From 505a9a821446f308efb65a47dc9afe895421a077 Mon Sep 17 00:00:00 2001
From: Luke Tainton <luke@tainton.uk>
Date: Sun, 22 Feb 2026 22:04:30 +0000
Subject: [PATCH] Add WiFi

---
 .gitea/workflows/deploy.yaml |  4 +++-
 config.yaml                  | 29 +++++++++++++++++++++++++++++
 2 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/.gitea/workflows/deploy.yaml b/.gitea/workflows/deploy.yaml
index 6177578..b424636 100644
--- a/.gitea/workflows/deploy.yaml
+++ b/.gitea/workflows/deploy.yaml
@@ -31,7 +31,9 @@ jobs:
       
       - name: Run Ansible
         run: |
-          MERAKI_DASHBOARD_API_KEY=${{ secrets.MERAKI_DASHBOARD_API_KEY }} uv run ansible-playbook -i hosts config.yaml
+          MERAKI_DASHBOARD_API_KEY=${{ secrets.MERAKI_DASHBOARD_API_KEY }} \
+            WIFI_PSK=${{ secrets.WIFI_PSK }} \
+            uv run ansible-playbook -i hosts config.yaml
 
       - name: Minimize uv cache
         run: uv cache prune --ci
diff --git a/config.yaml b/config.yaml
index 60e716a..e69d0dc 100644
--- a/config.yaml
+++ b/config.yaml
@@ -166,3 +166,32 @@
           enabled: false
         loop: "{{ mx_ports }}"
         when: not item.enabled
+
+      - name: Configure Wireless SSID
+        cisco.meraki.networks_wireless_ssids:
+          state: present
+          networkId: "{{ nid }}"
+          number: "2"
+          name: Tainton Test WiFi
+          enabled: true
+          authMode: psk
+          defaultVlanId: 35
+          dhcpEnforcedDeauthentication:
+            enabled: false
+          dot11w:  # PMF
+            enabled: true
+            required: false
+          dot11r:  # Fast Roam, not required as we only have 1 AP
+            enabled: false
+            # adaptive: true
+          encryptionMode: wpa
+          psk: "{{ lookup('ansible.builtin.env', 'WIFI_PSK', default=undef()) }}"
+          visible: true
+          wpaEncryptionMode: WPA3 Transition Mode
+          availableOnAllAps: true
+          enterpriseAdminAccess: "access enabled"
+          ipAssignmentMode: "Bridge mode"
+          lanIsolationEnabled: false
+          mandatoryDhcpEnabled: false
+          splashPage: "None"
+          useVlanTagging: true