The wlan-setup Deployment runs gitea.renner.uno/gitea_admin/wlan-setup (Flux image policy wlan-setup) instead of nginx + njs; the ConfigMap wlan-setup-config.yaml with nginx.conf, njs and the Windows .cmd is removed. - Certificate wlan-setup-signing for wlan.renner.uno (PKCS#8), mounted at /etc/wlan-signing (fsGroup 65534, mode 0440); the service reads it per request, so renewals need no restart. - Ingress wlan-setup-provisioning: /windows/profile/ without the authentik gate, for Windows Settings fetching the signed provisioning XML. - OAuth provider wlan-setup: redirect URI https://wlan.renner.uno/windows/callback. - docs/radius/dot1x.md: Go service and the Windows Passpoint flow. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>