Add ansible-managed wifi profiles for meshcore nodes

Each node now gets three NetworkManager wifi connections via a new
wifi role: dotnetwork (home), dotmobile (phone hotspot, for field
troubleshooting), and a host-specific deployed-location network.
Credentials live in a new per-repo ansible-vault (group and host
scoped), matching the pattern already used in dotnetwork.

Also updates the README's Pi imaging instructions from Bookworm to
Trixie, matching what the nodes actually run.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

.gitignore

@@ -0,0 +1,2 @@
+# Vault password file — never commit this
+.vault_pass

README.md

@@ -19,7 +19,7 @@ pip install ansible
 ```
 
 **New Pi node checklist:**
-1. Flash Raspberry Pi OS Lite (Bookworm), connect to WiFi
+1. Flash Raspberry Pi OS Lite (Trixie), connect to WiFi
 2. Install Tailscale and join the network
 3. Ensure `david` user exists with sudo access
 4. Connect the MeshCore device via USB, then find its serial ID:

ansible/ansible.cfg

@@ -0,0 +1,5 @@
+[defaults]
+inventory            = inventory.yml
+host_key_checking    = False
+stdout_callback      = yaml
+vault_password_file  = ../.vault_pass

ansible/group_vars/all/vars.yml

@@ -7,3 +7,12 @@ meshcore_description: "meshcore management"
 # Same values as dotnetwork/ansible/inventory/group_vars/all/vars.yml
 ssh_pubkey_dotlaptop_lin: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJykGDnyJkOfPyzNTCaEFx5niy6kAAo/7nLzbhB9tmj2 [email protected]"
 ssh_pubkey_dotlaptop_win: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC7l0kU6LRzmgCADHFmdxu6zU6Zt3mD7VyaNyLXfWdT6YsU2Q6KsKfxQlrzPgnJzEnqxqHybcEb4KO22ktIaFkDE3o1eLPYF02EOtYB3xHhqnuctn9o3GP/50kbqgeFA2NiDs2+QbtqtPzBefFes95c5ezYckzJ4qmGUm2DaNoJiSffn4wNqx8bGU7FpR4bLAc2Z+2MTW7SRr3/nbmgzjs5E6t2CX/HBQXMBSTSGZiGShpU7/WqQBOeFM51+xoL+vfHlUuOjGOPAFAeHlS9Gys7/sjG8cjBDpfKaUGMhB8lCZZJ/2O1Xpecq+Vf37gr7xwqeTTpWrbCIUH4ACkB3Mpn5fTfarMwG3rUjQ9Kl5+BBB/t6lIrS4JJoDuoZ9/GwTt7vWiq4mFk93fLCwVIvJTF88D+TXP+dhNQ3OD8E5LrQ6obk7fTSbk5TJBsdKAnH8ab9njadmLrYL6o9OQFnz+n6Lvcc7piAznB4yyD8tz24mcbLjx0l2rBbDTsb7l2yt2vFZnK2Wp4PXcgk+PwD/jY2xUbHUysolIkxO7BoqN4W7mI4mJaVun+H1hSYbaJZ22U1zDtybLaaTbLVwidWvmidELM49FZ+tD95gZbo0d16JHYJRjRctia4l2tYSrCD891GSFfEZ784oXzhVZYyEGNaisdmIykUjV9CBsswa28PQ== [email protected]"
+
+# WiFi networks every node joins: dotnetwork here at home, dotmobile (phone
+# hotspot) as a field-troubleshooting fallback. Nodes also join a
+# host-specific wifi_ssid_location for their deployed site (host_vars).
+wifi_ssid_dotnetwork: "dotnetwork"
+wifi_password_dotnetwork: "{{ vault_wifi_dotnetwork }}"
+
+wifi_ssid_dotmobile: "dotmobile"
+wifi_password_dotmobile: "{{ vault_wifi_dotnetwork }}"

ansible/group_vars/all/vault.yml

@@ -0,0 +1,7 @@
+$ANSIBLE_VAULT;1.1;AES256
+62646238366237396536303538333838663864316631636636623131353839333332616337323363
+6164666235383139396364376566633563333765333761610a326133656635326131363939336437
+38353766633166643333333030656237383030666131363239643034316561333033626262343666
+6330326537313435320a613662303763356465643333633032646136323762313531656430613630
+31356662616265393431613634363964326663323636653266353562633732363430306638303664
+6330613766656166393636666637313735363835656635666536

ansible/group_vars/all/vault.yml.example

@@ -0,0 +1,7 @@
+# Copy this to vault.yml and encrypt it:
+#   ansible-vault encrypt group_vars/all/vault.yml
+#
+# To edit later:
+#   ansible-vault edit group_vars/all/vault.yml
+
+vault_wifi_dotnetwork: "changeme"   # also used for dotmobile (phone hotspot) — same password

ansible/host_vars/dm-ashwell.yml

@@ -1 +0,0 @@
-serial_port: /dev/serial/by-id/usb-Espressif_USB_JTAG_serial_debug_unit_1C:DB:D4:5A:AA:B0-if00

ansible/host_vars/dm-ashwell/vars.yml

@@ -0,0 +1,5 @@
+serial_port: /dev/serial/by-id/usb-Espressif_USB_JTAG_serial_debug_unit_1C:DB:D4:5A:AA:B0-if00
+
+# Deployed-location wifi
+wifi_ssid_location: "awesome"
+wifi_password_location: "{{ vault_wifi_location }}"

ansible/host_vars/dm-ashwell/vault.yml

@@ -0,0 +1,7 @@
+$ANSIBLE_VAULT;1.1;AES256
+66323935356562383438383164383233366339616430313935613665376165393762633039663861
+3366373034613639386537363564643130653165393634370a326364323231306364313832366132
+65656264623537636264393433653838373234393435663838323263643037343637643139663838
+3932326163356663310a393065316631383230306433393063316135333030306531386138303733
+37363837376536323231386232333937306562343464376332386539323266653436643631353562
+3631616136623431626165336564643737306537643162666435

ansible/host_vars/dm-baldock.yml

@@ -1 +0,0 @@
-serial_port: /dev/serial/by-id/usb-Espressif_USB_JTAG_serial_debug_unit_98:3D:AE:61:74:60-if00

ansible/host_vars/dm-baldock/vars.yml

@@ -0,0 +1,5 @@
+serial_port: /dev/serial/by-id/usb-Espressif_USB_JTAG_serial_debug_unit_98:3D:AE:61:74:60-if00
+
+# Deployed-location wifi
+wifi_ssid_location: "H-NeT"
+wifi_password_location: "{{ vault_wifi_location }}"

ansible/host_vars/dm-baldock/vault.yml

@@ -0,0 +1,7 @@
+$ANSIBLE_VAULT;1.1;AES256
+39666566313664333037366537316636666532616663636664636162346538663039393364633231
+3930393835346636306362653035653130393935306166380a386439366431386466613732323962
+30616161636135643037343737303838623338393632616331353665636335356636613164666138
+6136353833376632330a356532303530363735343530646165376532663833386433623264386331
+39346365613661306161643266353365633336636334313463646330303434303465353132333364
+3465373933366432326434356163303437653166393934613933

ansible/host_vars/dm-edworth/vars.yml

@@ -1,2 +1,6 @@
 # Find this by connecting the MeshCore device then running: ls /dev/serial/by-id/
 serial_port: FILL_IN_SERIAL_PORT
+
+# Deployed-location wifi
+wifi_ssid_location: "Ridgeway"
+wifi_password_location: "{{ vault_wifi_location }}"

ansible/host_vars/dm-edworth/vault.yml

@@ -0,0 +1,7 @@
+$ANSIBLE_VAULT;1.1;AES256
+38663539336539396564376166656338313664633564636234383835383838613330323734363733
+6532306238633463616131383965626239613234636237620a613033396261616534336161383431
+39613234386161643439613166313962653939343138353539346638316562333330643561333961
+6136343564353736640a623365333930383962333865313938616261373639346435636364313665
+37326636663061383362643261633362643564663531306430633935636636306430353836333338
+3463383931306266393838663734303336383035623733643735

ansible/requirements.yml

@@ -0,0 +1,4 @@
+---
+collections:
+  - name: ansible.posix
+  - name: community.general

ansible/roles/wifi/tasks/main.yml

@@ -0,0 +1,40 @@
+---
+- name: WiFi — dotnetwork (home)
+  community.general.nmcli:
+    type: wifi
+    conn_name: dotnetwork
+    ssid: "{{ wifi_ssid_dotnetwork }}"
+    wifi_sec:
+      key-mgmt: wpa-psk
+      psk: "{{ wifi_password_dotnetwork }}"
+    autoconnect: true
+    state: present
+  become: true
+  tags: [wifi]
+
+- name: WiFi — dotmobile (phone hotspot, field troubleshooting)
+  community.general.nmcli:
+    type: wifi
+    conn_name: dotmobile
+    ssid: "{{ wifi_ssid_dotmobile }}"
+    wifi_sec:
+      key-mgmt: wpa-psk
+      psk: "{{ wifi_password_dotmobile }}"
+    autoconnect: true
+    state: present
+  become: true
+  tags: [wifi]
+
+- name: WiFi — deployed-location network
+  community.general.nmcli:
+    type: wifi
+    conn_name: location
+    ssid: "{{ wifi_ssid_location }}"
+    wifi_sec:
+      key-mgmt: wpa-psk
+      psk: "{{ wifi_password_location }}"
+    autoconnect: true
+    state: present
+  become: true
+  when: wifi_ssid_location is defined
+  tags: [wifi]

ansible/site.yml

@@ -16,6 +16,7 @@
       become: true
 
   roles:
+    - wifi
     - base
     - meshcore_cli
     - meshcore_capture