feat(radius): Apple Passpoint profile with a per-device app password #1568

2026-11-05T13:00:56Z

claude-bot commented

2026-11-05 13:00:56 +00:00

Apple devices get Passpoint from wlan.renner.uno the same way as Android. Builds on #1567.

/apple/install and /apple/callback (njs, shared with Android): sign-in through the wlan-setup OAuth application, app password wlan-apple-<user>-<timestamp>-<random> created with the user's own access token, response is a .mobileconfig.
Profile: com.apple.wifi.managed with IsHotspot, DomainName and NAIRealmNames renner.uno (no SSID), EAP-TTLS/PAP, outer identity anonymous, trusted server name radius.renner.uno, username and app password. PayloadIdentifier/UUIDs of the previous profile, so installing replaces it.
The static /renner-unifi.mobileconfig without a password is removed.
OAuth provider wlan-setup: redirect URI https://wlan.renner.uno/apple/callback.
Setup page: Apple button points to /apple/install; the intro names which platforms get an app password.
docs/radius/dot1x.md: Passpoint flow for both platforms; the manual Android steps with the account password are removed.

🤖 Generated with Claude Code

Apple devices get Passpoint from wlan.renner.uno the same way as Android. Builds on #1567. - `/apple/install` and `/apple/callback` (njs, shared with Android): sign-in through the `wlan-setup` OAuth application, app password `wlan-apple-<user>-<timestamp>-<random>` created with the user's own access token, response is a `.mobileconfig`. - Profile: `com.apple.wifi.managed` with `IsHotspot`, `DomainName` and `NAIRealmNames` `renner.uno` (no SSID), EAP-TTLS/PAP, outer identity `anonymous`, trusted server name `radius.renner.uno`, username and app password. PayloadIdentifier/UUIDs of the previous profile, so installing replaces it. - The static `/renner-unifi.mobileconfig` without a password is removed. - OAuth provider `wlan-setup`: redirect URI `https://wlan.renner.uno/apple/callback`. - Setup page: Apple button points to `/apple/install`; the intro names which platforms get an app password. - `docs/radius/dot1x.md`: Passpoint flow for both platforms; the manual Android steps with the account password are removed. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 3 commits 2026-11-05 13:00:57 +00:00

docs(radius): Renner UniFi is WPA3 Enterprise with Passpoint

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

3bfb38ebd7

"Renner UniFi" now runs WPA3 Enterprise without transition mode and
advertises Passpoint (realm and domain renner.uno, EAP-TTLS/PAP), so the
Android profiles from wlan.renner.uno join it directly. The table row for
the deleted "Renner Test" WLAN is replaced; the Windows manual setup uses
WPA3-Enterprise.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

feat(radius): Apple Passpoint profile with a per-device app password 5718492e2b

wlan.renner.uno serves Apple devices the same way as Android: /apple/install
signs in through the wlan-setup OAuth application, /apple/callback creates
an app password (wlan-apple-...) with the user's own access token and returns
a .mobileconfig with Passpoint (IsHotspot, domain and NAI realm renner.uno),
EAP-TTLS/PAP, outer identity anonymous, trusted server name
radius.renner.uno, username and app password. The static profile without a
password is removed; its PayloadIdentifier/UUIDs are kept so the new profile
replaces it on install. The OAuth provider gets the redirect URI
https://wlan.renner.uno/apple/callback.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs(radius): Passpoint setup for Android and Apple

ci/woodpecker/pr/ci-scripts-test Pipeline was successful

Details

ci/woodpecker/pr/ci-manifests-test Pipeline was successful

Details

6e12a608b3

Android and Apple get Passpoint profiles with their own app password from
wlan.renner.uno; the manual Android steps with the account password are
removed. Windows and Linux keep their setup files.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

k.renner merged commit 5718c9bae2 into main

2026-11-05 13:03:12 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: konairius/homelab#1568