
+		AuthorizeURL: get("AUTHENTIK_AUTHORIZE_URL", "https://auth.renner.uno/application/o/authorize/"),
+		PublicURL:    strings.TrimRight(get("PUBLIC_URL", "https://wlan.renner.uno"), "/"),
+		SigningKey:   get("SIGNING_KEY", "/etc/wlan-signing/tls.key"),
+		SigningCert:  get("SIGNING_CERT", "/etc/wlan-signing/tls.crt"),
+		Listen:       get("LISTEN", ":8080"),
+	}
+	var errs []error
+	if c.ClientSecret == "" {
+		errs = append(errs, errors.New("WLAN_SETUP_CLIENT_SECRET is not set"))
+	}
+	for key, v := range map[string]string{
+		"AUTHENTIK_INTERNAL_URL":  c.AuthentikURL,
+		"AUTHENTIK_AUTHORIZE_URL": c.AuthorizeURL,
+		"PUBLIC_URL":              c.PublicURL,
+	} {
+		if u, err := url.Parse(v); err != nil || (u.Scheme != "http" && u.Scheme != "https") || u.Host == "" {
+			errs = append(errs, errors.New(key+" must be an absolute http(s) URL"))
+		}
+	}
+	return c, errors.Join(errs...)
+}

wlan-setup/go.mod

@@ -0,0 +1,11 @@
+module gitea.renner.uno/konairius/homelab/wlan-setup
+
+go 1.27
+
+require (
+	github.com/beevik/etree v1.7.0
+	github.com/russellhaering/goxmldsig v1.6.1
+	howett.net/plist v1.0.1
+)
+
+require github.com/jonboulle/clockwork v0.5.0 // indirect

wlan-setup/go.sum

@@ -0,0 +1,19 @@
+github.com/beevik/etree v1.7.0 h1:xjBk9O4p4x7D1YajePjfLzdaFC4/uYUENA7P0pv6gXA=
+github.com/beevik/etree v1.7.0/go.mod h1:bh4zJxiIr62SOf9pRzN7UUYaEDa9HEKafK25+sLc0Gc=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/jessevdk/go-flags v1.4.0/go.mod h1:4FA24M0QyGHXBuZZK/XkWh8h0e1EYbRYJSGM75WSRxI=
+github.com/jonboulle/clockwork v0.5.0 h1:Hyh9A8u51kptdkR+cqRpT1EebBwTn1oK9YfGYbdFz6I=
+github.com/jonboulle/clockwork v0.5.0/go.mod h1:3mZlmanh0g2NDKO5TWZVJAfofYk64M7XN3SzBPjZF60=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/russellhaering/goxmldsig v1.6.1 h1:SB7R5ttvrGIDB2juJAK/i7DQ2Ivr7agG+ohfNJjwyYU=
+github.com/russellhaering/goxmldsig v1.6.1/go.mod h1:haZkRcLs9W/Xp989fIjP3BrTdbFQveRF0QNZSYoH09w=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v1 v1.0.0-20140924161607-9f9df34309c0/go.mod h1:WDnlLJ4WF5VGsH/HVa3CI79GS0ol3YnhVnKP89i0kNg=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+howett.net/plist v1.0.1 h1:37GdZ8tP09Q35o9ych3ehygcsL+HqKSwzctveSlarvM=
+howett.net/plist v1.0.1/go.mod h1:lqaXoTrLY4hg8tnEzNru53gicrbv7rrk+2xJA/7hw9g=

wlan-setup/index.html

@@ -0,0 +1,123 @@
+<!doctype html>
+<html lang="de">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>WLAN einrichten</title>
+<style>
+  :root { --bg: #ffffff; --fg: #1d1d1f; --muted: #5f6368; --card: #f4f5f7; --accent: #0b63ce; --code: #e9ebef; }
+  @media (prefers-color-scheme: dark) {
+    :root { --bg: #121314; --fg: #e8eaed; --muted: #9aa0a6; --card: #1e1f22; --accent: #7cacf8; --code: #2a2b2f; }
+  }
+  * { box-sizing: border-box; }
+  body { margin: 0; background: var(--bg); color: var(--fg); font: 16px/1.5 system-ui, -apple-system, "Segoe UI", Roboto, sans-serif; }
+  main { max-width: 42rem; margin: 0 auto; padding: 1.5rem 1rem 3rem; }
+  h1 { font-size: 1.6rem; margin: 0 0 .25rem; }
+  h2 { font-size: 1.15rem; margin: 0 0 .5rem; }
+  p { margin: .5rem 0; }
+  .muted { color: var(--muted); }
+  section { background: var(--card); border-radius: 12px; padding: 1rem 1.1rem; margin: 1rem 0; }
+  section.current { outline: 2px solid var(--accent); }
+  a.button, button { display: inline-block; background: var(--accent); color: #fff; border: 0; border-radius: 8px; padding: .6rem 1rem; font: inherit; text-decoration: none; cursor: pointer; }
+  @media (prefers-color-scheme: dark) { a.button, button { color: #121314; } }
+  ol { padding-left: 1.3rem; margin: .5rem 0; }
+  pre { background: var(--code); border-radius: 8px; padding: .75rem; overflow-x: auto; white-space: pre-wrap; word-break: break-all; font-size: .85rem; margin: .5rem 0; }
+  details > summary { cursor: pointer; color: var(--accent); margin: 1.5rem 0 .5rem; }
+</style>
+</head>
+<body>
+<main>
+  <h1>WLAN einrichten</h1>
+  <p>WLAN <strong>Renner UniFi</strong> für dein Konto <strong id="user">…</strong>. Android, iPhone, iPad, Mac und Windows bekommen ein eigenes WLAN-App-Passwort; Linux meldet sich mit deinem authentik-Passwort an.</p>
+
+  <div id="detected"></div>
+
+  <details id="others">
+    <summary>Andere Geräte</summary>
+    <div id="rest"></div>
+  </details>
+
+  <template id="t-android">
+    <section data-os="android">
+      <h2>Android</h2>
+      <p><a class="button" href="/android/install">Auf Android installieren</a></p>
+      <p class="muted">Das Gerät bekommt ein eigenes WLAN-App-Passwort in deinem authentik-Konto; dort gelöscht, ist das Gerät aus dem WLAN.</p>
+    </section>
+  </template>
+
+  <template id="t-apple">
+    <section data-os="apple">
+      <h2>iPhone, iPad, Mac</h2>
+      <p><a class="button" href="/apple/install">Profil laden</a></p>
+      <ol>
+        <li>iPhone/iPad: Einstellungen → „Profil geladen“ → Installieren. Mac: Systemeinstellungen → Allgemein → Geräteverwaltung → Profil doppelklicken.</li>
+        <li>Das Gerät verbindet sich danach selbst mit „Renner UniFi“.</li>
+      </ol>
+      <p class="muted">Das Gerät bekommt ein eigenes WLAN-App-Passwort in deinem authentik-Konto; dort gelöscht, ist das Gerät aus dem WLAN.</p>
+    </section>
+  </template>
+
+  <template id="t-windows">
+    <section data-os="windows">
+      <h2>Windows</h2>
+      <p><a class="button" href="/windows/install">Auf Windows installieren</a></p>
+      <p>Windows öffnet die Einstellungen und fragt, ob das WLAN-Profil hinzugefügt werden soll: „Hinzufügen“ wählen.</p>
+      <p class="muted">Das Gerät bekommt ein eigenes WLAN-App-Passwort in deinem authentik-Konto; dort gelöscht, ist das Gerät aus dem WLAN.</p>
+    </section>
+  </template>
+
+  <template id="t-linux">
+    <section data-os="linux">
+      <h2>Linux (NetworkManager)</h2>
+      <p>Im Terminal ausführen, danach fragt NetworkManager nach dem Passwort:</p>
+      <pre id="nmcli"></pre>
+      <p><button type="button" id="copy-nmcli">Befehl kopieren</button></p>
+    </section>
+  </template>
+</main>
+<script>
+(function () {
+  var ua = navigator.userAgent;
+  var os = "other";
+  if (/Android/i.test(ua)) os = "android";
+  else if (/iPhone|iPad|iPod|Macintosh/i.test(ua)) os = "apple";
+  else if (/Windows/i.test(ua)) os = "windows";
+  else if (/Linux|X11/i.test(ua)) os = "linux";
+
+  var detected = document.getElementById("detected");
+  var rest = document.getElementById("rest");
+  ["android", "apple", "windows", "linux"].forEach(function (name) {
+    var node = document.getElementById("t-" + name).content.cloneNode(true);
+    if (name === os) { node.querySelector("section").classList.add("current"); detected.appendChild(node); }
+    else rest.appendChild(node);
+  });
+  if (os === "other") document.getElementById("others").open = true;
+
+  function quote(s) { return "'" + s.replace(/'/g, "'\\''") + "'"; }
+  function render(user) {
+    document.getElementById("user").textContent = user || "(dein Benutzername)";
+    document.getElementById("nmcli").textContent =
+      "nmcli connection add type wifi con-name 'Renner UniFi' ssid 'Renner UniFi' " +
+      "wifi-sec.key-mgmt wpa-eap 802-1x.eap ttls 802-1x.phase2-auth pap " +
+      "802-1x.anonymous-identity anonymous 802-1x.identity " + quote(user || "BENUTZERNAME") + " " +
+      "802-1x.domain-suffix-match radius.renner.uno 802-1x.system-ca-certs yes " +
+      "802-1x.password-flags 2 && nmcli --ask connection up 'Renner UniFi'";
+  }
+  render("");
+  fetch("/whoami", { credentials: "same-origin" })
+    .then(function (r) { return r.ok ? r.text() : ""; })
+    .then(function (t) { render(t.trim()); })
+    .catch(function () {});
+
+  document.getElementById("copy-nmcli").addEventListener("click", function () {
+    var text = document.getElementById("nmcli").textContent;
+    var btn = this;
+    navigator.clipboard.writeText(text).then(function () {
+      btn.textContent = "Kopiert";
+      setTimeout(function () { btn.textContent = "Befehl kopieren"; }, 2000);
+    });
+  });
+})();
+</script>
+</body>
+</html>

wlan-setup/main.go

@@ -0,0 +1,59 @@
+// wlan-setup serves wlan.renner.uno behind the authentik gate: the setup page for the WLAN
+// "Renner UniFi" and, per device, an authorization-code sign-in that creates an authentik app
+// password as the user and answers with a Passpoint profile (Android, Apple) or a signed
+// CarrierProvisioning document that Windows Settings fetches once.
+package main
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"net/http"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+)
+
+func main() {
+	log := slog.New(slog.NewJSONHandler(os.Stdout, nil))
+	cfg, err := loadConfig(os.Getenv)
+	if err != nil {
+		log.Error("invalid configuration", "err", err)
+		os.Exit(2)
+	}
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer stop()
+	if err := run(ctx, cfg, log); err != nil {
+		log.Error("stopped", "err", err)
+		os.Exit(1)
+	}
+}
+
+func run(ctx context.Context, cfg Config, log *slog.Logger) error {
+	srv := &http.Server{
+		Addr:              cfg.Listen,
+		Handler:           newServer(cfg, log).routes(),
+		ReadHeaderTimeout: 10 * time.Second,
+		ReadTimeout:       30 * time.Second,
+		// A callback makes up to four authentik calls of at most 10 s each.
+		WriteTimeout:   60 * time.Second,
+		IdleTimeout:    2 * time.Minute,
+		MaxHeaderBytes: 64 << 10,
+	}
+	failed := make(chan error, 1)
+	go func() { failed <- srv.ListenAndServe() }()
+	log.Info("listening", "addr", cfg.Listen)
+
+	select {
+	case <-ctx.Done():
+	case err := <-failed:
+		if !errors.Is(err, http.ErrServerClosed) {
+			return err
+		}
+	}
+	log.Info("shutting down")
+	shutdown, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+	return srv.Shutdown(shutdown)
+}

wlan-setup/profiles.go

@@ -0,0 +1,258 @@
+package main
+
+import (
+	"bytes"
+	"encoding/base64"
+	"encoding/xml"
+	"fmt"
+	"mime"
+	"mime/multipart"
+	"net/textproto"
+
+	"github.com/beevik/etree"
+	"howett.net/plist"
+)
+
+// isrgRootX1 is the trust anchor of the radius-tls chain (DER, base64).
+const isrgRootX1 = "MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAwTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2VhcmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygch77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6UA5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sWT8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyHB5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UCB5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUvKBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWnOlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTnjh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbwqHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CIrU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkqhkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZLubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KKNFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7UrTkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdCjNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVcoyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPAmRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57demyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc="
+
+// carrierID identifies the Windows provisioning document; a reinstall replaces the profile.
+const carrierID = "{5423c37a-7530-4ce9-8f87-a2574ea006bc}"
+
+// mimeBoundary separates the parts of the Android profile.
+const mimeBoundary = "renner-passpoint-profile"
+
+// ppsNode is a node of the PPS MO management tree: a leaf carries a Value, an interior node
+// further nodes.
+type ppsNode struct {
+	XMLName      xml.Name         `xml:"Node"`
+	NodeName     string           `xml:"NodeName"`
+	RTProperties *ppsRTProperties `xml:"RTProperties,omitempty"`
+	Value        *string          `xml:"Value,omitempty"`
+	Nodes        []ppsNode        `xml:"Node"`
+}
+
+type ppsRTProperties struct {
+	DDFName string `xml:"Type>DDFName"`
+}
+
+type ppsTree struct {
+	XMLName xml.Name  `xml:"syncml:dmddf1.2 MgmtTree"`
+	VerDTD  string    `xml:"VerDTD"`
+	Nodes   []ppsNode `xml:"Node"`
+}
+
+func ppsLeaf(name, value string) ppsNode { return ppsNode{NodeName: name, Value: &value} }
+
+func ppsInterior(name string, nodes ...ppsNode) ppsNode {
+	return ppsNode{NodeName: name, Nodes: nodes}
+}
+
+// androidProfile is the application/x-wifi-config body: base64 of a MIME multipart with the
+// Passpoint R1 PPS MO and the trust anchor, each part base64.
+func androidProfile(user, password string) ([]byte, error) {
+	subscription := ppsInterior("PerProviderSubscription",
+		ppsInterior("i001",
+			ppsInterior("HomeSP", ppsLeaf("FriendlyName", "Renner"), ppsLeaf("FQDN", "renner.uno")),
+			ppsInterior("Credential",
+				ppsLeaf("Realm", "renner.uno"),
+				ppsInterior("UsernamePassword",
+					ppsLeaf("Username", user),
+					ppsLeaf("Password", base64.StdEncoding.EncodeToString([]byte(password))),
+					ppsInterior("EAPMethod", ppsLeaf("EAPType", "21"), ppsLeaf("InnerMethod", "PAP")))),
+			ppsInterior("Extension", ppsInterior("Android",
+				ppsInterior("AAAServerTrustedNames", ppsLeaf("FQDN", "radius.renner.uno"))))))
+	subscription.RTProperties = &ppsRTProperties{DDFName: "urn:wfa:mo:hotspot2dot0-perprovidersubscription:1.0"}
+	pps, err := xml.Marshal(ppsTree{VerDTD: "1.2", Nodes: []ppsNode{subscription}})
+	if err != nil {
+		return nil, fmt.Errorf("pps: %w", err)
+	}
+
+	var parts bytes.Buffer
+	mw := multipart.NewWriter(&parts)
+	if err := mw.SetBoundary(mimeBoundary); err != nil {
+		return nil, err
+	}
+	for _, p := range []struct{ contentType, body string }{
+		{"application/x-passpoint-profile", base64.StdEncoding.EncodeToString(pps)},
+		{"application/x-x509-ca-cert", isrgRootX1},
+	} {
+		w, err := mw.CreatePart(textproto.MIMEHeader{
+			"Content-Type":              {p.contentType},
+			"Content-Transfer-Encoding": {"base64"},
+		})
+		if err != nil {
+			return nil, err
+		}
+		if _, err := w.Write([]byte(p.body)); err != nil {
+			return nil, err
+		}
+	}
+	if err := mw.Close(); err != nil {
+		return nil, err
+	}
+
+	var message bytes.Buffer
+	fmt.Fprintf(&message, "Content-Type: %s\r\nContent-Transfer-Encoding: base64\r\n\r\n",
+		mime.FormatMediaType("multipart/mixed", map[string]string{"boundary": mw.Boundary()}))
+	message.Write(parts.Bytes())
+	return []byte(base64.StdEncoding.EncodeToString(message.Bytes())), nil
+}
+
+type appleEAP struct {
+	UserName                string
+	UserPassword            string
+	OuterIdentity           string
+	AcceptEAPTypes          []int
+	TTLSInnerAuthentication string
+	TLSTrustedServerNames   []string
+}
+
+type appleWiFi struct {
+	PayloadType                   string
+	PayloadVersion                int
+	PayloadIdentifier             string
+	PayloadUUID                   string
+	PayloadDisplayName            string
+	PayloadOrganization           string
+	IsHotspot                     bool
+	DomainName                    string
+	NAIRealmNames                 []string
+	DisplayedOperatorName         string
+	ServiceProviderRoamingEnabled bool
+	AutoJoin                      bool
+	EncryptionType                string
+	EAPClientConfiguration        appleEAP
+}
+
+type appleConfiguration struct {
+	PayloadContent      []appleWiFi
+	PayloadType         string
+	PayloadVersion      int
+	PayloadIdentifier   string
+	PayloadUUID         string
+	PayloadDisplayName  string
+	PayloadOrganization string
+}
+
+// appleProfile is the .mobileconfig: com.apple.wifi.managed with Passpoint matching. Fixed
+// identifiers and UUIDs, so a reinstall replaces the previous profile.
+func appleProfile(user, password string) ([]byte, error) {
+	return plist.MarshalIndent(appleConfiguration{
+		PayloadContent: []appleWiFi{{
+			PayloadType:                   "com.apple.wifi.managed",
+			PayloadVersion:                1,
+			PayloadIdentifier:             "uno.renner.wifi.renner-unifi.network",
+			PayloadUUID:                   "824959bf-c55d-4ed2-b569-c33f3759c2b6",
+			PayloadDisplayName:            "Renner UniFi",
+			PayloadOrganization:           "Renner",
+			IsHotspot:                     true,
+			DomainName:                    "renner.uno",
+			NAIRealmNames:                 []string{"renner.uno"},
+			DisplayedOperatorName:         "Renner",
+			ServiceProviderRoamingEnabled: false,
+			AutoJoin:                      true,
+			EncryptionType:                "Any",
+			EAPClientConfiguration: appleEAP{
+				UserName:                user,
+				UserPassword:            password,
+				OuterIdentity:           "anonymous",
+				AcceptEAPTypes:          []int{21},
+				TTLSInnerAuthentication: "PAP",
+				TLSTrustedServerNames:   []string{"radius.renner.uno"},
+			},
+		}},
+		PayloadType:         "Configuration",
+		PayloadVersion:      1,
+		PayloadIdentifier:   "uno.renner.wifi.renner-unifi",
+		PayloadUUID:         "7175a2a3-ddd3-42ea-b4ad-b7e5501892f3",
+		PayloadDisplayName:  "WLAN Renner UniFi",
+		PayloadOrganization: "Renner",
+	}, plist.XMLFormat, "\t")
+}
+
+// Namespaces of the CarrierProvisioning document.
+const (
+	nsCarrierControl  = "http://www.microsoft.com/networking/CarrierControl/v1"
+	nsWLAN            = "http://www.microsoft.com/networking/CarrierControl/WLAN/v1"
+	nsOneX            = "http://www.microsoft.com/networking/OneX/v1"
+	nsEapHostConfig   = "http://www.microsoft.com/provisioning/EapHostConfig"
+	nsEapCommon       = "http://www.microsoft.com/provisioning/EapCommon"
+	nsEapTtlsConn     = "http://www.microsoft.com/provisioning/EapTtlsConnectionPropertiesV1"
+	nsEapHostUserCred = "http://www.microsoft.com/provisioning/EapHostUserCredentials"
+	nsEapTtlsUser     = "http://www.microsoft.com/provisioning/EapTtlsUserPropertiesV1"
+)
+
+// add appends an element named tag to parent. ns, when set, becomes its default namespace.
+func add(parent *etree.Element, tag, ns string) *etree.Element {
+	el := parent.CreateElement(tag)
+	if ns != "" {
+		el.CreateAttr("xmlns", ns)
+	}
+	return el
+}
+
+// addText appends an element named tag with text content to parent.
+func addText(parent *etree.Element, tag, ns, text string) *etree.Element {
+	el := add(parent, tag, ns)
+	el.SetText(text)
+	return el
+}
+
+// windowsProfile is the unsigned CarrierProvisioning document: one Hotspot 2.0 WLAN profile
+// (domain and NAI realm renner.uno), WPA3-Enterprise, EAP-TTLS with inner PAP, and the user's
+// credentials. Valid against the schemas Windows ships in %SYSTEMROOT%\schemas\provisioning
+// (TestWindowsProfileSchema); SubscriberId is base:SubscriberType, i.e. \w+ and at most 20
+// characters.
+func windowsProfile(user, password string) *etree.Document {
+	doc := etree.NewDocument()
+	doc.WriteSettings = etree.WriteSettings{CanonicalEndTags: true, CanonicalText: true, CanonicalAttrVal: true}
+	doc.CreateProcInst("xml", `version="1.0"`)
+	doc.CreateText("\n")
+	root := add(&doc.Element, "CarrierProvisioning", nsCarrierControl)
+
+	global := add(root, "Global", "")
+	addText(global, "CarrierId", "", carrierID)
+	addText(global, "SubscriberId", "", "rennerunifi")
+
+	wlan := add(add(root, "WLANProfiles", ""), "WLANProfile", nsWLAN)
+	addText(wlan, "name", "", "Renner UniFi")
+	addText(add(add(wlan, "SSIDConfig", ""), "SSID", ""), "name", "", "Renner UniFi")
+	hotspot2 := add(wlan, "Hotspot2", "")
+	addText(hotspot2, "DomainName", "", "renner.uno")
+	addText(add(hotspot2, "NAIRealm", ""), "name", "", "renner.uno")
+
+	security := add(add(wlan, "MSM", ""), "security", "")
+	auth := add(security, "authEncryption", "")
+	addText(auth, "authentication", "", "WPA3ENT")
+	addText(auth, "encryption", "", "AES")
+	addText(auth, "useOneX", "", "true")
+
+	oneX := add(security, "OneX", nsOneX)
+	addText(oneX, "authMode", "", "user")
+	eapHost := add(add(oneX, "EAPConfig", ""), "EapHostConfig", nsEapHostConfig)
+	method := add(eapHost, "EapMethod", "")
+	addText(method, "Type", nsEapCommon, "21")
+	addText(method, "VendorId", nsEapCommon, "0")
+	addText(method, "VendorType", nsEapCommon, "0")
+	addText(method, "AuthorId", nsEapCommon, "311")
+	ttls := add(add(eapHost, "Config", ""), "EapTtls", nsEapTtlsConn)
+	validation := add(ttls, "ServerValidation", "")
+	addText(validation, "ServerNames", "", "radius.renner.uno")
+	addText(validation, "TrustedRootCAHash", "", "ca bd 2a 79 a1 07 6a 31 f2 1d 25 36 35 cb 03 9d 43 29 a5 e8")
+	addText(validation, "DisablePrompt", "", "true")
+	add(add(ttls, "Phase2Authentication", ""), "PAPAuthentication", "")
+	identity := add(ttls, "Phase1Identity", "")
+	addText(identity, "IdentityPrivacy", "", "true")
+	addText(identity, "AnonymousIdentity", "", "anonymous")
+
+	userCred := add(security, "EapHostUserCredentials", nsEapHostUserCred)
+	userCred.CreateAttr("xmlns:eapCommon", nsEapCommon)
+	userMethod := add(userCred, "EapMethod", "")
+	addText(userMethod, "eapCommon:Type", "", "21")
+	addText(userMethod, "eapCommon:AuthorId", "", "311")
+	credentials := add(add(userCred, "Credentials", ""), "EapTtls", nsEapTtlsUser)
+	addText(credentials, "Username", "", user)
+	addText(credentials, "Password", "", password)
+	return doc
+}

wlan-setup/server.go

@@ -0,0 +1,249 @@
+package main
+
+import (
+	"crypto/rand"
+	"crypto/subtle"
+	_ "embed"
+	"encoding/base64"
+	"io"
+	"log/slog"
+	"net/http"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+)
+
+//go:embed index.html
+var indexHTML []byte
+
+const (
+	clientID     = "wlan-setup"
+	stateCookie  = "wlan_oauth_state"
+	lifetimeDays = 29
+	restart      = "Bitte die Einrichtung neu starten.\n"
+	failed       = "Die Einrichtung ist fehlgeschlagen.\n"
+)
+
+// userPattern admits only plain usernames into a generated file.
+var userPattern = regexp.MustCompile(`^[A-Za-z0-9._@+-]{1,64}$`)
+
+var identifierUnsafe = regexp.MustCompile(`[^a-z0-9-]`)
+
+var platformLabels = map[string]string{"android": "Android", "apple": "Apple", "windows": "Windows"}
+
+// Server serves the setup page and the per-platform flows.
+type Server struct {
+	cfg       Config
+	authentik *Authentik
+	profiles  *ProfileStore
+	now       func() time.Time
+	log       *slog.Logger
+}
+
+func newServer(cfg Config, log *slog.Logger) *Server {
+	return &Server{
+		cfg:       cfg,
+		authentik: &Authentik{base: cfg.AuthentikURL, secret: cfg.ClientSecret, http: &http.Client{Timeout: 10 * time.Second}},
+		profiles:  newProfileStore(time.Now),
+		now:       time.Now,
+		log:       log,
+	}
+}
+
+func (s *Server) routes() http.Handler {
+	mux := http.NewServeMux()
+	mux.HandleFunc("GET /{$}", func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		_, _ = w.Write(indexHTML)
+	})
+	mux.HandleFunc("GET /whoami", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/plain")
+		if u := r.Header.Get("X-authentik-username"); userPattern.MatchString(u) {
+			_, _ = io.WriteString(w, u)
+		}
+	})
+	mux.HandleFunc("GET /healthz", func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "text/plain")
+		_, _ = io.WriteString(w, "ok\n")
+	})
+	for name := range platformLabels {
+		mux.HandleFunc("GET /"+name+"/install", func(w http.ResponseWriter, r *http.Request) { s.install(w, r, name) })
+		mux.HandleFunc("GET /"+name+"/callback", func(w http.ResponseWriter, r *http.Request) { s.callback(w, r, name) })
+	}
+	mux.HandleFunc("GET /windows/profile/{token}", s.windowsProfile)
+	mux.HandleFunc("/", http.NotFound)
+	return noStore(mux)
+}
+
+func noStore(h http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Cache-Control", "no-store")
+		h.ServeHTTP(w, r)
+	})
+}
+
+func random(n int) string {
+	b := make([]byte, n)
+	_, _ = rand.Read(b)
+	return base64.RawURLEncoding.EncodeToString(b)
+}
+
+func (s *Server) redirectURI(name string) string { return s.cfg.PublicURL + "/" + name + "/callback" }
+
+func setStateCookie(w http.ResponseWriter, name, value string, maxAge int) {
+	w.Header().Set("Set-Cookie", stateCookie+"="+value+"; Path=/"+name+"/; Max-Age="+strconv.Itoa(maxAge)+
+		"; HttpOnly; Secure; SameSite=Lax")
+}
+
+func redirect(w http.ResponseWriter, location string) {
+	w.Header().Set("Location", location)
+	w.WriteHeader(http.StatusFound)
+}
+
+func text(w http.ResponseWriter, status int, body string) {
+	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	w.WriteHeader(status)
+	_, _ = io.WriteString(w, body)
+}
+
+// install starts an authorization-code sign-in at authentik; the user is already signed in there.
+func (s *Server) install(w http.ResponseWriter, _ *http.Request, name string) {
+	state := random(24)
+	setStateCookie(w, name, state, 300)
+	redirect(w, s.cfg.AuthorizeURL+"?"+form(
+		"response_type", "code",
+		"client_id", clientID,
+		"redirect_uri", s.redirectURI(name),
+		"scope", "openid profile goauthentik.io/api",
+		"state", state,
+	))
+}
+
+func stateFrom(r *http.Request) string {
+	c, err := r.Cookie(stateCookie)
+	if err != nil {
+		return ""
+	}
+	return c.Value
+}
+
+// callback creates a new app password as the user and answers with the platform's profile.
+func (s *Server) callback(w http.ResponseWriter, r *http.Request, name string) {
+	q := r.URL.Query()
+	state, code := stateFrom(r), q.Get("code")
+	if state == "" || code == "" || subtle.ConstantTimeCompare([]byte(state), []byte(q.Get("state"))) != 1 {
+		text(w, http.StatusBadRequest, restart)
+		return
+	}
+	fail := func(reason string, args ...any) {
+		s.log.Error("wlan-setup "+name+": "+reason, args...)
+		text(w, http.StatusBadGateway, failed)
+	}
+
+	// Windows signs the profile: without key and chain there is nothing to hand out, so no app
+	// password is created.
+	var signer *Signer
+	if name == "windows" {
+		var err error
+		if signer, err = loadSigner(s.cfg.SigningKey, s.cfg.SigningCert); err != nil {
+			fail("cannot load the signing key", "err", err)
+			return
+		}
+	}
+
+	ctx := r.Context()
+	access, err := s.authentik.Exchange(ctx, code, s.redirectURI(name))
+	if err != nil {
+		fail("token exchange", "err", err)
+		return
+	}
+	user, err := s.authentik.Username(ctx, access)
+	if err != nil {
+		fail("user lookup", "err", err)
+		return
+	}
+	if !userPattern.MatchString(user) || user != r.Header.Get("X-authentik-username") {
+		s.log.Warn("wlan-setup "+name+": the token's user is not the signed-in user", "user", user)
+		w.WriteHeader(http.StatusForbidden)
+		return
+	}
+
+	now := s.now().UTC()
+	suffix := strings.Map(func(c rune) rune {
+		if (c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z') || (c >= '0' && c <= '9') {
+			return c
+		}
+		return 'x'
+	}, random(24)[:6])
+	identifier := "wlan-" + name + "-" + identifierUnsafe.ReplaceAllString(strings.ToLower(user), "-") + "-" +
+		now.Format("20060102T150405") + "-" + suffix
+	key, err := s.authentik.AppPassword(ctx, access, tokenRequest{
+		Identifier:  identifier,
+		Intent:      "app_password",
+		Description: "WLAN " + platformLabels[name] + ", " + now.Format("2006-01-02") + " (wlan.renner.uno)",
+		Expiring:    true,
+		Expires:     now.Add(lifetimeDays * 24 * time.Hour).Format("2006-01-02T15:04:05.000Z07:00"),
+	})
+	if err != nil {
+		fail("app password", "err", err)
+		return
+	}
+
+	switch name {
+	case "android":
+		body, err := androidProfile(user, key)
+		if err != nil {
+			fail("building the profile", "err", err)
+			return
+		}
+		setStateCookie(w, name, "", 0)
+		w.Header().Set("Content-Type", "application/x-wifi-config")
+		w.Header().Set("Content-Transfer-Encoding", "base64")
+		_, _ = w.Write(body)
+	case "apple":
+		body, err := appleProfile(user, key)
+		if err != nil {
+			fail("building the profile", "err", err)
+			return
+		}
+		setStateCookie(w, name, "", 0)
+		w.Header().Set("Content-Type", "application/x-apple-aspen-config")
+		w.Header().Set("Content-Disposition", `attachment; filename="renner-unifi.mobileconfig"`)
+		_, _ = w.Write(body)
+	case "windows":
+		body, err := signer.Sign(windowsProfile(user, key))
+		if err != nil {
+			fail("signing the profile", "err", err)
+			return
+		}
+		token := random(32)
+		if !s.profiles.Put(token, body) {
+			fail("too many profiles waiting to be fetched")
+			return
+		}
+		setStateCookie(w, name, "", 0)
+		redirect(w, "ms-settings:wifi-provisioning?uri="+s.cfg.PublicURL+"/windows/profile/"+token)
+	}
+}
+
+// windowsProfile hands out a signed profile once. Windows Settings fetches it without the
+// authentik session: the unguessable single-use token is the only gate.
+func (s *Server) windowsProfile(w http.ResponseWriter, r *http.Request) {
+	token := r.PathValue("token")
+	if r.Method == http.MethodHead {
+		if !s.profiles.Has(token) {
+			http.NotFound(w, r)
+			return
+		}
+		w.Header().Set("Content-Type", "text/xml")
+		return
+	}
+	body, ok := s.profiles.Take(token)
+	if !ok {
+		http.NotFound(w, r)
+		return
+	}
+	w.Header().Set("Content-Type", "text/xml")
+	_, _ = w.Write(body)
+}

wlan-setup/server_test.go

@@ -0,0 +1,880 @@
+package main
+
+import (
+	"bufio"
+	"bytes"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha1"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/base64"
+	"encoding/json"
+	"encoding/pem"
+	"encoding/xml"
+	"io"
+	"log/slog"
+	"math/big"
+	"mime"
+	"mime/multipart"
+	"net/http"
+	"net/http/httptest"
+	"net/textproto"
+	"net/url"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"reflect"
+	"regexp"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/beevik/etree"
+	dsig "github.com/russellhaering/goxmldsig"
+	"howett.net/plist"
+)
+
+const (
+	testSecret = "client-secret"
+	testAccess = "access-token-123"
+	testKey    = "app-password-<&>-456"
+	testCode   = "code-789"
+)
+
+// fakeAuthentik answers the four calls of a callback and records what it received.
+type fakeAuthentik struct {
+	t        *testing.T
+	username string
+	fail     string // path that answers 500
+
+	mu       sync.Mutex
+	requests []string
+	created  tokenRequest
+}
+
+func (f *fakeAuthentik) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	f.mu.Lock()
+	f.requests = append(f.requests, r.Method+" "+r.URL.Path)
+	f.mu.Unlock()
+	t := f.t
+	if r.Host != "auth.renner.uno" {
+		t.Errorf("%s: Host %q", r.URL.Path, r.Host)
+	}
+	if r.Header.Get("Cookie") != "" {
+		t.Errorf("%s: a cookie reached authentik", r.URL.Path)
+	}
+	if r.URL.Path == f.fail {
+		http.Error(w, `{"detail":"broken"}`, http.StatusInternalServerError)
+		return
+	}
+	bearer := func() bool {
+		if got := r.Header.Get("Authorization"); got != "Bearer "+testAccess {
+			t.Errorf("%s: Authorization %q", r.URL.Path, got)
+			return false
+		}
+		return true
+	}
+	switch {
+	case r.Method == http.MethodPost && r.URL.Path == "/application/o/token/":
+		user, pass, ok := r.BasicAuth()
+		if !ok || user != "wlan-setup" || pass != testSecret {
+			t.Errorf("token: Basic auth %q %v", user, ok)
+		}
+		if ct := r.Header.Get("Content-Type"); ct != "application/x-www-form-urlencoded" {
+			t.Errorf("token: Content-Type %q", ct)
+		}
+		if err := r.ParseForm(); err != nil {
+			t.Fatal(err)
+		}
+		if r.PostForm.Get("grant_type") != "authorization_code" || r.PostForm.Get("code") != testCode {
+			t.Errorf("token: form %v", r.PostForm)
+		}
+		platform := strings.Split(r.PostForm.Get("redirect_uri"), "/")[3]
+		if want := "https://wlan.renner.uno/" + platform + "/callback"; r.PostForm.Get("redirect_uri") != want {
+			t.Errorf("token: redirect_uri %q", r.PostForm.Get("redirect_uri"))
+		}
+		_, _ = io.WriteString(w, `{"access_token":"`+testAccess+`","token_type":"Bearer"}`)
+	case r.Method == http.MethodGet && r.URL.Path == "/api/v3/core/users/me/":
+		if bearer() {
+			_ = json.NewEncoder(w).Encode(map[string]any{"user": map[string]any{"username": f.username}})
+		}
+	case r.Method == http.MethodPost && r.URL.Path == "/api/v3/core/tokens/":
+		if !bearer() {
+			return
+		}
+		if ct := r.Header.Get("Content-Type"); ct != "application/json" {
+			t.Errorf("tokens: Content-Type %q", ct)
+		}
+		var tr tokenRequest
+		if err := json.NewDecoder(r.Body).Decode(&tr); err != nil {
+			t.Fatal(err)
+		}
+		f.mu.Lock()
+		f.created = tr
+		f.mu.Unlock()
+		w.WriteHeader(http.StatusCreated)
+		_, _ = io.WriteString(w, `{"identifier":"`+tr.Identifier+`"}`)
+	case r.Method == http.MethodGet && strings.HasPrefix(r.URL.Path, "/api/v3/core/tokens/") &&
+		strings.HasSuffix(r.URL.Path, "/view_key/"):
+		f.mu.Lock()
+		want := "/api/v3/core/tokens/" + f.created.Identifier + "/view_key/"
+		f.mu.Unlock()
+		if r.URL.Path != want {
+			t.Errorf("view_key: path %q, want %q", r.URL.Path, want)
+		}
+		if bearer() {
+			_ = json.NewEncoder(w).Encode(map[string]string{"key": testKey})
+		}
+	default:
+		t.Errorf("unexpected call %s %s", r.Method, r.URL.Path)
+		http.NotFound(w, r)
+	}
+}
+
+type testCert struct {
+	cert     *x509.Certificate
+	keyFile  string
+	certFile string
+}
+
+// writeSigningFiles writes a fresh RSA key (PKCS#8) and a chain of a self-signed leaf plus a
+// second certificate, as cert-manager would mount them.
+func writeSigningFiles(t *testing.T) testCert {
+	t.Helper()
+	dir := t.TempDir()
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatal(err)
+	}
+	mk := func(cn string, k *rsa.PrivateKey) []byte {
+		tmpl := &x509.Certificate{
+			SerialNumber: big.NewInt(time.Now().UnixNano()),
+			Subject:      pkix.Name{CommonName: cn},
+			NotBefore:    time.Now().Add(-time.Hour),
+			NotAfter:     time.Now().Add(time.Hour),
+			KeyUsage:     x509.KeyUsageDigitalSignature,
+		}
+		der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &k.PublicKey, k)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return der
+	}
+	leaf := mk("wlan.renner.uno", key)
+	other, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatal(err)
+	}
+	intermediate := mk("intermediate", other)
+	pkcs8, err := x509.MarshalPKCS8PrivateKey(key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	tc := testCert{keyFile: filepath.Join(dir, "tls.key"), certFile: filepath.Join(dir, "tls.crt")}
+	if err := os.WriteFile(tc.keyFile, pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: pkcs8}), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	chain := append(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: leaf}),
+		pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: intermediate})...)
+	if err := os.WriteFile(tc.certFile, chain, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	tc.cert, _ = x509.ParseCertificate(leaf)
+	return tc
+}
+
+type harness struct {
+	srv     *Server
+	handler http.Handler
+	fake    *fakeAuthentik
+	signing testCert
+	clock   *fakeClock
+}
+
+type fakeClock struct {
+	mu  sync.Mutex
+	now time.Time
+}
+
+func (c *fakeClock) Now() time.Time { c.mu.Lock(); defer c.mu.Unlock(); return c.now }
+func (c *fakeClock) Add(d time.Duration) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.now = c.now.Add(d)
+}
+
+func newHarness(t *testing.T) *harness {
+	t.Helper()
+	fake := &fakeAuthentik{t: t, username: "Alice.Smith"}
+	upstream := httptest.NewServer(fake)
+	t.Cleanup(upstream.Close)
+	signing := writeSigningFiles(t)
+	cfg, err := loadConfig(env(map[string]string{
+		"WLAN_SETUP_CLIENT_SECRET": testSecret,
+		"AUTHENTIK_INTERNAL_URL":   upstream.URL,
+		"SIGNING_KEY":              signing.keyFile,
+		"SIGNING_CERT":             signing.certFile,
+	}))
+	if err != nil {
+		t.Fatal(err)
+	}
+	srv := newServer(cfg, slog.New(slog.NewTextHandler(io.Discard, nil)))
+	clock := &fakeClock{now: time.Date(2026, 11, 5, 9, 8, 7, 0, time.UTC)}
+	srv.now = clock.Now
+	srv.profiles.now = clock.Now
+	return &harness{srv: srv, handler: srv.routes(), fake: fake, signing: signing, clock: clock}
+}
+
+func env(m map[string]string) func(string) string { return func(k string) string { return m[k] } }
+
+func (h *harness) do(req *http.Request) *httptest.ResponseRecorder {
+	rec := httptest.NewRecorder()
+	h.handler.ServeHTTP(rec, req)
+	if rec.Header().Get("Cache-Control") != "no-store" {
+		panic("no Cache-Control: no-store on " + req.URL.Path)
+	}
+	return rec
+}
+
+func (h *harness) callback(platform, cookieState, queryState, user string) *httptest.ResponseRecorder {
+	q := url.Values{"state": {queryState}, "code": {testCode}}
+	req := httptest.NewRequest(http.MethodGet, "/"+platform+"/callback?"+q.Encode(), nil)
+	if cookieState != "" {
+		req.Header.Set("Cookie", "other=1; wlan_oauth_state="+cookieState)
+	}
+	req.Header.Set("X-authentik-username", user)
+	return h.do(req)
+}
+
+func TestInstall(t *testing.T) {
+	h := newHarness(t)
+	for _, platform := range []string{"android", "apple", "windows"} {
+		rec := h.do(httptest.NewRequest(http.MethodGet, "/"+platform+"/install", nil))
+		if rec.Code != http.StatusFound {
+			t.Fatalf("%s: status %d", platform, rec.Code)
+		}
+		cookie := rec.Header().Get("Set-Cookie")
+		m := regexp.MustCompile(`^wlan_oauth_state=([A-Za-z0-9_-]{32}); Path=/` + platform +
+			`/; Max-Age=300; HttpOnly; Secure; SameSite=Lax$`).FindStringSubmatch(cookie)
+		if m == nil {
+			t.Fatalf("%s: cookie %q", platform, cookie)
+		}
+		loc := rec.Header().Get("Location")
+		if !strings.HasPrefix(loc, "https://auth.renner.uno/application/o/authorize/?response_type=code&") {
+			t.Errorf("%s: location %q", platform, loc)
+		}
+		if !strings.Contains(loc, "scope=openid%20profile%20goauthentik.io%2Fapi") {
+			t.Errorf("%s: scope not encoded like encodeURIComponent: %q", platform, loc)
+		}
+		u, err := url.Parse(loc)
+		if err != nil {
+			t.Fatal(err)
+		}
+		q := u.Query()
+		if q.Get("client_id") != "wlan-setup" || q.Get("redirect_uri") != "https://wlan.renner.uno/"+platform+"/callback" ||
+			q.Get("scope") != "openid profile goauthentik.io/api" || q.Get("state") != m[1] || q.Get("response_type") != "code" {
+			t.Errorf("%s: query %v", platform, q)
+		}
+	}
+}
+
+func TestCallbackStateMismatch(t *testing.T) {
+	h := newHarness(t)
+	for _, c := range []struct{ cookie, query string }{{"abc", "abd"}, {"", "abc"}, {"abc", ""}} {
+		rec := h.callback("android", c.cookie, c.query, "Alice.Smith")
+		if rec.Code != http.StatusBadRequest || rec.Body.String() != "Bitte die Einrichtung neu starten.\n" {
+			t.Errorf("%+v: %d %q", c, rec.Code, rec.Body.String())
+		}
+	}
+	req := httptest.NewRequest(http.MethodGet, "/apple/callback?state=abc", nil)
+	req.Header.Set("Cookie", "wlan_oauth_state=abc")
+	if rec := h.do(req); rec.Code != http.StatusBadRequest {
+		t.Errorf("no code: %d", rec.Code)
+	}
+	if len(h.fake.requests) != 0 {
+		t.Errorf("authentik was called: %v", h.fake.requests)
+	}
+}
+
+func TestCallbackUserMismatch(t *testing.T) {
+	h := newHarness(t)
+	if rec := h.callback("android", "s", "s", "bob"); rec.Code != http.StatusForbidden {
+		t.Errorf("other user: %d", rec.Code)
+	}
+	h.fake.username = "bad user"
+	if rec := h.callback("apple", "s", "s", "bad user"); rec.Code != http.StatusForbidden {
+		t.Errorf("unsafe username: %d", rec.Code)
+	}
+	for _, r := range h.fake.requests {
+		if strings.HasPrefix(r, "POST /api/v3/core/tokens/") {
+			t.Errorf("an app password was created for a mismatched user")
+		}
+	}
+}
+
+func TestCallbackUpstreamError(t *testing.T) {
+	for _, path := range []string{"/application/o/token/", "/api/v3/core/users/me/", "/api/v3/core/tokens/"} {
+		h := newHarness(t)
+		h.fake.fail = path
+		rec := h.callback("android", "s", "s", "Alice.Smith")
+		if rec.Code != http.StatusBadGateway || rec.Body.String() != "Die Einrichtung ist fehlgeschlagen.\n" {
+			t.Errorf("%s: %d %q", path, rec.Code, rec.Body.String())
+		}
+		if strings.Contains(rec.Header().Get("Set-Cookie"), "Max-Age=0") {
+			t.Errorf("%s: the state cookie was cleared on failure", path)
+		}
+	}
+}
+
+func TestCallbackWindowsWithoutSigningKey(t *testing.T) {
+	h := newHarness(t)
+	h.srv.cfg.SigningKey = filepath.Join(t.TempDir(), "missing.key")
+	if rec := h.callback("windows", "s", "s", "Alice.Smith"); rec.Code != http.StatusBadGateway {
+		t.Errorf("status %d", rec.Code)
+	}
+	if len(h.fake.requests) != 0 {
+		t.Errorf("authentik was called without a signing key: %v", h.fake.requests)
+	}
+}
+
+func checkCreated(t *testing.T, h *harness, platform, label string) {
+	t.Helper()
+	got := h.fake.created
+	if !regexp.MustCompile(`^wlan-` + platform + `-alice-smith-20261105T090807-[A-Za-z0-9]{6}$`).MatchString(got.Identifier) {
+		t.Errorf("identifier %q", got.Identifier)
+	}
+	if got.Intent != "app_password" || !got.Expiring || got.Expires != "2026-12-04T09:08:07.000Z" ||
+		got.Description != "WLAN "+label+", 2026-11-05 (wlan.renner.uno)" {
+		t.Errorf("token request %+v", got)
+	}
+	want := []string{"POST /application/o/token/", "GET /api/v3/core/users/me/", "POST /api/v3/core/tokens/",
+		"GET /api/v3/core/tokens/" + got.Identifier + "/view_key/"}
+	if strings.Join(h.fake.requests, "|") != strings.Join(want, "|") {
+		t.Errorf("calls %v", h.fake.requests)
+	}
+}
+
+func checkCleared(t *testing.T, rec *httptest.ResponseRecorder, platform string) {
+	t.Helper()
+	if got := rec.Header().Get("Set-Cookie"); got != "wlan_oauth_state=; Path=/"+platform+"/; Max-Age=0; HttpOnly; Secure; SameSite=Lax" {
+		t.Errorf("cookie %q", got)
+	}
+}
+
+func TestCallbackAndroid(t *testing.T) {
+	h := newHarness(t)
+	rec := h.callback("android", "s", "s", "Alice.Smith")
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status %d %q", rec.Code, rec.Body.String())
+	}
+	checkCreated(t, h, "android", "Android")
+	checkCleared(t, rec, "android")
+	if rec.Header().Get("Content-Type") != "application/x-wifi-config" ||
+		rec.Header().Get("Content-Transfer-Encoding") != "base64" || rec.Header().Get("Content-Disposition") != "" {
+		t.Errorf("headers %v", rec.Header())
+	}
+	raw, err := base64.StdEncoding.DecodeString(rec.Body.String())
+	if err != nil {
+		t.Fatal(err)
+	}
+	msg, err := textproto.NewReader(bufio.NewReader(bytes.NewReader(raw))).ReadMIMEHeader()
+	if err != nil {
+		t.Fatal(err)
+	}
+	mediaType, params, err := mime.ParseMediaType(msg.Get("Content-Type"))
+	if err != nil || mediaType != "multipart/mixed" || params["boundary"] == "" ||
+		msg.Get("Content-Transfer-Encoding") != "base64" {
+		t.Fatalf("message header %v", msg)
+	}
+	body := raw[bytes.Index(raw, []byte("\r\n\r\n"))+4:]
+	mr := multipart.NewReader(bytes.NewReader(body), params["boundary"])
+	parts := map[string][]byte{}
+	var order []string
+	for {
+		p, err := mr.NextRawPart()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			t.Fatal(err)
+		}
+		if p.Header.Get("Content-Transfer-Encoding") != "base64" {
+			t.Errorf("part %v is not base64", p.Header)
+		}
+		b, err := io.ReadAll(p)
+		if err != nil {
+			t.Fatal(err)
+		}
+		ct := p.Header.Get("Content-Type")
+		order = append(order, ct)
+		parts[ct] = b
+	}
+	if strings.Join(order, ",") != "application/x-passpoint-profile,application/x-x509-ca-cert" {
+		t.Errorf("parts %v", order)
+	}
+	if string(parts["application/x-x509-ca-cert"]) != isrgRootX1 {
+		t.Error("the trust anchor part is not ISRG Root X1")
+	}
+	pps, err := base64.StdEncoding.DecodeString(string(parts["application/x-passpoint-profile"]))
+	if err != nil {
+		t.Fatal(err)
+	}
+	type node struct {
+		Name  string  `xml:"NodeName"`
+		DDF   string  `xml:"RTProperties>Type>DDFName"`
+		Value *string `xml:"Value"`
+		Nodes []node  `xml:"Node"`
+	}
+	var tree struct {
+		XMLName xml.Name
+		VerDTD  string `xml:"VerDTD"`
+		Nodes   []node `xml:"Node"`
+	}
+	if err := xml.Unmarshal(pps, &tree); err != nil {
+		t.Fatalf("pps: %v\n%s", err, pps)
+	}
+	if tree.XMLName != (xml.Name{Space: "syncml:dmddf1.2", Local: "MgmtTree"}) || tree.VerDTD != "1.2" ||
+		len(tree.Nodes) != 1 || tree.Nodes[0].Name != "PerProviderSubscription" ||
+		tree.Nodes[0].DDF != "urn:wfa:mo:hotspot2dot0-perprovidersubscription:1.0" {
+		t.Fatalf("pps %s", pps)
+	}
+	// value follows NodeNames below PerProviderSubscription/i001.
+	value := func(path string) string {
+		nodes := tree.Nodes[0].Nodes
+		var cur *node
+		for _, name := range strings.Split("i001/"+path, "/") {
+			cur = nil
+			for i := range nodes {
+				if nodes[i].Name == name {
+					cur = &nodes[i]
+				}
+			}
+			if cur == nil {
+				return "<no node>"
+			}
+			nodes = cur.Nodes
+		}
+		if cur.Value == nil {
+			return "<no value>"
+		}
+		return *cur.Value
+	}
+	for path, want := range map[string]string{
+		"HomeSP/FriendlyName":                               "Renner",
+		"HomeSP/FQDN":                                       "renner.uno",
+		"Credential/Realm":                                  "renner.uno",
+		"Credential/UsernamePassword/Username":              "Alice.Smith",
+		"Credential/UsernamePassword/Password":              base64.StdEncoding.EncodeToString([]byte(testKey)),
+		"Credential/UsernamePassword/EAPMethod/EAPType":     "21",
+		"Credential/UsernamePassword/EAPMethod/InnerMethod": "PAP",
+		"Extension/Android/AAAServerTrustedNames/FQDN":      "radius.renner.uno",
+	} {
+		if got := value(path); got != want {
+			t.Errorf("%s = %q, want %q", path, got, want)
+		}
+	}
+}
+
+func TestCallbackApple(t *testing.T) {
+	h := newHarness(t)
+	rec := h.callback("apple", "s", "s", "Alice.Smith")
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status %d %q", rec.Code, rec.Body.String())
+	}
+	checkCreated(t, h, "apple", "Apple")
+	checkCleared(t, rec, "apple")
+	if rec.Header().Get("Content-Type") != "application/x-apple-aspen-config" ||
+		rec.Header().Get("Content-Disposition") != `attachment; filename="renner-unifi.mobileconfig"` {
+		t.Errorf("headers %v", rec.Header())
+	}
+	var top map[string]any
+	format, err := plist.Unmarshal(rec.Body.Bytes(), &top)
+	if err != nil || format != plist.XMLFormat {
+		t.Fatalf("plist (format %d): %v\n%s", format, err, rec.Body.Bytes())
+	}
+	want := map[string]any{
+		"PayloadContent": []any{map[string]any{
+			"PayloadType":                   "com.apple.wifi.managed",
+			"PayloadVersion":                uint64(1),
+			"PayloadIdentifier":             "uno.renner.wifi.renner-unifi.network",
+			"PayloadUUID":                   "824959bf-c55d-4ed2-b569-c33f3759c2b6",
+			"PayloadDisplayName":            "Renner UniFi",
+			"PayloadOrganization":           "Renner",
+			"IsHotspot":                     true,
+			"DomainName":                    "renner.uno",
+			"NAIRealmNames":                 []any{"renner.uno"},
+			"DisplayedOperatorName":         "Renner",
+			"ServiceProviderRoamingEnabled": false,
+			"AutoJoin":                      true,
+			"EncryptionType":                "Any",
+			"EAPClientConfiguration": map[string]any{
+				"UserName":                "Alice.Smith",
+				"UserPassword":            testKey,
+				"OuterIdentity":           "anonymous",
+				"AcceptEAPTypes":          []any{uint64(21)},
+				"TTLSInnerAuthentication": "PAP",
+				"TLSTrustedServerNames":   []any{"radius.renner.uno"},
+			},
+		}},
+		"PayloadType":         "Configuration",
+		"PayloadVersion":      uint64(1),
+		"PayloadIdentifier":   "uno.renner.wifi.renner-unifi",
+		"PayloadUUID":         "7175a2a3-ddd3-42ea-b4ad-b7e5501892f3",
+		"PayloadDisplayName":  "WLAN Renner UniFi",
+		"PayloadOrganization": "Renner",
+	}
+	if !reflect.DeepEqual(top, want) {
+		t.Errorf("profile\n got %#v\nwant %#v", top, want)
+	}
+	if !bytes.Contains(rec.Body.Bytes(), []byte("<string>app-password-&lt;&amp;&gt;-456</string>")) {
+		t.Error("the password is not escaped as XML text")
+	}
+}
+
+func (h *harness) windowsToken(t *testing.T) string {
+	t.Helper()
+	rec := h.callback("windows", "s", "s", "Alice.Smith")
+	if rec.Code != http.StatusFound {
+		t.Fatalf("status %d %q", rec.Code, rec.Body.String())
+	}
+	checkCleared(t, rec, "windows")
+	m := regexp.MustCompile(`^ms-settings:wifi-provisioning\?uri=https://wlan\.renner\.uno/windows/profile/([A-Za-z0-9_-]{43})$`).
+		FindStringSubmatch(rec.Header().Get("Location"))
+	if m == nil {
+		t.Fatalf("location %q", rec.Header().Get("Location"))
+	}
+	return m[1]
+}
+
+func validate(cert *x509.Certificate, body []byte) error {
+	doc := etree.NewDocument()
+	if err := doc.ReadFromBytes(body); err != nil {
+		return err
+	}
+	ctx := dsig.NewDefaultValidationContext(&dsig.MemoryX509CertificateStore{Roots: []*x509.Certificate{cert}})
+	_, err := ctx.Validate(doc.Root())
+	return err
+}
+
+func TestCallbackWindows(t *testing.T) {
+	h := newHarness(t)
+	token := h.windowsToken(t)
+	checkCreated(t, h, "windows", "Windows")
+
+	// No header or cookie: Windows Settings fetches it outside the authentik session.
+	head := h.do(httptest.NewRequest(http.MethodHead, "/windows/profile/"+token, nil))
+	if head.Code != http.StatusOK {
+		t.Errorf("HEAD: %d", head.Code)
+	}
+	rec := h.do(httptest.NewRequest(http.MethodGet, "/windows/profile/"+token, nil))
+	if rec.Code != http.StatusOK || rec.Header().Get("Content-Type") != "text/xml" {
+		t.Fatalf("first fetch: %d %v", rec.Code, rec.Header())
+	}
+	body := rec.Body.Bytes()
+	if again := h.do(httptest.NewRequest(http.MethodGet, "/windows/profile/"+token, nil)); again.Code != http.StatusNotFound {
+		t.Errorf("second fetch: %d", again.Code)
+	}
+
+	if err := validate(h.signing.cert, body); err != nil {
+		t.Fatalf("signature does not verify: %v\n%s", err, body)
+	}
+	s := string(body)
+	for _, want := range []string{
+		`<CarrierProvisioning xmlns="http://www.microsoft.com/networking/CarrierControl/v1">`,
+		`<Username>Alice.Smith</Username><Password>app-password-&lt;&amp;&gt;-456</Password>`,
+		`<Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo>`,
+		`<CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"></CanonicalizationMethod>`,
+		`<SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"></SignatureMethod>`,
+		`<Reference URI=""><Transforms><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"></Transform>`,
+		`<DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></DigestMethod>`,
+		`</Signature></CarrierProvisioning>`,
+	} {
+		if !strings.Contains(s, want) {
+			t.Errorf("missing %s", want)
+		}
+	}
+	// The reference digest is the SHA-1 of the canonical unsigned document; written with
+	// canonical settings, the unsigned root is already in that form.
+	unsigned := etree.NewDocument()
+	unsigned.SetRoot(windowsProfile("Alice.Smith", testKey).Root())
+	unsigned.WriteSettings = etree.WriteSettings{CanonicalEndTags: true, CanonicalText: true, CanonicalAttrVal: true}
+	unsignedBytes, err := unsigned.WriteToBytes()
+	if err != nil {
+		t.Fatal(err)
+	}
+	canonical, err := dsig.MakeC14N10RecCanonicalizer().Canonicalize(unsigned.Root())
+	if err != nil || !bytes.Equal(canonical, unsignedBytes) {
+		t.Fatalf("the unsigned document is not canonical: %v\n%s\n%s", err, canonical, unsignedBytes)
+	}
+	sum := sha1.Sum(canonical)
+	if !strings.Contains(s, "<DigestValue>"+base64.StdEncoding.EncodeToString(sum[:])+"</DigestValue>") {
+		t.Error("the digest is not the SHA-1 of the unsigned document")
+	}
+	signed := etree.NewDocument()
+	if err := signed.ReadFromBytes(body); err != nil {
+		t.Fatal(err)
+	}
+	if pi, ok := signed.Child[0].(*etree.ProcInst); !ok || pi.Target != "xml" || pi.Inst != `version="1.0"` {
+		t.Errorf("the document does not start with the XML declaration: %q", s[:min(len(s), 40)])
+	}
+	root := signed.Root()
+	if last := root.ChildElements()[len(root.ChildElements())-1]; last.Tag != "Signature" {
+		t.Errorf("the last child of the root is %s", last.Tag)
+	}
+	root.RemoveChild(root.SelectElement("Signature"))
+	if stripped, err := dsig.MakeC14N10RecCanonicalizer().Canonicalize(root); err != nil || !bytes.Equal(stripped, canonical) {
+		t.Errorf("without the signature, the document differs from the unsigned one: %v", err)
+	}
+	// Only the enveloped-signature transform, as in Microsoft's signed samples.
+	if n := strings.Count(s, "<Transform "); n != 1 {
+		t.Errorf("%d transforms, want 1", n)
+	}
+	if n := strings.Count(s, "<X509Certificate>"); n != 2 {
+		t.Errorf("%d certificates in KeyInfo, want the whole chain (2)", n)
+	}
+	leaf := base64.StdEncoding.EncodeToString(h.signing.cert.Raw)
+	if !strings.Contains(s, "<X509Data><X509Certificate>"+leaf+"</X509Certificate>") {
+		t.Error("the leaf is not the first certificate")
+	}
+
+	tampered := bytes.Replace(body, []byte("Alice.Smith"), []byte("Alice.Smitx"), 1)
+	if err := validate(h.signing.cert, tampered); err == nil {
+		t.Error("a tampered profile verifies")
+	}
+}
+
+// TestWindowsProfileSchema validates the signed document with xmllint against the schemas
+// Windows ships in %SYSTEMROOT%\schemas\provisioning. They are Microsoft's files and not in the
+// repo: point WLAN_SETUP_PROVISIONING_XSD at a copy of that folder to run it.
+func TestWindowsProfileSchema(t *testing.T) {
+	dir := os.Getenv("WLAN_SETUP_PROVISIONING_XSD")
+	if dir == "" {
+		t.Skip("WLAN_SETUP_PROVISIONING_XSD not set")
+	}
+	xmllint, err := exec.LookPath("xmllint")
+	if err != nil {
+		t.Skip("xmllint not installed")
+	}
+	tc := writeSigningFiles(t)
+	signer, err := loadSigner(tc.keyFile, tc.certFile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	body, err := signer.Sign(windowsProfile("Alice.Smith", testKey))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// The schemas import each other by namespace only; a wrapper schema gives libxml2 the
+	// locations. Dependencies first, so the later imports find their namespaces loaded.
+	wrapper := etree.NewDocument()
+	schema := wrapper.CreateElement("xs:schema")
+	schema.CreateAttr("xmlns:xs", "http://www.w3.org/2001/XMLSchema")
+	schema.CreateAttr("targetNamespace", "urn:wlan-setup:schema-test")
+	for _, s := range []struct{ ns, file string }{
+		{"http://www.microsoft.com/networking/CarrierControl/Base/v1", "provisioning_base_v1.xsd"},
+		{"http://www.microsoft.com/networking/CarrierControl/Plans/v1", "provisioning_plans_v1.xsd"},
+		{"http://www.microsoft.com/networking/CarrierControl/WWAN/v1", "provisioning_wwan_v1.xsd"},
+		{"http://www.microsoft.com/networking/CarrierControl/WLAN/v1", "provisioning_wlan_v1.xsd"},
+		{dsig.Namespace, "provisioning_sig_v1.xsd"},
+		{nsCarrierControl, "provisioning_v1.xsd"},
+	} {
+		imp := schema.CreateElement("xs:import")
+		imp.CreateAttr("namespace", s.ns)
+		imp.CreateAttr("schemaLocation", "file://"+filepath.Join(dir, s.file))
+	}
+	tmp := t.TempDir()
+	wrapperFile := filepath.Join(tmp, "wrapper.xsd")
+	if err := wrapper.WriteToFile(wrapperFile); err != nil {
+		t.Fatal(err)
+	}
+	docFile := filepath.Join(tmp, "profile.xml")
+	if err := os.WriteFile(docFile, body, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	out, err := exec.Command(xmllint, "--noout", "--schema", wrapperFile, docFile).CombinedOutput()
+	if err != nil {
+		t.Fatalf("xmllint: %v\n%s", err, out)
+	}
+}
+
+func TestWindowsProfileDocument(t *testing.T) {
+	tc := writeSigningFiles(t)
+	signer, err := loadSigner(tc.keyFile, tc.certFile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	body, err := signer.Sign(windowsProfile("Alice.Smith", testKey))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := validate(tc.cert, body); err != nil {
+		t.Fatalf("signature does not verify: %v", err)
+	}
+	var wellFormed struct{}
+	if err := xml.Unmarshal(body, &wellFormed); err != nil {
+		t.Fatalf("not well-formed: %v", err)
+	}
+	doc := etree.NewDocument()
+	if err := doc.ReadFromBytes(body); err != nil {
+		t.Fatal(err)
+	}
+	root := doc.Root()
+	const (
+		wlan  = "WLANProfiles/WLANProfile/"
+		sec   = wlan + "MSM/security/"
+		eap   = sec + "OneX/EAPConfig/EapHostConfig/"
+		ttls  = eap + "Config/EapTtls/"
+		creds = sec + "EapHostUserCredentials/"
+		sig   = "Signature/"
+	)
+	for path, want := range map[string]string{
+		"Global/CarrierId":                                carrierID,
+		"Global/SubscriberId":                             "rennerunifi",
+		wlan + "name":                                     "Renner UniFi",
+		wlan + "SSIDConfig/SSID/name":                     "Renner UniFi",
+		wlan + "Hotspot2/DomainName":                      "renner.uno",
+		wlan + "Hotspot2/NAIRealm/name":                   "renner.uno",
+		sec + "authEncryption/authentication":             "WPA3ENT",
+		sec + "authEncryption/encryption":                 "AES",
+		sec + "authEncryption/useOneX":                    "true",
+		sec + "OneX/authMode":                             "user",
+		eap + "EapMethod/Type":                            "21",
+		eap + "EapMethod/VendorId":                        "0",
+		eap + "EapMethod/VendorType":                      "0",
+		eap + "EapMethod/AuthorId":                        "311",
+		ttls + "ServerValidation/ServerNames":             "radius.renner.uno",
+		ttls + "ServerValidation/TrustedRootCAHash":       "ca bd 2a 79 a1 07 6a 31 f2 1d 25 36 35 cb 03 9d 43 29 a5 e8",
+		ttls + "ServerValidation/DisablePrompt":           "true",
+		ttls + "Phase2Authentication/PAPAuthentication":   "",
+		ttls + "Phase1Identity/IdentityPrivacy":           "true",
+		ttls + "Phase1Identity/AnonymousIdentity":         "anonymous",
+		creds + "EapMethod/eapCommon:Type":                "21",
+		creds + "EapMethod/eapCommon:AuthorId":            "311",
+		creds + "Credentials/EapTtls/Username":            "Alice.Smith",
+		creds + "Credentials/EapTtls/Password":            testKey,
+		sig + "SignedInfo/Reference/Transforms/Transform": "",
+	} {
+		el := root.FindElement(path)
+		if el == nil {
+			t.Errorf("no element %s", path)
+			continue
+		}
+		if el.Text() != want {
+			t.Errorf("%s = %q, want %q", path, el.Text(), want)
+		}
+	}
+	for path, want := range map[string]string{
+		".":                                    "http://www.microsoft.com/networking/CarrierControl/v1",
+		"Global/CarrierId":                     "http://www.microsoft.com/networking/CarrierControl/v1",
+		"WLANProfiles":                         "http://www.microsoft.com/networking/CarrierControl/v1",
+		wlan + "Hotspot2/DomainName":           "http://www.microsoft.com/networking/CarrierControl/WLAN/v1",
+		sec + "OneX/authMode":                  "http://www.microsoft.com/networking/OneX/v1",
+		eap + "EapMethod":                      "http://www.microsoft.com/provisioning/EapHostConfig",
+		eap + "EapMethod/Type":                 "http://www.microsoft.com/provisioning/EapCommon",
+		eap + "EapMethod/AuthorId":             "http://www.microsoft.com/provisioning/EapCommon",
+		ttls + "ServerValidation":              "http://www.microsoft.com/provisioning/EapTtlsConnectionPropertiesV1",
+		creds + "EapMethod":                    "http://www.microsoft.com/provisioning/EapHostUserCredentials",
+		creds + "EapMethod/eapCommon:Type":     "http://www.microsoft.com/provisioning/EapCommon",
+		creds + "Credentials/EapTtls/Password": "http://www.microsoft.com/provisioning/EapTtlsUserPropertiesV1",
+		"Signature":                            dsig.Namespace,
+		sig + "SignedInfo/Reference":           dsig.Namespace,
+	} {
+		if el := root.FindElement(path); el == nil || el.NamespaceURI() != want {
+			t.Errorf("%s: namespace not %s", path, want)
+		}
+	}
+	if si := root.FindElement(sig + "SignedInfo"); si == nil || len(si.Attr) != 0 {
+		t.Error("SignedInfo carries its own attributes")
+	}
+	for path, want := range map[string]string{
+		sig + "SignedInfo/CanonicalizationMethod":         "http://www.w3.org/TR/2001/REC-xml-c14n-20010315",
+		sig + "SignedInfo/SignatureMethod":                "http://www.w3.org/2000/09/xmldsig#rsa-sha1",
+		sig + "SignedInfo/Reference/Transforms/Transform": "http://www.w3.org/2000/09/xmldsig#enveloped-signature",
+		sig + "SignedInfo/Reference/DigestMethod":         "http://www.w3.org/2000/09/xmldsig#sha1",
+	} {
+		if el := root.FindElement(path); el == nil || el.SelectAttrValue("Algorithm", "") != want {
+			t.Errorf("%s: Algorithm not %s", path, want)
+		}
+	}
+	if ref := root.FindElement(sig + "SignedInfo/Reference"); ref == nil || ref.SelectAttrValue("URI", "-") != "" {
+		t.Error(`Reference URI is not ""`)
+	}
+	if n := len(root.FindElements(sig + "SignedInfo/Reference/Transforms/Transform")); n != 1 {
+		t.Errorf("%d transforms, want 1", n)
+	}
+	certs := root.FindElements(sig + "KeyInfo/X509Data/X509Certificate")
+	if len(certs) != 2 || certs[0].Text() != base64.StdEncoding.EncodeToString(tc.cert.Raw) {
+		t.Errorf("KeyInfo holds %d certificates, want the chain with the leaf first", len(certs))
+	}
+	if _, err := signer.Sign(doc); err == nil {
+		t.Error("an already signed document was signed again")
+	}
+}
+
+func TestWindowsProfileExpires(t *testing.T) {
+	h := newHarness(t)
+	token := h.windowsToken(t)
+	h.clock.Add(profileTTL)
+	if rec := h.do(httptest.NewRequest(http.MethodGet, "/windows/profile/"+token, nil)); rec.Code != http.StatusNotFound {
+		t.Errorf("expired: %d", rec.Code)
+	}
+	if len(h.srv.profiles.profiles) != 0 {
+		t.Error("the expired profile was not purged")
+	}
+	if rec := h.do(httptest.NewRequest(http.MethodGet, "/windows/profile/unknown", nil)); rec.Code != http.StatusNotFound {
+		t.Errorf("unknown: %d", rec.Code)
+	}
+}
+
+func TestWhoamiHealthzIndexNotFound(t *testing.T) {
+	h := newHarness(t)
+	for _, c := range []struct{ user, want string }{{"Alice.Smith", "Alice.Smith"}, {"a b", ""}, {"", ""},
+		{strings.Repeat("a", 65), ""}} {
+		req := httptest.NewRequest(http.MethodGet, "/whoami", nil)
+		req.Header.Set("X-authentik-username", c.user)
+		rec := h.do(req)
+		if rec.Code != http.StatusOK || rec.Body.String() != c.want || !strings.HasPrefix(rec.Header().Get("Content-Type"), "text/plain") {
+			t.Errorf("whoami %q: %d %q", c.user, rec.Code, rec.Body.String())
+		}
+	}
+	if rec := h.do(httptest.NewRequest(http.MethodGet, "/healthz", nil)); rec.Code != http.StatusOK || rec.Body.String() != "ok\n" {
+		t.Errorf("healthz: %d %q", rec.Code, rec.Body.String())
+	}
+	rec := h.do(httptest.NewRequest(http.MethodGet, "/", nil))
+	if rec.Code != http.StatusOK || !strings.Contains(rec.Body.String(), `href="/windows/install"`) ||
+		strings.Contains(rec.Body.String(), ".cmd") {
+		t.Errorf("index: %d", rec.Code)
+	}
+	for _, req := range []*http.Request{
+		httptest.NewRequest(http.MethodGet, "/renner-unifi-wlan.cmd", nil),
+		httptest.NewRequest(http.MethodGet, "/linux/install", nil),
+		httptest.NewRequest(http.MethodPost, "/", nil),
+		httptest.NewRequest(http.MethodPost, "/android/install", nil),
+		httptest.NewRequest(http.MethodGet, "/index.html", nil),
+	} {
+		if rec := h.do(req); rec.Code != http.StatusNotFound {
+			t.Errorf("%s %s: %d", req.Method, req.URL.Path, rec.Code)
+		}
+	}
+}
+
+func TestLoadConfig(t *testing.T) {
+	if _, err := loadConfig(env(nil)); err == nil || !strings.Contains(err.Error(), "WLAN_SETUP_CLIENT_SECRET is not set") {
+		t.Errorf("missing secret: %v", err)
+	}
+	c, err := loadConfig(env(map[string]string{"WLAN_SETUP_CLIENT_SECRET": "x"}))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if c.AuthentikURL != "http://authentik-server.authentik.svc.cluster.local" ||
+		c.AuthorizeURL != "https://auth.renner.uno/application/o/authorize/" || c.PublicURL != "https://wlan.renner.uno" ||
+		c.SigningKey != "/etc/wlan-signing/tls.key" || c.SigningCert != "/etc/wlan-signing/tls.crt" || c.Listen != ":8080" {
+		t.Errorf("defaults %+v", c)
+	}
+	if _, err := loadConfig(env(map[string]string{"WLAN_SETUP_CLIENT_SECRET": "x", "PUBLIC_URL": "wlan"})); err == nil {
+		t.Error("relative PUBLIC_URL accepted")
+	}
+}

wlan-setup/sign.go

@@ -0,0 +1,137 @@
+package main
+
+import (
+	"crypto"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha1"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"os"
+
+	"github.com/beevik/etree"
+	dsig "github.com/russellhaering/goxmldsig"
+)
+
+// Signer holds the key and chain that sign the Windows provisioning document.
+type Signer struct {
+	key   *rsa.PrivateKey
+	chain [][]byte
+}
+
+// loadSigner reads the PEM key (PKCS#8 RSA) and the PEM chain (leaf first). It runs per request:
+// cert-manager rotates the files.
+func loadSigner(keyFile, certFile string) (*Signer, error) {
+	keyPEM, err := os.ReadFile(keyFile)
+	if err != nil {
+		return nil, fmt.Errorf("signing key: %w", err)
+	}
+	certPEM, err := os.ReadFile(certFile)
+	if err != nil {
+		return nil, fmt.Errorf("signing certificate: %w", err)
+	}
+	return parseSigner(keyPEM, certPEM)
+}
+
+func parseSigner(keyPEM, certPEM []byte) (*Signer, error) {
+	block, _ := pem.Decode(keyPEM)
+	if block == nil {
+		return nil, errors.New("signing key: no PEM block")
+	}
+	var key *rsa.PrivateKey
+	switch block.Type {
+	case "PRIVATE KEY":
+		k, err := x509.ParsePKCS8PrivateKey(block.Bytes)
+		if err != nil {
+			return nil, fmt.Errorf("signing key: %w", err)
+		}
+		rk, ok := k.(*rsa.PrivateKey)
+		if !ok {
+			return nil, errors.New("signing key: not an RSA key")
+		}
+		key = rk
+	case "RSA PRIVATE KEY":
+		k, err := x509.ParsePKCS1PrivateKey(block.Bytes)
+		if err != nil {
+			return nil, fmt.Errorf("signing key: %w", err)
+		}
+		key = k
+	default:
+		return nil, fmt.Errorf("signing key: unexpected PEM block %q", block.Type)
+	}
+	var chain [][]byte
+	for rest := certPEM; ; {
+		var b *pem.Block
+		b, rest = pem.Decode(rest)
+		if b == nil {
+			break
+		}
+		if b.Type != "CERTIFICATE" {
+			continue
+		}
+		if _, err := x509.ParseCertificate(b.Bytes); err != nil {
+			return nil, fmt.Errorf("signing certificate: %w", err)
+		}
+		chain = append(chain, b.Bytes)
+	}
+	if len(chain) == 0 {
+		return nil, errors.New("signing certificate: no certificate")
+	}
+	leaf, _ := x509.ParseCertificate(chain[0])
+	if pub, ok := leaf.PublicKey.(*rsa.PublicKey); !ok || !pub.Equal(&key.PublicKey) {
+		return nil, errors.New("signing certificate: the first certificate does not match the key")
+	}
+	return &Signer{key: key, chain: chain}, nil
+}
+
+const dsigNS = dsig.Namespace
+
+// Sign appends an enveloped XML-DSig signature as the last child of doc's root and returns the
+// serialized document, in the form of Microsoft's CarrierProvisioning samples: Reference URI=""
+// with only the enveloped-signature transform, inclusive C14N 1.0, RSA-SHA1, SHA-1 digest, and
+// every certificate of the chain in KeyInfo/X509Data.
+func (s *Signer) Sign(doc *etree.Document) ([]byte, error) {
+	root := doc.Root()
+	if root == nil || root.Tag != "CarrierProvisioning" || root.SelectElement(dsig.SignatureTag) != nil {
+		return nil, errors.New("signing: not an unsigned CarrierProvisioning document")
+	}
+	c14n := dsig.MakeC14N10RecCanonicalizer()
+	canonical, err := c14n.Canonicalize(root)
+	if err != nil {
+		return nil, fmt.Errorf("signing: %w", err)
+	}
+	digest := sha1.Sum(canonical)
+
+	signature := root.CreateElement(dsig.SignatureTag)
+	signature.CreateAttr("xmlns", dsigNS)
+	signedInfo := signature.CreateElement(dsig.SignedInfoTag)
+	signedInfo.CreateElement(dsig.CanonicalizationMethodTag).
+		CreateAttr(dsig.AlgorithmAttr, c14n.Algorithm().String())
+	signedInfo.CreateElement(dsig.SignatureMethodTag).CreateAttr(dsig.AlgorithmAttr, dsig.RSASHA1SignatureMethod)
+	reference := signedInfo.CreateElement(dsig.ReferenceTag)
+	reference.CreateAttr(dsig.URIAttr, "")
+	reference.CreateElement(dsig.TransformsTag).CreateElement(dsig.TransformTag).
+		CreateAttr(dsig.AlgorithmAttr, dsig.EnvelopedSignatureAltorithmId.String())
+	reference.CreateElement(dsig.DigestMethodTag).CreateAttr(dsig.AlgorithmAttr, dsigNS+"sha1")
+	reference.CreateElement(dsig.DigestValueTag).SetText(base64.StdEncoding.EncodeToString(digest[:]))
+
+	// In place, the canonicalizer adds the namespace SignedInfo inherits from Signature.
+	canonical, err = c14n.Canonicalize(signedInfo)
+	if err != nil {
+		return nil, fmt.Errorf("signing: %w", err)
+	}
+	hashed := sha1.Sum(canonical)
+	value, err := rsa.SignPKCS1v15(rand.Reader, s.key, crypto.SHA1, hashed[:])
+	if err != nil {
+		return nil, fmt.Errorf("signing: %w", err)
+	}
+	signature.CreateElement(dsig.SignatureValueTag).SetText(base64.StdEncoding.EncodeToString(value))
+	x509Data := signature.CreateElement(dsig.KeyInfoTag).CreateElement(dsig.X509DataTag)
+	for _, c := range s.chain {
+		x509Data.CreateElement(dsig.X509CertificateTag).SetText(base64.StdEncoding.EncodeToString(c))
+	}
+	return doc.WriteToBytes()
+}

wlan-setup/store.go

@@ -0,0 +1,70 @@
+package main
+
+import (
+	"sync"
+	"time"
+)
+
+// profileTTL is how long a signed Windows profile waits for Windows Settings to fetch it.
+const profileTTL = 5 * time.Minute
+
+// maxProfiles bounds the profiles held at once.
+const maxProfiles = 1000
+
+type storedProfile struct {
+	body    []byte
+	expires time.Time
+}
+
+// ProfileStore keeps signed Windows profiles in memory, each fetchable once until it expires.
+type ProfileStore struct {
+	mu       sync.Mutex
+	now      func() time.Time
+	profiles map[string]storedProfile
+}
+
+func newProfileStore(now func() time.Time) *ProfileStore {
+	return &ProfileStore{now: now, profiles: map[string]storedProfile{}}
+}
+
+func (s *ProfileStore) purge(now time.Time) {
+	for k, p := range s.profiles {
+		if !now.Before(p.expires) {
+			delete(s.profiles, k)
+		}
+	}
+}
+
+// Put stores body under token; false when the store is full.
+func (s *ProfileStore) Put(token string, body []byte) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	now := s.now()
+	s.purge(now)
+	if len(s.profiles) >= maxProfiles {
+		return false
+	}
+	s.profiles[token] = storedProfile{body: body, expires: now.Add(profileTTL)}
+	return true
+}
+
+// Take returns the profile stored under token and deletes it.
+func (s *ProfileStore) Take(token string) ([]byte, bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.purge(s.now())
+	p, ok := s.profiles[token]
+	if ok {
+		delete(s.profiles, token)
+	}
+	return p.body, ok
+}
+
+// Has reports whether a profile is stored under token, without taking it.
+func (s *ProfileStore) Has(token string) bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.purge(s.now())
+	_, ok := s.profiles[token]
+	return ok
+}