Wi-Fi Keys Available #

What you get #

A Wi-Fi key of your own on the site’s IoT SSID. Devices that join with it land on the IoT network (VLAN 30, 10.20.30.0/24 at the mobile site), where they can reach the MQTT broker and the internet — and nothing else: not your workloads, not the management network, not other tenants' services.

The SSID is shared; the key is yours. The access point uses per-key passphrases (PPSK), so your key identifies your devices as yours, and revoking it disconnects only yours.

Declare one #

resource "deevnet_iot_wifi_key" "devices" {
  tenant      = deevnet_tenant.this.name
  name        = "devices"
  trust_class = "iot"
}

output "device_wifi" {
  value     = { ssid = deevnet_iot_wifi_key.devices.ssid, psk = deevnet_iot_wifi_key.devices.psk }
  sensitive = true
}

terraform output -json device_wifi

One key per tenant per trust class, not per device: every device you flash uses the same key. Read the SSID from the output rather than hardcoding DVNTM-IOT: another site would name the same trust class differently.

Your DVNTM-TD keys #

Your first DVNTM-TD key comes with your admission, because you need that network to reach the API at all. After your first apply it is one of your tenant’s keys, named admission. For another computer, or a teammate’s, issue one more:

resource "deevnet_iot_wifi_key" "second_laptop" {
  tenant      = deevnet_tenant.this.name
  name        = "second-laptop"
  trust_class = "tenant_dev"
  mac         = "AA-BB-CC-00-11-22"   # optional: this key then works from that computer only
}

mac binds a key to one computer, so a key that leaks is useless elsewhere. Your computer probably uses a private Wi-Fi address per network: bind the one it shows while joined to DVNTM-TD. Computers on DVNTM-TD cannot reach each other; each reaches only the site’s services and your workloads.

Rotating it #

terraform apply -replace=deevnet_iot_wifi_key.devices

issues a new key, and every device holding the old one drops off until it is reflashed. The psk is only ever returned when the key is issued — your state is its only copy.

What it does not do #

• It is not authorization. Joining the network proves you have the key, nothing more; each service still wants its own credential (the broker wants a broker account) ( ADR-0020)
• Your devices cannot reach your workloads directly. Both talk to the broker