update radius

ansible/ansible-bootstrap.cfg

@@ -2,6 +2,7 @@
 host_key_checking = False
 inventory = hosts
 interpreter_python = auto_silent
+vault_password_file = ~/.ansible-vault-pass
 
 [ssh_connection]
 pipelining = true

ansible/host_vars/radius.vntx.net.yml

@@ -1,21 +0,0 @@
----
-ansible_host: 204.110.191.248
-ansible_python_interpreter: /usr/bin/python3
-ansible_ssh_common_args: '-o StrictHostKeyChecking=accept-new'
-
-firewall_allow_rules:
-  - port: 1812
-    proto: udp
-    comment: RADIUS Auth
-  - port: 1812
-    proto: tcp
-    comment: RADIUS Auth
-  - port: 1813
-    proto: udp
-    comment: RADIUS Accounting
-  - port: 1813
-    proto: tcp
-    comment: RADIUS Accounting
-  - port: 3306
-    proto: tcp
-    comment: MySQL

ansible/host_vars/radius.vntx.net/vars.yml

@@ -0,0 +1,104 @@
+---
+ansible_python_interpreter: /usr/bin/python3
+ansible_ssh_common_args: '-o StrictHostKeyChecking=accept-new'
+
+firewall_trusted_subnets:
+  - subnet: 100.64.0.0/10
+    comment: Tailscale
+  - subnet: 204.110.188.0/22
+    comment: VNTX
+  - subnet: 10.0.0.0/8
+    comment: Internal
+  - subnet: 192.168.0.0/16
+    comment: Internal
+  - subnet: 172.0.0.0/15
+    comment: VNTX
+  - subnet: 216.180.128.0/20
+    comment: VNTX
+  - subnet: 3.228.90.246
+    comment: Gaiia AWS
+
+firewall_allow_rules:
+  - port: 1812
+    proto: udp
+    comment: RADIUS Auth
+  - port: 1812
+    proto: tcp
+    comment: RADIUS Auth
+  - port: 1813
+    proto: udp
+    comment: RADIUS Accounting
+  - port: 1813
+    proto: tcp
+    comment: RADIUS Accounting
+  - port: 3306
+    proto: tcp
+    from_ip: 10.0.0.0/8
+    comment: MySQL (internal)
+  - port: 3306
+    proto: tcp
+    from_ip: 204.110.188.0/22
+    comment: MySQL (VNTX/Gaiia)
+  - port: 3306
+    proto: tcp
+    from_ip: 3.228.90.246
+    comment: MySQL (Gaiia AWS)
+  - port: 3799
+    proto: udp
+    from_ip: 3.228.90.246
+    comment: RADIUS CoA/Disconnect (Gaiia AWS)
+
+# FreeRADIUS role — user will manually import seed data after deploy
+freeradius_load_user_data: false
+
+# RADIUS clients (CoA/management systems)
+freeradius_clients:
+  - name: localhost
+    ipaddr: "127.0.0.1"
+    secret: "{{ vault_freeradius_localhost_secret | default('testing123') }}"
+    shortname: localhost
+    nas_type: other
+  - name: gaiia
+    ipaddr: "3.228.90.246"
+    secret: "{{ vault_freeradius_gaiia_secret }}"
+    shortname: gaiia
+    nas_type: other
+
+# NAS clients (secrets from vault.yml in this directory)
+freeradius_nas_clients:
+  - nasname: "204.110.188.31"
+    shortname: "380"
+    secret: "{{ vault_nas_380_secret }}"
+  - nasname: "204.110.188.254"
+    shortname: "Verona"
+    secret: "{{ vault_nas_verona_secret }}"
+  - nasname: "204.110.188.62"
+    shortname: "Climax"
+    secret: "{{ vault_nas_climax_secret }}"
+  - nasname: "204.110.188.158"
+    shortname: "Culleoka"
+    secret: "{{ vault_nas_culleoka_secret }}"
+  - nasname: "204.110.188.190"
+    shortname: "NewHope"
+    secret: "{{ vault_nas_newhope_secret }}"
+  - nasname: "204.110.188.222"
+    shortname: "LowryCrossing"
+    secret: "{{ vault_nas_lowrycrossing_secret }}"
+  - nasname: "204.110.188.126"
+    shortname: "982"
+    secret: "{{ vault_nas_982_secret }}"
+  - nasname: "204.110.191.190"
+    shortname: "yorkshire"
+    secret: "{{ vault_nas_yorkshire_secret }}"
+  - nasname: "204.110.188.94"
+    shortname: "494"
+    secret: "{{ vault_nas_494_secret }}"
+  - nasname: "204.110.191.185"
+    shortname: "Core"
+    secret: "{{ vault_nas_core_secret }}"
+  - nasname: "204.110.191.252"
+    shortname: "Concatenator"
+    secret: "{{ vault_nas_concatenator_secret }}"
+  - nasname: "10.254.254.103"
+    shortname: "Yorkshire-mgmt"
+    secret: "{{ vault_nas_yorkshire_secret }}"

ansible/host_vars/radius.vntx.net/vault.yml

@@ -0,0 +1,39 @@
+$ANSIBLE_VAULT;1.1;AES256
+65323864356364393135623533323261663562363831646562366138373331383030346535633461
+6363633761363631393136663630613334303034623230300a386661383931313138333165396535
+61626130353839323335646366383435323365663232356338383236316632343331323139363962
+6630663737393337660a396361313439313663636634353465393333373233363961663136393561
+64663130383362613330316439346536646235343831366138373864646433653131613734613131
+30613266666661653030383937323639666435323163666338353835626265313862643066623334
+35646236343062376635313339626366356265313032363763623066636466346363363838613938
+37653238346635343637656535373436356135356335653030323639386530386234326332333534
+63313365346265653130636635386465643966613666316532383563653534386366363762343939
+61393365663763323437303637343635326232643833336432393836363733633330663634333362
+63356338653864653363663533383430663236643335303862353133646637653232363736626532
+66316138633133663837396436633439313264613436656135383934393861363630396138616635
+32643663373232326433363834346161343832336135393830303134396539633437366466663139
+64393339623436646666326236633662636364663730376230636334663733616334633064316364
+62626166626138303165363038653930643966303334383265326331383766396332336561633636
+63643038373635326539643061313063393839356439303339386661343964303034363937363263
+37373463326530336664643134626630643839366634346432393964316366316363373461653863
+34303865303563373563386339353433613766333233626131626265623935613239373730333661
+31313836626535393934373636363863616139613866383232323931623866626336323131373136
+64373534396535666433636566613834643466353764386431303362663433333731333731613038
+65383435323738643837343538383366633766636463353963373336333033393062343734616664
+65336632613662373636336464653930346533643839623833393437316239353062386238333661
+39646433376437366234376164356337353433613938613636353235383230323738616434376439
+66393662316330663966353236383438616662656437393064353465633666326433356536366139
+37386137353464363163636664323266353064383666396537363331373334616433316433333362
+62353761613462383239653034656466383365373065376632623637366235356265313831303766
+39623236396663303333323430613233396239636638393839636462633438353334366631316432
+34396135663062383065323534643235316461336534333666636665343463323266666131356334
+63623535656433613237353432393433313362663061643237306138656663313734653962356638
+36656536356131336338336162653062663466643161346661326334363132346533653064346163
+35366536643938366265313065353230643331363034303462336534643065373634323861306236
+66646637303239393561646662383836633735623066353634643732633337626231623731663664
+61313738376337626337336334656562393664316138383235353630343233373264636631386439
+66653065396534316565666262623331653461633862396430313938616233636361633166656533
+32393735646565613835303466633639303139393461613634333835326439323664633333333030
+38656437363036303434656436343364323730363765646234366363353561343030326264333462
+62313665373162343437386133616362346539646666633736303337313366616562393562646439
+3865376334636231363639343833663863303765396131633839

ansible/hosts

@@ -1,6 +1,6 @@
 [vntx_servers]
 logs.vntx.net
-radius.vntx.net
+#radius.vntx.net
 vpn.vntx.net
 netbox.vntx.net
 #ntp.vntx.net
@@ -60,7 +60,9 @@ db.w5isp.com
 [irc_limited]
 ca.manero.org
 
+#[radius_servers]
+#radius.vntx.net
+
 [irc_servers]
 us.manero.org ansible_host=manero-us
 ca.manero.org ansible_host=manero-ca
-

ansible/playbook.yml

@@ -381,6 +381,16 @@
     - role: grafana
       tags: grafana
 
+- name: Configure FreeRADIUS servers
+  hosts: radius_servers
+  become: true
+  gather_facts: true
+  tags:
+    - radius
+    - freeradius
+  roles:
+    - freeradius
+
 - name: Configure IRC servers
   hosts: irc_servers
   become: true

ansible/roles/base/tasks/users.yml

@@ -60,11 +60,42 @@
     label: "{{ item.name }}"
   when: item.state | default('present') == 'absent'
 
+- name: Collect unique GitHub usernames for key fetch
+  ansible.builtin.set_fact:
+    _gh_usernames: >-
+      {{ managed_users | default([])
+         | map(attribute='authorized_keys', default=[])
+         | flatten
+         | selectattr('type', 'defined')
+         | selectattr('type', 'equalto', 'github')
+         | map(attribute='value')
+         | unique
+         | list }}
+  when: managed_users | default([]) | length > 0
+
+- name: Fetch GitHub SSH keys
+  ansible.builtin.uri:
+    url: "https://github.com/{{ item }}.keys"
+    return_content: true
+  loop: "{{ _gh_usernames | default([]) }}"
+  register: _gh_fetched
+  delegate_to: localhost
+  run_once: true
+  become: false
+  when: _gh_usernames | default([]) | length > 0
+
+- name: Build GitHub keys lookup dict
+  ansible.builtin.set_fact:
+    _gh_keys: "{{ _gh_keys | default({}) | combine({item.item: item.content}) }}"
+  loop: "{{ _gh_fetched.results | default([]) }}"
+  when: _gh_fetched.results | default([]) | length > 0
+  no_log: true
+
 - name: Install authorized keys from GitHub
   ansible.posix.authorized_key:
     user: "{{ item.0.name }}"
     state: "{{ item.1.state | default('present') }}"
-    key: "https://github.com/{{ item.1.value }}.keys"
+    key: "{{ _gh_keys[item.1.value] }}"
     manage_dir: "{{ item.1.manage_dir | default(true) }}"
     exclusive: "{{ item.1.exclusive | default(false) }}"
   loop: "{{ managed_users | default([]) | subelements('authorized_keys', skip_missing=True) }}"

ansible/roles/debian/tasks/main.yml

@@ -44,3 +44,11 @@
     state: present
     regexp: '^tmpfs\s+/run/shm\s+'
     line: "tmpfs /run/shm tmpfs defaults,noexec,nosuid 0 0"
+
+- name: "Ensure SSH listens on both IPv4 and IPv6"
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: '^#?AddressFamily'
+    line: "AddressFamily any"
+    state: present
+  notify: restart ssh

ansible/roles/firewall/tasks/main.yml

@@ -196,7 +196,7 @@
     - ansible_facts['os_family'] == "Debian"
     - firewall_enabled | default(true)
     - firewall_allow_rules | length > 0
-    - _fw_ufw_rules.skipped | default(true) or (item.port | string + '/' + item.proto) not in _fw_ufw_rules.stdout
+    - _fw_ufw_rules.skipped | default(true) or (item.from_ip | default('any') + ' ' + item.port | string + '/' + item.proto) not in _fw_ufw_rules.stdout
 
 - name: Enable IP forwarding
   ansible.posix.sysctl:

ansible/roles/freeradius/defaults/main.yml

@@ -0,0 +1,50 @@
+---
+# FreeRADIUS v3 role for Debian
+
+freeradius_config_dir: /etc/freeradius/3.0
+freeradius_service_name: freeradius
+
+# Packages to install (Debian)
+freeradius_packages:
+  - freeradius
+  - freeradius-mysql
+  - freeradius-utils
+  - mariadb-server
+  - python3-pymysql
+
+# MySQL connection
+freeradius_db_host: localhost
+freeradius_db_port: 3306
+freeradius_db_name: radius
+freeradius_db_user: radius
+
+# SQL dialect
+freeradius_sql_dialect: mysql
+freeradius_sql_driver: "rlm_sql_{{ freeradius_sql_dialect }}"
+
+# Whether to read clients from nas table
+freeradius_read_clients: true
+freeradius_client_table: nas
+
+# NAS clients — define in host_vars
+# Each entry: { nasname, shortname, type, ports, secret, server, community, description }
+freeradius_nas_clients: []
+
+# RADIUS clients.conf entries — define in host_vars
+# Each entry: { name, ipaddr, secret, shortname, nas_type }
+freeradius_clients:
+  - name: localhost
+    ipaddr: "127.0.0.1"
+    secret: "{{ vault_freeradius_localhost_secret | default('testing123') }}"
+    shortname: localhost
+    nas_type: other
+
+# Whether to seed the DB schema
+freeradius_seed_db: true
+
+# Whether to seed NAS table from freeradius_nas_clients
+freeradius_seed_nas: true
+
+# Whether to load user data from a SQL dump file
+freeradius_load_user_data: false
+freeradius_user_data_file: ""

ansible/roles/freeradius/files/queries.conf

@@ -0,0 +1,393 @@
+{# Managed by Ansible — do not edit manually. #}
+# -*- text -*-
+#
+#  main/mysql/queries.conf -- MySQL configuration for default schema (schema.sql)
+#
+#  $Id: b31ae9c3a1bf41f030a2112d31bf3a678e76f23c $
+
+safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /"
+
+sql_user_name = "%{User-Name}"
+
+event_timestamp_epoch = "%{%{integer:Event-Timestamp}:-%l}"
+event_timestamp = "FROM_UNIXTIME(${event_timestamp_epoch})"
+
+class {
+	column_name =	# ", class"
+	packet_xlat =	# ", '%{Class}'"
+	reply_xlat =	# ", '%{reply:Class}'"
+}
+
+client_query = "\
+	SELECT id, nasname, shortname, type, secret, server \
+	FROM ${client_table}"
+
+authorize_check_query = "\
+	SELECT id, username, attribute, value, op \
+	FROM ${authcheck_table} \
+	WHERE username = '%{SQL-User-Name}' \
+	ORDER BY id"
+
+authorize_reply_query = "\
+	SELECT id, username, attribute, value, op \
+	FROM ${authreply_table} \
+	WHERE username = '%{SQL-User-Name}' \
+	ORDER BY id"
+
+group_membership_query = "\
+	SELECT groupname \
+	FROM ${usergroup_table} \
+	WHERE username = '%{SQL-User-Name}' \
+	ORDER BY priority"
+
+authorize_group_check_query = "\
+	SELECT id, groupname, attribute, \
+	Value, op \
+	FROM ${groupcheck_table} \
+	WHERE groupname = '%{${group_attribute}}' \
+	ORDER BY id"
+
+authorize_group_reply_query = "\
+	SELECT id, groupname, attribute, \
+	value, op \
+	FROM ${groupreply_table} \
+	WHERE groupname = '%{${group_attribute}}' \
+	ORDER BY id"
+
+simul_count_query = "\
+	SELECT COUNT(*) \
+	FROM ${acct_table1} a \
+	LEFT OUTER JOIN nasreload n USING (nasipaddress) \
+	WHERE username = '%{SQL-User-Name}' \
+	AND acctstoptime IS NULL \
+	AND (a.acctstarttime > n.reloadtime OR n.reloadtime IS NULL)"
+
+simul_verify_query = "\
+	SELECT \
+		radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, \
+		callingstationid, framedprotocol \
+	FROM ${acct_table1} a \
+	LEFT OUTER JOIN nasreload n USING (nasipaddress) \
+	WHERE username = '%{SQL-User-Name}' \
+	AND acctstoptime IS NULL \
+	AND (a.acctstarttime > n.reloadtime OR n.reloadtime IS NULL)"
+
+accounting {
+	reference = "%{tolower:type.%{%{Acct-Status-Type}:-%{Request-Processing-Stage}}.query}"
+
+	column_list = "\
+		acctsessionid,		acctuniqueid,		username, \
+		realm,			nasipaddress,		nasportid, \
+		nasporttype,		acctstarttime,		acctupdatetime, \
+		acctstoptime,		acctsessiontime, 	acctauthentic, \
+		connectinfo_start,	connectinfo_stop, 	acctinputoctets, \
+		acctoutputoctets,	calledstationid, 	callingstationid, \
+		acctterminatecause,	servicetype,		framedprotocol, \
+		framedipaddress,	framedipv6address,	framedipv6prefix, \
+		framedinterfaceid,	delegatedipv6prefix	${..class.column_name}"
+
+	type {
+		accounting-on {
+			query = "\
+				UPDATE ${....acct_table1} \
+				SET \
+					acctstoptime = ${....event_timestamp}, \
+					acctsessiontime	= '${....event_timestamp_epoch}' \
+						- UNIX_TIMESTAMP(acctstarttime), \
+					acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' \
+				WHERE acctstoptime IS NULL \
+				AND nasipaddress   = '%{NAS-IP-Address}' \
+				AND acctstarttime <= ${....event_timestamp}"
+
+			-query = "\
+				INSERT INTO nasreload \
+				SET \
+					nasipaddress = '%{NAS-IP-Address}', \
+					reloadtime = ${....event_timestamp} \
+				ON DUPLICATE KEY UPDATE reloadtime = ${....event_timestamp}"
+		}
+
+		accounting-off {
+			query = "${..accounting-on.query}"
+		}
+
+		post-auth {
+			query = "\
+			INSERT INTO ${....acct_table1} \
+				(${...column_list}) \
+			VALUES(\
+				'%{Acct-Session-Id}', \
+				'%{Acct-Unique-Session-Id}', \
+				'%{SQL-User-Name}', \
+				'%{Realm}', \
+				'%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}}', \
+				NULLIF('%{%{NAS-Port-ID}:-%{NAS-Port}}', ''), \
+				'%{NAS-Port-Type}', \
+				${....event_timestamp}, \
+				${....event_timestamp}, \
+				NULL, \
+				0, \
+				'', \
+				'%{Connect-Info}', \
+				NULL, \
+				0, \
+				0, \
+				'%{Called-Station-Id}', \
+				'%{Calling-Station-Id}', \
+				'', \
+				'%{Service-Type}', \
+				NULL, \
+				'', \
+				'', \
+				'', \
+				'', \
+				'' \
+				${....class.packet_xlat})"
+
+			query = "\
+				UPDATE ${....acct_table1} SET \
+					AcctStartTime = ${....event_timestamp}, \
+					AcctUpdateTime = ${....event_timestamp}, \
+					ConnectInfo_start = '%{Connect-Info}', \
+					AcctSessionId = '%{Acct-Session-Id}' \
+				WHERE UserName = '%{SQL-User-Name}' \
+					AND NASIPAddress = '%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}}' \
+					AND NASPortId = '%{%{NAS-Port-ID}:-%{NAS-Port}}' \
+					AND NASPortType = '%{NAS-Port-Type}' \
+					AND AcctStopTime IS NULL"
+		}
+
+		start {
+			query = "\
+				INSERT INTO ${....acct_table1} \
+					(${...column_list}) \
+				VALUES \
+					('%{Acct-Session-Id}', \
+					'%{Acct-Unique-Session-Id}', \
+					'%{SQL-User-Name}', \
+					'%{Realm}', \
+					'%{NAS-IP-Address}', \
+					'%{%{NAS-Port-ID}:-%{NAS-Port}}', \
+					'%{NAS-Port-Type}', \
+					${....event_timestamp}, \
+					${....event_timestamp}, \
+					NULL, \
+					'0', \
+					'%{Acct-Authentic}', \
+					'%{Connect-Info}', \
+					'', \
+					'0', \
+					'0', \
+					'%{Called-Station-Id}', \
+					'%{Calling-Station-Id}', \
+					'', \
+					'%{Service-Type}', \
+					'%{Framed-Protocol}', \
+					'%{Framed-IP-Address}', \
+					'%{Framed-IPv6-Address}', \
+					'%{Framed-IPv6-Prefix}', \
+					'%{Framed-Interface-Id}', \
+					'%{Delegated-IPv6-Prefix}' \
+					${....class.packet_xlat})"
+
+			-query = "\
+				UPDATE ${....acct_table1} \
+				SET \
+					AcctSessionId = '%{Acct-Session-Id}', \
+					AcctUniqueId = '%{Acct-Unique-Session-Id}', \
+					AcctAuthentic = '%{Acct-Authentic}', \
+					ConnectInfo_start = '%{Connect-Info}', \
+					ServiceType = '%{Service-Type}', \
+					FramedProtocol = '%{Framed-Protocol}', \
+					framedipaddress = '%{Framed-IP-Address}', \
+					framedipv6address = '%{Framed-IPv6-Address}', \
+					framedipv6prefix = '%{Framed-IPv6-Prefix}', \
+					framedinterfaceid = '%{Framed-Interface-Id}', \
+					delegatedipv6prefix = '%{Delegated-IPv6-Prefix}', \
+					AcctStartTime = ${....event_timestamp}, \
+					AcctUpdateTime = ${....event_timestamp} \
+				WHERE UserName = '%{SQL-User-Name}' \
+					AND NASIPAddress = '%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}}' \
+					AND NASPortId = '%{%{NAS-Port-ID}:-%{NAS-Port}}' \
+					AND NASPortType = '%{NAS-Port-Type}' \
+					AND AcctStopTime IS NULL"
+
+			query = "\
+				UPDATE ${....acct_table1} SET \
+					acctstarttime	= ${....event_timestamp}, \
+					acctupdatetime	= ${....event_timestamp}, \
+					connectinfo_start = '%{Connect-Info}' \
+				WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'"
+		}
+
+		interim-update {
+			query = "\
+				UPDATE ${....acct_table1} \
+				SET \
+					acctupdatetime  = (@acctupdatetime_old:=acctupdatetime), \
+					acctupdatetime  = ${....event_timestamp}, \
+					acctinterval    = ${....event_timestamp_epoch} - \
+						UNIX_TIMESTAMP(@acctupdatetime_old), \
+					framedipaddress = '%{Framed-IP-Address}', \
+					framedipv6address = '%{Framed-IPv6-Address}', \
+					framedipv6prefix = '%{Framed-IPv6-Prefix}', \
+					framedinterfaceid = '%{Framed-Interface-Id}', \
+					delegatedipv6prefix = '%{Delegated-IPv6-Prefix}', \
+					acctsessiontime = %{%{Acct-Session-Time}:-NULL}, \
+					acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' \
+						<< 32 | '%{%{Acct-Input-Octets}:-0}', \
+					acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' \
+						<< 32 | '%{%{Acct-Output-Octets}:-0}' \
+				WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'"
+
+			query = "\
+				INSERT INTO ${....acct_table1} \
+					(${...column_list}) \
+				VALUES \
+					('%{Acct-Session-Id}', \
+					'%{Acct-Unique-Session-Id}', \
+					'%{SQL-User-Name}', \
+					'%{Realm}', \
+					'%{NAS-IP-Address}', \
+					'%{%{NAS-Port-ID}:-%{NAS-Port}}', \
+					'%{NAS-Port-Type}', \
+					FROM_UNIXTIME(${....event_timestamp_epoch} - %{%{Acct-Session-Time}:-0}), \
+					${....event_timestamp}, \
+					NULL, \
+					%{%{Acct-Session-Time}:-NULL}, \
+					'%{Acct-Authentic}', \
+					'%{Connect-Info}', \
+					'', \
+					'%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', \
+					'%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', \
+					'%{Called-Station-Id}', \
+					'%{Calling-Station-Id}', \
+					'', \
+					'%{Service-Type}', \
+					'%{Framed-Protocol}', \
+					'%{Framed-IP-Address}', \
+					'%{Framed-IPv6-Address}', \
+					'%{Framed-IPv6-Prefix}', \
+					'%{Framed-Interface-Id}', \
+					'%{Delegated-IPv6-Prefix}' \
+					${....class.packet_xlat})"
+
+			-query = "\
+				UPDATE ${....acct_table1} \
+				SET \
+					AcctSessionId = '%{Acct-Session-Id}', \
+					AcctUniqueId = '%{Acct-Unique-Session-Id}', \
+					AcctAuthentic = '%{Acct-Authentic}', \
+					ConnectInfo_start = '%{Connect-Info}', \
+					ServiceType = '%{Service-Type}', \
+					FramedProtocol = '%{Framed-Protocol}', \
+					framedipaddress = '%{Framed-IP-Address}', \
+					framedipv6address = '%{Framed-IPv6-Address}', \
+					framedipv6prefix = '%{Framed-IPv6-Prefix}', \
+					framedinterfaceid = '%{Framed-Interface-Id}', \
+					delegatedipv6prefix = '%{Delegated-IPv6-Prefix}', \
+					AcctUpdateTime = ${....event_timestamp}, \
+					AcctSessionTime = %{%{Acct-Session-Time}:-NULL}, \
+					AcctInputOctets = '%{%{Acct-Input-Gigawords}:-0}' \
+						<< 32 | '%{%{Acct-Input-Octets}:-0}', \
+					AcctOutputOctets = '%{%{Acct-Output-Gigawords}:-0}' \
+						<< 32 | '%{%{Acct-Output-Octets}:-0}' \
+				WHERE UserName = '%{SQL-User-Name}' \
+					AND NASIPAddress = '%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}}' \
+					AND NASPortId = '%{%{NAS-Port-ID}:-%{NAS-Port}}' \
+					AND NASPortType = '%{NAS-Port-Type}' \
+					AND AcctStopTime IS NULL"
+		}
+
+		stop {
+			query = "\
+				UPDATE ${....acct_table2} SET \
+					acctstoptime	= ${....event_timestamp}, \
+					acctsessiontime	= %{%{Acct-Session-Time}:-NULL}, \
+					acctinputoctets	= '%{%{Acct-Input-Gigawords}:-0}' \
+						<< 32 | '%{%{Acct-Input-Octets}:-0}', \
+					acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' \
+						<< 32 | '%{%{Acct-Output-Octets}:-0}', \
+					acctterminatecause = '%{Acct-Terminate-Cause}', \
+					connectinfo_stop = '%{Connect-Info}' \
+				WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'"
+
+			query = "\
+				INSERT INTO ${....acct_table2} \
+					(${...column_list}) \
+				VALUES \
+					('%{Acct-Session-Id}', \
+					'%{Acct-Unique-Session-Id}', \
+					'%{SQL-User-Name}', \
+					'%{Realm}', \
+					'%{NAS-IP-Address}', \
+					'%{%{NAS-Port-ID}:-%{NAS-Port}}', \
+					'%{NAS-Port-Type}', \
+					FROM_UNIXTIME(${....event_timestamp_epoch} - %{%{Acct-Session-Time}:-0}), \
+					${....event_timestamp}, \
+					${....event_timestamp}, \
+					%{%{Acct-Session-Time}:-NULL}, \
+					'%{Acct-Authentic}', \
+					'', \
+					'%{Connect-Info}', \
+					'%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', \
+					'%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', \
+					'%{Called-Station-Id}', \
+					'%{Calling-Station-Id}', \
+					'%{Acct-Terminate-Cause}', \
+					'%{Service-Type}', \
+					'%{Framed-Protocol}', \
+					'%{Framed-IP-Address}', \
+					'%{Framed-IPv6-Address}', \
+					'%{Framed-IPv6-Prefix}', \
+					'%{Framed-Interface-Id}', \
+					'%{Delegated-IPv6-Prefix}' \
+					${....class.packet_xlat})"
+
+			-query = "\
+				UPDATE ${....acct_table1} \
+				SET \
+					AcctSessionId = '%{Acct-Session-Id}', \
+					AcctUniqueId = '%{Acct-Unique-Session-Id}', \
+					AcctAuthentic = '%{Acct-Authentic}', \
+					ConnectInfo_start = '%{Connect-Info}', \
+					ServiceType = '%{Service-Type}', \
+					FramedProtocol = '%{Framed-Protocol}', \
+					framedipaddress = '%{Framed-IP-Address}', \
+					framedipv6address = '%{Framed-IPv6-Address}', \
+					framedipv6prefix = '%{Framed-IPv6-Prefix}', \
+					framedinterfaceid = '%{Framed-Interface-Id}', \
+					delegatedipv6prefix = '%{Delegated-IPv6-Prefix}', \
+					AcctStopTime = ${....event_timestamp}, \
+					AcctUpdateTime = ${....event_timestamp}, \
+					AcctSessionTime = %{Acct-Session-Time}, \
+					AcctInputOctets = '%{%{Acct-Input-Gigawords}:-0}' \
+						<< 32 | '%{%{Acct-Input-Octets}:-0}', \
+					AcctOutputOctets = '%{%{Acct-Output-Gigawords}:-0}' \
+						<< 32 | '%{%{Acct-Output-Octets}:-0}', \
+					AcctTerminateCause = '%{Acct-Terminate-Cause}', \
+					ConnectInfo_stop = '%{Connect-Info}' \
+				WHERE UserName = '%{SQL-User-Name}' \
+					AND NASIPAddress = '%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}}' \
+					AND NASPortId = '%{%{NAS-Port-ID}:-%{NAS-Port}}' \
+					AND NASPortType = '%{NAS-Port-Type}' \
+					AND AcctStopTime IS NULL"
+		}
+
+		accounting {
+			query = "SELECT true"
+		}
+	}
+}
+
+post-auth {
+	query =	"\
+		INSERT INTO ${..postauth_table} \
+			(username, pass, reply, authdate ${..class.column_name}) \
+		VALUES ( \
+			'%{SQL-User-Name}', \
+			'%{%{User-Password}:-%{Chap-Password}}', \
+			'%{reply:Packet-Type}', \
+			'%S.%M' \
+			${..class.reply_xlat})"
+}

ansible/roles/freeradius/files/schema.sql

@@ -0,0 +1,130 @@
+-- FreeRADIUS v3 MySQL schema
+-- Managed by Ansible
+
+CREATE TABLE IF NOT EXISTS radacct (
+  radacctid bigint(21) NOT NULL auto_increment,
+  acctsessionid varchar(64) NOT NULL default '',
+  acctuniqueid varchar(32) NOT NULL default '',
+  username varchar(64) NOT NULL default '',
+  realm varchar(64) default '',
+  nasipaddress varchar(15) NOT NULL default '',
+  nasportid varchar(32) default NULL,
+  nasporttype varchar(32) default NULL,
+  acctstarttime datetime NULL default NULL,
+  acctupdatetime datetime NULL default NULL,
+  acctstoptime datetime NULL default NULL,
+  acctinterval int(12) default NULL,
+  acctsessiontime int(12) unsigned default NULL,
+  acctauthentic varchar(32) default NULL,
+  connectinfo_start varchar(128) default NULL,
+  connectinfo_stop varchar(128) default NULL,
+  acctinputoctets bigint(20) default NULL,
+  acctoutputoctets bigint(20) default NULL,
+  calledstationid varchar(50) NOT NULL default '',
+  callingstationid varchar(50) NOT NULL default '',
+  acctterminatecause varchar(32) NOT NULL default '',
+  servicetype varchar(32) default NULL,
+  framedprotocol varchar(32) default NULL,
+  framedipaddress varchar(15) NOT NULL default '',
+  framedipv6address varchar(45) NOT NULL default '',
+  framedipv6prefix varchar(45) NOT NULL default '',
+  framedinterfaceid varchar(44) NOT NULL default '',
+  delegatedipv6prefix varchar(45) NOT NULL default '',
+  class varchar(64) default NULL,
+  PRIMARY KEY (radacctid),
+  UNIQUE KEY acctuniqueid (acctuniqueid),
+  KEY username (username),
+  KEY framedipaddress (framedipaddress),
+  KEY framedipv6address (framedipv6address),
+  KEY framedipv6prefix (framedipv6prefix),
+  KEY framedinterfaceid (framedinterfaceid),
+  KEY delegatedipv6prefix (delegatedipv6prefix),
+  KEY acctsessionid (acctsessionid),
+  KEY acctsessiontime (acctsessiontime),
+  KEY acctstarttime (acctstarttime),
+  KEY acctinterval (acctinterval),
+  KEY acctstoptime (acctstoptime),
+  KEY nasipaddress (nasipaddress),
+  KEY class (class)
+) ENGINE = INNODB;
+
+CREATE TABLE IF NOT EXISTS radcheck (
+  id int(11) unsigned NOT NULL auto_increment,
+  username varchar(64) NOT NULL default '',
+  attribute varchar(64)  NOT NULL default '',
+  op char(2) NOT NULL DEFAULT '==',
+  value varchar(253) NOT NULL default '',
+  PRIMARY KEY  (id),
+  KEY username (username(32))
+);
+
+CREATE TABLE IF NOT EXISTS radgroupcheck (
+  id int(11) unsigned NOT NULL auto_increment,
+  groupname varchar(64) NOT NULL default '',
+  attribute varchar(64)  NOT NULL default '',
+  op char(2) NOT NULL DEFAULT '==',
+  value varchar(253)  NOT NULL default '',
+  PRIMARY KEY  (id),
+  KEY groupname (groupname(32))
+);
+
+CREATE TABLE IF NOT EXISTS radgroupreply (
+  id int(11) unsigned NOT NULL auto_increment,
+  groupname varchar(64) NOT NULL default '',
+  attribute varchar(64)  NOT NULL default '',
+  op char(2) NOT NULL DEFAULT '=',
+  value varchar(253)  NOT NULL default '',
+  PRIMARY KEY  (id),
+  KEY groupname (groupname(32))
+);
+
+CREATE TABLE IF NOT EXISTS radreply (
+  id int(11) unsigned NOT NULL auto_increment,
+  username varchar(64) NOT NULL default '',
+  attribute varchar(64) NOT NULL default '',
+  op char(2) NOT NULL DEFAULT '=',
+  value varchar(253) NOT NULL default '',
+  PRIMARY KEY  (id),
+  KEY username (username(32))
+);
+
+CREATE TABLE IF NOT EXISTS radusergroup (
+  id int(11) unsigned NOT NULL auto_increment,
+  username varchar(64) NOT NULL default '',
+  groupname varchar(64) NOT NULL default '',
+  priority int(11) NOT NULL default '1',
+  PRIMARY KEY  (id),
+  KEY username (username(32))
+);
+
+CREATE TABLE IF NOT EXISTS radpostauth (
+  id int(11) NOT NULL auto_increment,
+  username varchar(64) NOT NULL default '',
+  pass varchar(64) NOT NULL default '',
+  reply varchar(32) NOT NULL default '',
+  authdate timestamp(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),
+  class varchar(64) default NULL,
+  PRIMARY KEY  (id),
+  KEY username (username),
+  KEY class (class)
+) ENGINE = INNODB;
+
+CREATE TABLE IF NOT EXISTS nas (
+  id int(10) NOT NULL auto_increment,
+  nasname varchar(128) NOT NULL,
+  shortname varchar(32),
+  type varchar(30) DEFAULT 'other',
+  ports int(5),
+  secret varchar(60) DEFAULT 'secret' NOT NULL,
+  server varchar(64),
+  community varchar(50),
+  description varchar(200) DEFAULT 'RADIUS Client',
+  PRIMARY KEY (id),
+  KEY nasname (nasname)
+) ENGINE = INNODB;
+
+CREATE TABLE IF NOT EXISTS nasreload (
+  nasipaddress varchar(15) NOT NULL,
+  reloadtime datetime NOT NULL,
+  PRIMARY KEY (nasipaddress)
+) ENGINE = INNODB;

ansible/roles/freeradius/files/seed-data.sql

@@ -0,0 +1,521 @@
+
+/*M!999999\- enable the sandbox mode */ 
+-- MariaDB dump 10.19  Distrib 10.11.18-MariaDB, for Linux (x86_64)
+--
+-- Host: localhost    Database: radius
+-- ------------------------------------------------------
+-- Server version	10.11.18-MariaDB-log
+
+/*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */;
+/*!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS */;
+/*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */;
+/*!40101 SET NAMES utf8mb4 */;
+/*!40103 SET @OLD_TIME_ZONE=@@TIME_ZONE */;
+/*!40103 SET TIME_ZONE='+00:00' */;
+/*!40014 SET @OLD_FOREIGN_KEY_CHECKS=@@FOREIGN_KEY_CHECKS, FOREIGN_KEY_CHECKS=0 */;
+/*!40101 SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE='NO_AUTO_VALUE_ON_ZERO' */;
+/*!40111 SET @OLD_SQL_NOTES=@@SQL_NOTES, SQL_NOTES=0 */;
+
+--
+-- Dumping data for table `radcheck`
+--
+
+LOCK TABLES `radcheck` WRITE;
+/*!40000 ALTER TABLE `radcheck` DISABLE KEYS */;
+INSERT INTO `radcheck` (`id`, `username`, `attribute`, `op`, `value`) VALUES (29581,'joseortiz','Cleartext-Password',':=','J2WEYT7782UJ'),
+(29578,'perlachavez2','Cleartext-Password',':=','U4BBTBMCJZST'),
+(29575,'thomashernandez','Cleartext-Password',':=','X6BZLA7SC3XM'),
+(29572,'williamarmstead','Cleartext-Password',':=','SAQ4XEKXDC58'),
+(29570,'julierose','Cleartext-Password',':=','MLM8R2WAGY52'),
+(29571,'derrickmccausland','Cleartext-Password',':=','ETNLKZHACGF7'),
+(29567,'sherrifredrick','Cleartext-Password',':=','7P52BVMTSNN6'),
+(29565,'shelbyburris','Cleartext-Password',':=','3YAL9DWFZUPT'),
+(29564,'priscillacrenshaw','Cleartext-Password',':=','AXBDLXSGXMLR'),
+(29561,'korybiggs','Cleartext-Password',':=','4FJC7DXAW5RV'),
+(29563,'kristinjimenez','Cleartext-Password',':=','9FAYXMRDU69T'),
+(29558,'jessicaweddle','Cleartext-Password',':=','VV96G36AEEDA'),
+(29557,'yolandamedrano','Cleartext-Password',':=','R948UL4KZRA4'),
+(29555,'williambowland','Cleartext-Password',':=','K7HYNWGE25XX'),
+(29554,'marcuspatton','Cleartext-Password',':=','GEUXX27VLZXK'),
+(29553,'shacaciabillings','Cleartext-Password',':=','8AZLJCDFYFYV'),
+(29552,'guadalupelugo','Cleartext-Password',':=','DQG8XCMFMVH5'),
+(29551,'brandonhardesty','Cleartext-Password',':=','KMRHVPEXBEZ8'),
+(29550,'nancyavellaneda','Cleartext-Password',':=','CXATYV7NGZN2'),
+(29549,'matthewgoodwin','Cleartext-Password',':=','VSPM7N9UNU6Y'),
+(29545,'donmckinney','Cleartext-Password',':=','C6AQ6UVD6R7R'),
+(29544,'natashaelmore','Cleartext-Password',':=','8G5QJ8R7MK8Q'),
+(29543,'shamsbashir','Cleartext-Password',':=','WLBGY4JMN4VA'),
+(29541,'douglasglover','Cleartext-Password',':=','9Y6H9X3HCG3D'),
+(29538,'carolstrickland','Cleartext-Password',':=','547P6AQ8RCD4'),
+(29537,'carmenlopez','Cleartext-Password',':=','TPLND3H2FWTQ'),
+(29534,'johnlooper','Cleartext-Password',':=','ZPL8LRY2TGRH'),
+(29535,'davidroesch','Cleartext-Password',':=','ZHB2BS968DTU'),
+(29531,'daycor','Cleartext-Password',':=','U45YBPSARH7N'),
+(29530,'derekrodriguez','Cleartext-Password',':=','AP7Z594DMR7E'),
+(29522,'joshuasoliz','Cleartext-Password',':=','PE7MHRZWUEQM'),
+(29521,'tiffanyyarley-olenak','Cleartext-Password',':=','98HTZ9Q8FARG'),
+(29514,'ericbarrett','Cleartext-Password',':=','5S2CV9FEFMKG'),
+(29513,'marysmelser','Cleartext-Password',':=','ZS74NS5BBPX3'),
+(29506,'nicolemaenn','Cleartext-Password',':=','B7KS27WL5WSN'),
+(29503,'yolandajudge','Cleartext-Password',':=','6V8RLNK75LM8'),
+(29501,'craighovde','Cleartext-Password',':=','AVZXWBX8GQTC'),
+(29498,'joselucas','Cleartext-Password',':=','ZHMW9TE8QHRX'),
+(29488,'douggarber','Cleartext-Password',':=','WXP9J5SRJWEJ'),
+(29482,'carmencleghorn','Cleartext-Password',':=','VH3CBTJZAJ2Y'),
+(29472,'rubenreyez','Cleartext-Password',':=','66384Y7B4WR4'),
+(29464,'tiffanystewart','Cleartext-Password',':=','3EGVCS6RMF3Z'),
+(29449,'dejadodson','Cleartext-Password',':=','FLR4DJHPX6TG'),
+(29447,'coreyball','Cleartext-Password',':=','3JAUWZNAR9MB'),
+(29442,'toniyoung','Cleartext-Password',':=','RJ24VTRM7JA9'),
+(29434,'melanieweddle','Cleartext-Password',':=','XQ5L7PUM9RP6'),
+(29431,'zackknuckey','Cleartext-Password',':=','VP5CCX8LTE47'),
+(29425,'christinehamparyan','Cleartext-Password',':=','WEYX9R5P7J5L'),
+(29422,'joespeciale','Cleartext-Password',':=','UH6ZCM9WLGRQ'),
+(29420,'rogerbatt','Cleartext-Password',':=','KGDJZ7V66QQK'),
+(29419,'kalebjames','Cleartext-Password',':=','KMQDGPD5XB6Z'),
+(29416,'stevemolina','Cleartext-Password',':=','BLLHWPY9RCTC'),
+(29414,'mariatrejo','Cleartext-Password',':=','EYPWCQKKWYZH'),
+(29410,'kenhall','Cleartext-Password',':=','LX897BGJNMK5'),
+(29407,'deewilliams','Cleartext-Password',':=','R8AGX3E8WAHN'),
+(29406,'johnvayo','Cleartext-Password',':=','DJJNUEEHGAW5'),
+(29398,'anthonythompson','Cleartext-Password',':=','WB4E4MPJVHTB'),
+(29608,'stevecombest','ClearText-Password',':=','STVN23552Wt'),
+(29606,'mariacastanon','ClearText-Password',':=','iu297gkid9'),
+(29395,'vanessagomez1','Cleartext-Password',':=','J5JEW3HEBVAF'),
+(29607,'luisvelira','ClearText-Password',':=','uygo875491!'),
+(29609,'keithtucker','ClearText-Password',':=','14FYJSNUU48'),
+(29610,'angelatrevino','ClearText-Password',':=','KJGU39565'),
+(29611,'brittannieredden1','ClearText-Password',':=','TYFTUEZ7429'),
+(29612,'amymontelongo','ClearText-Password',':=','ig76f7fuvu'),
+(29613,'michaelasmith','ClearText-Password',':=','MS21353GHY'),
+(29614,'samanthatheis','ClearText-Password',':=','kf6u8djigk'),
+(29615,'janisstewart','ClearText-Password',':=','JD834HCUW1C'),
+(29616,'irenegaribay','ClearText-Password',':=','uky75dkc'),
+(29383,'leonardocoronel','Cleartext-Password',':=','TXPC494'),
+(29374,'alejandrolimon','Cleartext-Password',':=','MM4BSQS7FRTD'),
+(29368,'crystalharney','Cleartext-Password',':=','A7W26H834WLJ'),
+(29647,'radiantlifeministries','Cleartext-Password',':=','12FDIUNF5L7vM'),
+(29648,'krisdougherty','Cleartext-Password',':=','rweh75uj38'),
+(29355,'olgagutierrez','Cleartext-Password',':=','WERWRMUDBZ85'),
+(29353,'greghummel','Cleartext-Password',':=','JV84HSVAK6XR'),
+(29349,'bettymitchell','Cleartext-Password',':=','8CHHCNBWQLRV'),
+(29341,'wandadavis','Cleartext-Password',':=','JXQXXZ9MKFX6'),
+(29338,'scottanderson','Cleartext-Password',':=','RJ49A43SG3RA'),
+(29335,'jenniferboon','Cleartext-Password',':=','28ESU8ELVELP'),
+(29331,'marialopez','Cleartext-Password',':=','P3FNSPT7MEYM'),
+(29329,'cynthiasandlin','Cleartext-Password',':=','MCDTLMVFQXAV'),
+(29328,'bethanybell','Cleartext-Password',':=','3UUC5X27PETS'),
+(29323,'garrettojeda','Cleartext-Password',':=','U5PRQYZE2MM3'),
+(29325,'rayschaak','Cleartext-Password',':=','XSNLP62EK6VZ'),
+(29327,'carlaswearingen','Cleartext-Password',':=','E6DQ4B2T9JZD'),
+(29320,'lesliebewley','Cleartext-Password',':=','55KFSJMEDYLK'),
+(29317,'delainawaite','Cleartext-Password',':=','EM7TWHUS4SYU'),
+(29307,'esparanzagarza','Cleartext-Password',':=','VLL9ZNPRSTG5'),
+(29653,'midvalleyconcrete','Cleartext-Password',':=','BD58JYT2PJ6A'),
+(29273,'glendabeauchamp','Cleartext-Password',':=','RKA3J8WSPYJP'),
+(29256,'glindarichter','Cleartext-Password',':=','VXMLMDAFLNJ3'),
+(29251,'nhumorrison','Cleartext-Password',':=','EC32VDFKB9CB'),
+(29245,'brittanyworley','Cleartext-Password',':=','NBKYERRBSBH4'),
+(29661,'janiscable','Cleartext-Password',':=','JHC7U554JBTR'),
+(29243,'dustynfisher','Cleartext-Password',':=','XASFU3DBPZ5M'),
+(29237,'stephenbeegle','Cleartext-Password',':=','RU5GZVTVACRC'),
+(29229,'roseanndellavalle','Cleartext-Password',':=','5GAF6JHUWWYP'),
+(29231,'duanewright','Cleartext-Password',':=','VXK4FBLVFE7F'),
+(29222,'pablohernandez','Cleartext-Password',':=','P3YB6A4JGEDF'),
+(29217,'pavelavanesov','Cleartext-Password',':=','KP8ZSGC2DG2U'),
+(29216,'wanxiaxong','Cleartext-Password',':=','BER4NEK9M7NA'),
+(29215,'bryangoulart','Cleartext-Password',':=','DTNQFE4CXSFX'),
+(29204,'sandrahoughton','Cleartext-Password',':=','5XR4QMPBXVWY'),
+(29203,'adamstaeben','Cleartext-Password',':=','GP7RANJ8UCYP'),
+(29190,'russmott','Cleartext-Password',':=','J8ZN888UQSLR'),
+(29189,'karenstewart','Cleartext-Password',':=','JSKTFAJ2JYDX'),
+(29185,'heatherwomack','Cleartext-Password',':=','89W7S5Q7UAHP'),
+(29183,'wyndijames','Cleartext-Password',':=','CPSDNRQU95HJ'),
+(29182,'angelicacuayahuitl','Cleartext-Password',':=','VK8PZW3LK5F3'),
+(29181,'chasewilliams','Cleartext-Password',':=','W6AMPQEPY3BC'),
+(29176,'kevinarana','Cleartext-Password',':=','JAJYSEG75UZS'),
+(29166,'chrisclayton','Cleartext-Password',':=','BFJ462PLHJFV'),
+(29162,'billyhorton','Cleartext-Password',':=','MPTX573ZUYYG'),
+(29151,'chisediquezada','Cleartext-Password',':=','RJBYQ2NUB829'),
+(29649,'donwilhelmus','Cleartext-Password',':=','2V4NEL87RM39'),
+(29147,'angelmerlo','Cleartext-Password',':=','EWWAPXN9Z2YS'),
+(29656,'kavalleriefarm','Cleartext-Password',':=','8DFNNTPBPZGY'),
+(29113,'kerryblack','Cleartext-Password',':=','9D5S9ZD2FCBV'),
+(29110,'cliffordjennings','Cleartext-Password',':=','5GC7M65H9VGT'),
+(29098,'carlakimberling','Cleartext-Password',':=','SS4KRJYKTV7B'),
+(29088,'richardconklin','Cleartext-Password',':=','WEUNG5H3K8BB'),
+(29089,'leandrabeshea','Cleartext-Password',':=','7V8BZU4G83VF'),
+(29640,'kellygarza','Cleartext-Password',':=','4696591662'),
+(29660,'1stchoiceliving','Cleartext-Password',':=','YVWJWRPEVYNH'),
+(29067,'robertfinch','Cleartext-Password',':=','D7FMTT455GBB'),
+(29058,'ericcoffman','Cleartext-Password',':=','MMEBXQYLZWNU'),
+(29050,'nathanaelfinch','Cleartext-Password',':=','JVNC68FV7N6B'),
+(29047,'gabrielasereno','Cleartext-Password',':=','KCH82WCRA2YR'),
+(29045,'georginacovarrubias','Cleartext-Password',':=','8QT57NUV8C7R'),
+(29035,'thomascline','Cleartext-Password',':=','E523BKVU5MJP'),
+(29034,'susanlewis','Cleartext-Password',':=','R7TZFZEGLNRW'),
+(29025,'tammywelborn','Cleartext-Password',':=','RMC482WNBS7'),
+(29023,'haleymuela','Cleartext-Password',':=','BS7X3DTKW8TH'),
+(29018,'christelles','Cleartext-Password',':=','WL2TKLFG8G2H'),
+(29017,'mauricioantonio','Cleartext-Password',':=','6QJW7RAPDBWB'),
+(29013,'vincentlimon','Cleartext-Password',':=','YDDXKFABUZY7'),
+(29655,'tech','Cleartext-Password',':=','brussels-crucial-smashing'),
+(29634,'jeffreyharder','ClearText-Password',':=','YUV565D67RT'),
+(29635,'pablomartinez','ClearText-Password',':=','2766581BER'),
+(29636,'krystalmendez','ClearText-Password',':=','6FTCKU6S56'),
+(29637,'davidvandagriff','Cleartext-Password',':=','UTRC53865F9'),
+(29638,'carolynwalker','Cleartext-Password',':=','trjxtyx75!'),
+(28979,'claygilbert','Cleartext-Password',':=','3E6XFDHXCAG7'),
+(28978,'jmichaelculverhouse','Cleartext-Password',':=','2147099521'),
+(28971,'diegosereno','Cleartext-Password',':=','2CE9F5YSPQHX'),
+(28970,'ashleysmith','Cleartext-Password',':=','F8D3FVCZB7PD'),
+(28954,'dougstowe','Cleartext-Password',':=','5D35LFD6GEAZ'),
+(28936,'timbronschidle','ClearText-Password',':=','3ZVLCWSAE3EW1'),
+(28935,'chrislewis1','Cleartext-Password',':=','V9DS4E4Y7UTT'),
+(28928,'cynthiajones','Cleartext-Password',':=','KC7ESYHEZGNR'),
+(28917,'crankkeith','Cleartext-Password',':=','kcrank10615'),
+(29646,'kimberlyrichards','Cleartext-Password',':=','7PQA6J8RPZ9Z'),
+(28867,'bobbymack','Cleartext-Password',':=','UDUBTCXXF8VV'),
+(28848,'americatrejo','Cleartext-Password',':=','3B63TLTT9WE4'),
+(28832,'tjbanschbach','Cleartext-Password',':=','8WTWTXACGG5N'),
+(28811,'luiscabrera','Cleartext-Password',':=','RWUQ94XT9A9Z'),
+(28810,'rosahernandez','Cleartext-Password',':=','JSGUXKWEMSVN'),
+(28807,'carlosgomez','Cleartext-Password',':=','J22RS7F3LGG2'),
+(28800,'kennethcampbell','Cleartext-Password',':=','!9727342446!'),
+(28763,'jeridrutledge','Cleartext-Password',':=','GJ3CZTRJJW2M'),
+(28748,'timthomas','Cleartext-Password',':=','NY223RQJD7PN'),
+(28715,'carolbates','Cleartext-Password',':=','J3UBUCMYDX64'),
+(28710,'shirleyelmore','Cleartext-Password',':=','D8Y64N9L4R9W'),
+(28703,'grahammcintire2','Cleartext-Password',':=','U5Y3hA3g*14L'),
+(28702,'chrissyeagle2','Cleartext-Password',':=','NJPCGPBNFB'),
+(28698,'swedlund','Cleartext-Password',':=','swedlund494'),
+(28695,'wendysanders','Cleartext-Password',':=','RYG9L43NWDZV'),
+(28693,'robbymccollom','Cleartext-Password',':=','RMC482WNBS7'),
+(28671,'melodymccarty','Cleartext-Password',':=','U3WLEGEB'),
+(28664,'heatherbrister2','Cleartext-Password',':=','KK37V8W9ZD9Z'),
+(28663,'ryanlloyd','Cleartext-Password',':=','HWEMKNWX55RF'),
+(28661,'amyrodriguez','Cleartext-Password',':=','WX3QRT2U6L4X'),
+(28660,'thecountrycutter','Cleartext-Password',':=','YXpScFIneePm'),
+(28659,'bradwilson','Cleartext-Password',':=','ZFAXA9AK63AH'),
+(28654,'edrater','Cleartext-Password',':=','FRY4823N'),
+(28642,'barbihardin','Cleartext-Password',':=','ZENETJ75TEVQ'),
+(28637,'vikyacosta','Cleartext-Password',':=','Z4SMV49SAH72'),
+(28633,'terrimack','Cleartext-Password',':=','B9HNTSN7ASQ4'),
+(28628,'jackworthy','Cleartext-Password',':=','2VUR7AAFWZZQ'),
+(28617,'luisarellano','Cleartext-Password',':=','GVNWBQMM3S7U'),
+(28609,'dorisavalos','Cleartext-Password',':=','DLKMJS88AF2W'),
+(29654,'ryanrodriguez','Cleartext-Password',':=','9DFYWJ47YWUP'),
+(28597,'jackierollier','Cleartext-Password',':=','TSFNN8DVDSPR'),
+(28588,'charlesmccreary','Cleartext-Password',':=','88J6XS6TXRMA'),
+(28548,'jamessmith','Cleartext-Password',':=','LRVU6RVG5SP8'),
+(28546,'davidwhitefoot','Cleartext-Password',':=','PYHTZMHJU8R8-'),
+(28542,'michaelray2','Cleartext-Password',':=','jjPgDcotL6rtY'),
+(28536,'patriciavasquez','Cleartext-Password',':=','P88256487V'),
+(28535,'adrianmcdaniel','Cleartext-Password',':=','U4TGDH2PSAB4'),
+(28526,'justinvoga','Cleartext-Password',':=','URHVCX7SFSFU'),
+(28518,'jenniferlittle','Cleartext-Password',':=','8EAUUDQPXSQX'),
+(28510,'bradslate','Cleartext-Password',':=','AF4KVQ2P44M7'),
+(28494,'irisdelira','Cleartext-Password',':=','L6XGQA583DG6'),
+(28491,'richardbarragan','Cleartext-Password',':=','WJBS86MMJBFH'),
+(28476,'jensenhall','Cleartext-Password',':=','F8XM9U8SC6LL'),
+(28466,'paulcomella','Cleartext-Password',':=','YTZDMBZCMPX4'),
+(29639,'saidaacosta','Cleartext-Password',':=','V29897X4'),
+(28458,'kennethcampbell2','Cleartext-Password',':=','V5TKW8L6RXFF'),
+(28449,'amberkrings','Cleartext-Password',':=','5NWBR3JLV6N8'),
+(28438,'mauriciosoto','Cleartext-Password',':=','DJ7YP7W7AA8M'),
+(28435,'jimcrank','Cleartext-Password',':=','PLA7XNX2F4Y3'),
+(28425,'summerbeazley','Cleartext-Password',':=','D4S4YRB8Y3KA'),
+(28426,'davidarmstrong','Cleartext-Password',':=','MPEZGG53KQSZ'),
+(29651,'jackiehendricks','Cleartext-Password',':=','UQR5HGFCJ4XX'),
+(28395,'stevenspurgers','Cleartext-Password',':=','YS5Q785J2HGZ'),
+(28388,'connercoleman','Cleartext-Password',':=','6108RANDOMREDDOG'),
+(28367,'judithfierro','Cleartext-Password',':=','FUZ33LB6SFFC'),
+(28359,'tonyasipes','Cleartext-Password',':=','N5VEZR8Q5M86'),
+(28358,'stephenday','Cleartext-Password',':=','MSVGQ8X38YLN'),
+(28347,'kathysmith','Cleartext-Password',':=','SJ53PSYCZLPR'),
+(28344,'cherieeshelman','Cleartext-Password',':=','BRUV99PN6Y7L'),
+(29644,'buddyswan','Cleartext-Password',':=','N7XUYUD7J9SD'),
+(28296,'cinthiapereira1','Cleartext-Password',':=','9WSGXM9LBXGZ'),
+(28289,'ronberger','Cleartext-Password',':=','Ronb499H7ALW'),
+(28267,'sandracrouch','Cleartext-Password',':=','V4N3764R5J'),
+(28263,'abbieandrews','Cleartext-Password',':=','YQSJ499H7ALW'),
+(28253,'perlachavez','Cleartext-Password',':=','ZWR9PXVFFYBS'),
+(28246,'susanking','Cleartext-Password',':=','N2KUYLPDNXJP'),
+(28241,'terrybachran','Cleartext-Password',':=','NG9VMH25LCTC'),
+(28240,'lanaygaunce','Cleartext-Password',':=','MJCNZAJHK9H3'),
+(28190,'heatherbrister','Cleartext-Password',':=','6XPLC545G6HW'),
+(28184,'jenniferdunaway','Cleartext-Password',':=','343V5CT2R7HZ'),
+(28159,'elviraquezada','Cleartext-Password',':=','HXAS29VRX33V'),
+(28154,'jordainpatton','Cleartext-Password',':=','J8P4TPF7QS2A'),
+(28140,'mattkosarek','Cleartext-Password',':=','RJ4BQUZJY'),
+(28117,'shannonclark','Cleartext-Password',':=','F5XESMCJ'),
+(28107,'jacquelinewilder','Cleartext-Password',':=','HEY36LUGYCUQ'),
+(28098,'kevincostanzo','Cleartext-Password',':=','244VGMVMH66D'),
+(28093,'kenpatrick','Cleartext-Password',':=','V7U3XBAPTSV3'),
+(28083,'briangallimore','Cleartext-Password',':=','39V285NX'),
+(28072,'amberprater','Cleartext-Password',':=','RP42B7AYDLAP'),
+(28068,'marilynfowler','Cleartext-Password',':=','MarilynVG72P8H'),
+(28065,'douglaswilson','Cleartext-Password',':=','HP97HG9XPYC3'),
+(28034,'terrygortney','Cleartext-Password',':=','GQUGR3VJUXBR'),
+(28031,'gizellebutler','Cleartext-Password',':=','HMZTX66RTPVX'),
+(28029,'bradgurney','Cleartext-Password',':=','7A6LRZWT82DX'),
+(28024,'darrylchavis','Cleartext-Password',':=','TDGUUNXGMYRC'),
+(28025,'kathymazzola','Cleartext-Password',':=','5MVS8VUF9QL2'),
+(27994,'austinwatkins','Cleartext-Password',':=','S7M4UD8QUTDP'),
+(27988,'oscarrodriguez','Cleartext-Password',':=','TGPCF3Y2ABXS'),
+(27986,'erinthompson','Cleartext-Password',':=','69TQZ797'),
+(27983,'brianhardesty','Cleartext-Password',':=','8D4P34N8'),
+(27976,'cathyday','Cleartext-Password',':=','FAXMKENV8FCT'),
+(27956,'fredheckel','Cleartext-Password',':=','HUVZSE8RGD65'),
+(27949,'charlesboone','Cleartext-Password',':=','Ccbn78wdfksB'),
+(27948,'rachelguzzardi','Cleartext-Password',':=','R87wgerf8bsG'),
+(27939,'reynamoore','Cleartext-Password',':=','R92nbskba7iM'),
+(27936,'juanalonzo','Cleartext-Password',':=','745GF0JK5!W'),
+(27930,'kristinamurphy','Cleartext-Password',':=','oPXFrylqKf'),
+(27926,'johnnygoble','Cleartext-Password',':=','J829fhf7G'),
+(27923,'keithbarber','Cleartext-Password',':=','K73bvd54tB'),
+(27917,'doreengrubb','Cleartext-Password',':=','DOR32SVT1234'),
+(27916,'steveraia','Cleartext-Password',':=','DRR648DFTMSE4'),
+(27912,'blancadiaz','Cleartext-Password',':=','B548gdu55D'),
+(27896,'twcowley','Cleartext-Password',':=','TW486TW'),
+(27888,'joepatton','Cleartext-Password',':=','L7luYzSKSu'),
+(27873,'timfisher','Cleartext-Password',':=','Thd73gdf5eF'),
+(27847,'kileigheven','Cleartext-Password',':=','K9872gdf8E'),
+(27838,'consueloluna1830','Cleartext-Password',':=','C8736gfd0'),
+(27833,'deannecook','Cleartext-Password',':=','Dc872cobnC'),
+(27830,'kacyharrison','Cleartext-Password',':=','7Ozr7el6K1'),
+(27822,'milliganwater','Cleartext-Password',':=','8NjGMNsTXd'),
+(27813,'michaelnewby','Cleartext-Password',':=','TM5M3HU877'),
+(27808,'ladonnaclark','Cleartext-Password',':=','YQReVH9men'),
+(27800,'jamesmooney','Cleartext-Password',':=','QNUqD2tSzq'),
+(29657,'branchrvpark','Cleartext-Password',':=','XfKxVZIKmm'),
+(27783,'tamythomas','Cleartext-Password',':=','TT4699520858tt'),
+(27781,'pambanschbach','Cleartext-Password',':=','Q2p68#*9vwF2'),
+(27780,'josephcruz','Cleartext-Password',':=','Z06oxJXrNd'),
+(27761,'franceskirby','Cleartext-Password',':=','FK8179391152fk'),
+(27759,'chadwhitsell','Cleartext-Password',':=','79374B75phGy'),
+(29641,'gordonhamilton','Cleartext-Password',':=','c3495Rpuq5Sh'),
+(27754,'ruthfengler','Cleartext-Password',':=','8q8MX6NQP3b6'),
+(27751,'bobbyfisher','Cleartext-Password',':=','salvagejuggle'),
+(27748,'eddieyarbrough','Cleartext-Password',':=','89298ChZWzMy'),
+(27744,'chrissyeagle','Cleartext-Password',':=','9vkX97426Sgt'),
+(27739,'victoriaobier','Cleartext-Password',':=','M57B288P9'),
+(27736,'bernardheer','Cleartext-Password',':=','BH33682019BER'),
+(27734,'garycable','Cleartext-Password',':=','M2w6z5Y73'),
+(27735,'coyungemach','Cleartext-Password',':=','MhS569N84e7a'),
+(27733,'michaelmccauley','Cleartext-Password',':=','CPORADIO98'),
+(27731,'lessruble','Cleartext-Password',':=','9U35SXxM2H8y'),
+(27730,'marknunnelee','Cleartext-Password',':=','833j2Ymm4yfV'),
+(27729,'elizabethchristian','Cleartext-Password',':=','Webg22nj'),
+(27724,'mikebell','Cleartext-Password',':=','BHF538HSEBDLY4'),
+(27713,'krystabates','Cleartext-Password',':=','KB2145445824kb'),
+(29658,'sensibleheatsystems','Cleartext-Password',':=','SHQWERY23'),
+(27708,'chrisfrancis','Cleartext-Password',':=','DR45QC74M'),
+(29659,'lambandlion','Cleartext-Password',':=','LL9727363567ll'),
+(27701,'markfisher','Cleartext-Password',':=','32fd8P&rw8s7'),
+(27696,'kirkvanmeter','Cleartext-Password',':=','J2sR9g^83M33'),
+(27694,'dananance','Cleartext-Password',':=','23SP$e!ug232'),
+(27690,'keithcrank','Cleartext-Password',':=','2zt3T5w72T3A'),
+(27687,'scottarmstrong','Cleartext-Password',':=','2SV58M55'),
+(27683,'floydday','Cleartext-Password',':=','Tfdd3254tfD'),
+(27680,'mariacortes','Cleartext-Password',':=','MC2145858276mc'),
+(27668,'christianlummus','ClearText-Password',':=','K6dbr631ddL'),
+(27666,'marklindsey','Cleartext-Password',':=','ML9727346434ml'),
+(27658,'joeywhitfield','Cleartext-Password',':=','BV758qXne446'),
+(27654,'taekim','Cleartext-Password',':=','SAN11837TCK'),
+(27652,'teresarobinson','Cleartext-Password',':=','T645trdf87fR'),
+(27651,'nathanmctee','Cleartext-Password',':=','N32462uu8rM'),
+(27646,'rebekahmoore','Cleartext-Password',':=','R756346tfg4M'),
+(27643,'monicatrevino','Cleartext-Password',':=','MT2145877143mt'),
+(27640,'rachelfuller','Cleartext-Password',':=','R8364hbst'),
+(27639,'choonpang','Cleartext-Password',':=','CP2143855677cp'),
+(27638,'shannonbrown','Cleartext-Password',':=','S9725298223b'),
+(27637,'allentaylor','Cleartext-Password',':=','A6346gge8T1'),
+(27632,'kristenaustin','Cleartext-Password',':=','KA8017916972ka'),
+(27630,'colinhopper','Cleartext-Password',':=','TYVU65445IUB'),
+(29642,'mattbud','Cleartext-Password',':=','kjklfda79sd'),
+(27621,'richardhill','Cleartext-Password',':=','RH9729788124rh'),
+(27619,'srireddy','Cleartext-Password',':=','ycHAvetmF0'),
+(27618,'tammieventris','Cleartext-Password',':=','DR45QC74M'),
+(27615,'almaacosta','Cleartext-Password',':=','ENKC5DGV'),
+(27614,'chrispassonno','Cleartext-Password',':=','C8766thf96P'),
+(27613,'seanbaxter','Cleartext-Password',':=','SB4696679337sb'),
+(27612,'collinhartman','Cleartext-Password',':=','B886tg98jt9L'),
+(27608,'michaeltalbot','Cleartext-Password',':=','Mjj1276rt99T'),
+(27606,'anagonzalez','Cleartext-Password',':=','WNAHDMwWoE'),
+(27604,'leonardlewis','Cleartext-Password',':=','L1877ef32L'),
+(27598,'jerryjohnson','Cleartext-Password',':=','J177895aa98J'),
+(27594,'pamtoler','Cleartext-Password',':=','NfxcgYQUbj'),
+(27589,'jodymccluskey','Cleartext-Password',':=','JM4696883349jm'),
+(27579,'donnance','Cleartext-Password',':=','9727346814'),
+(27577,'chrisvannatta','Cleartext-Password',':=','!4694502484!'),
+(27575,'mariomerlo','Cleartext-Password',':=','!2149579585!'),
+(27572,'williamarmstrong','Cleartext-Password',':=','!2145510334!'),
+(27571,'trecedaschmid','Cleartext-Password',':=','!4692075942!'),
+(27570,'ronlewis','Cleartext-Password',':=','JDkf1AL942'),
+(27567,'sherryerichardson','Cleartext-Password',':=','DR6528BCD3S2'),
+(27566,'joannarodriguez','Cleartext-Password',':=','394X3YR9'),
+(27561,'dannycampbell','Cleartext-Password',':=','!9726589541!'),
+(27560,'howardcomstock','Cleartext-Password',':=','!3365494230!'),
+(27555,'terrymiesen','Cleartext-Password',':=','!4697420828!'),
+(27550,'michaelray','Cleartext-Password',':=','primitivedefinitionstoredinner'),
+(27545,'terrybates','Cleartext-Password',':=','!2145786644!'),
+(27538,'gregmcintire','Cleartext-Password',':=','v9368$E9mx9m'),
+(27543,'beverlyerwin','Cleartext-Password',':=','MOOLAH'),
+(27518,'helenlumpkin','Cleartext-Password',':=','Heehhejd0N'),
+(27508,'stevechristiaens','Cleartext-Password',':=','zY272m258*vJ'),
+(27505,'judydevine','Cleartext-Password',':=','OD4697669725od'),
+(27501,'jonnytaylor','Cleartext-Password',':=','Zb6677&4!yky'),
+(27500,'rhondabolton','Cleartext-Password',':=','RB2145786030rb'),
+(27492,'rickbeckham','Cleartext-Password',':=','tVj7ZI5QA0'),
+(29652,'jenniferreed','Cleartext-Password',':=','683P7V7R'),
+(27490,'vancepeltonen','Cleartext-Password',':=','V66rdf43aaP'),
+(27486,'jacobwilliams','Cleartext-Password',':=','jnlka9994jkfldsa'),
+(29650,'irvinbarojas','Cleartext-Password',':=','yDeEJzYY08'),
+(27478,'classicshear','Cleartext-Password',':=','KARENALDERSON'),
+(27477,'davekiowski','Cleartext-Password',':=','FNW63KXSAPT7'),
+(27458,'paulsammataro','Cleartext-Password',':=','P2n74V7P8g4S'),
+(27460,'janetkern','Cleartext-Password',':=','j42252^Bhf44'),
+(27457,'carlossalaises','Cleartext-Password',':=','28E358y$JFB9'),
+(27453,'obedsandoval','Cleartext-Password',':=','*H78z9xy84C&'),
+(27455,'dianewiley','Cleartext-Password',':=','Diane03t4&adTL'),
+(27444,'tammylove','Cleartext-Password',':=','f65NS4Ct6$29'),
+(27438,'floydallen','Cleartext-Password',':=','V3864VB2'),
+(27436,'clayrobertson2','Cleartext-Password',':=','C2147288546R'),
+(27432,'hortenciaalvarez','Cleartext-Password',':=','WHTABORG3593JKS'),
+(27424,'timbagert','Cleartext-Password',':=','CF18n42cY7'),
+(27425,'davidbaker','Cleartext-Password',':=','DB764g1d87rtB'),
+(27421,'janicealexander','Cleartext-Password',':=','AG57TSH89L9'),
+(27423,'timgilbert','Cleartext-Password',':=','73xi0r600Sz%'),
+(27417,'donniecampbell','Cleartext-Password',':=','6a2671bc0c1'),
+(27418,'alanwyatt','Cleartext-Password',':=','i1412r53MYr'),
+(27413,'jesusrios','Cleartext-Password',':=','8Di6QMs7%7m1'),
+(27409,'veronabaptist','Cleartext-Password',':=','DAY753LIGHT253'),
+(27406,'whiteywhite','Cleartext-Password',':=','45z6r*H4418n'),
+(27404,'grahammcintire','Cleartext-Password',':=','U5Y3hA3g*14L'),
+(27402,'louislafon','Cleartext-Password',':=','RFTRE4825CVKL'),
+(27397,'ausencioluna','Cleartext-Password',':=','ABN765MNL'),
+(27374,'davidvillanueva','Cleartext-Password',':=','DV5489CRPMWBQ'),
+(29620,'sayedahaque','ClearText-Password',':=','YR4Sytbu'),
+(29621,'coryrees','ClearText-Password',':=','yt5c6ujhvu'),
+(29622,'brianamartinez','ClearText-Password',':=','ktydr6428'),
+(29623,'khushbooagarwal','ClearText-Password',':=','UUTFVUCTC446'),
+(29624,'elisasanders','ClearText-Password',':=','OYTCu3276'),
+(29625,'josemedrano','ClearText-Password',':=','UYVITRUR24'),
+(29645,'karengreen','Cleartext-Password',':=','UTKCYI674'),
+(29627,'nicholasterry','ClearText-Password',':=','VUTYVL746'),
+(29628,'leslieperalta','ClearText-Password',':=','RYC66747'),
+(29629,'khushbooagarwal2','ClearText-Password',':=','iytf65gkj'),
+(29630,'sriahobilamuth','ClearText-Password',':=','RTCESW24'),
+(29631,'royrogers','ClearText-Password',':=','TYDGVBNC'),
+(29632,'arturoprieto','ClearText-Password',':=','1653APVN877'),
+(29633,'ericamorris','ClearText-Password',':=','E16488VN387'),
+(29617,'belindamillener','ClearText-Password',':=','Uiyu7280'),
+(29618,'kailynnbarnfield','ClearText-Password',':=','HAkuguuvoy1'),
+(29619,'thomasgraham','ClearText-Password',':=','YUiygiiu4'),
+(27315,'debravega','Cleartext-Password',':=','RCG8618BDUMSR'),
+(29582,'davidlanman','Cleartext-Password',':=','2BMMRYQ2PHEA'),
+(29583,'anthonylongo','Cleartext-Password',':=','9MLG8HVME4J3'),
+(29584,'konradwoelffer','Cleartext-Password',':=','BCQ8NRFVNA3R'),
+(29585,'marthaflores','Cleartext-Password',':=','KG2QEG36348V'),
+(29586,'connorspicer','Cleartext-Password',':=','6U2BWJKGCX8G'),
+(29588,'korybiggsshop','Cleartext-Password',':=','JA4SXBGKHFUL'),
+(29589,'ednagriffin','Cleartext-Password',':=','AXA8EZEAN7DJ'),
+(29590,'richardrosson','Cleartext-Password',':=','9J5L6MEH4Y7Y'),
+(29603,'allentaylor2','ClearText-Password',':=','NCJW87FW8723'),
+(29604,'alextovias','ClearText-Password',':=','7VSgrVO1WX'),
+(29605,'mikecurrence','ClearText-Password',':=','MKH23FG79C'),
+(29594,'terryrector','Cleartext-Password',':=','QUPP83ZUUSGL'),
+(29595,'donnacampbell','Cleartext-Password',':=','KYCNTWS3929N'),
+(29600,'billmctee','ClearText-Password',':=','Bdge6388M'),
+(29643,'kimberlyrichards2','Cleartext-Password',':=','K84f7r10GT108');
+/*!40000 ALTER TABLE `radcheck` ENABLE KEYS */;
+UNLOCK TABLES;
+
+--
+-- Dumping data for table `radreply`
+--
+
+LOCK TABLES `radreply` WRITE;
+/*!40000 ALTER TABLE `radreply` DISABLE KEYS */;
+INSERT INTO `radreply` (`id`, `username`, `attribute`, `op`, `value`) VALUES (632,'grahammcintire','Framed-IP-Address','=','204.110.188.225'),
+(639,'vancepeltonen','Framed-IP-Address','=','204.110.188.229'),
+(648,'michaelray','Framed-IP-Address','=','204.110.188.38'),
+(650,'ronlewis','Framed-IP-Address','=','204.110.188.237'),
+(655,'leonardlewis','Framed-IP-Address','=','204.110.188.199'),
+(657,'taekim','Framed-IP-Address','=','204.110.188.42'),
+(658,'joeywhitfield','Framed-IP-Address','=','204.110.188.233'),
+(660,'kirkvanmeter','Framed-IP-Address','=','204.110.188.230'),
+(661,'lambandlion','Framed-IP-Address','=','204.110.188.168'),
+(662,'sensibleheatsystems','Framed-IP-Address','=','204.110.188.161'),
+(664,'elizabethchristian','Framed-IP-Address','=','204.110.188.197'),
+(665,'coyungemach','Framed-IP-Address','=','204.110.188.202'),
+(668,'branchrvpark','Framed-IP-Address','=','204.110.188.142'),
+(671,'austinwatkins','Framed-IP-Address','=','204.110.188.235'),
+(672,'marilynfowler','Framed-IP-Address','=','204.110.188.131'),
+(673,'ronberger','Framed-IP-Address','=','204.110.188.200'),
+(675,'mauriciosoto','Framed-IP-Address','=','100.64.4.1'),
+(677,'jamessmith','Framed-IP-Address','=','204.110.188.164'),
+(680,'jackierollier','Framed-IP-Address','=','204.110.188.135'),
+(681,'barbihardin','Framed-IP-Address','=','204.110.188.231'),
+(682,'gabrielasereno','Framed-IP-Address','=','204.110.188.143'),
+(684,'billyhorton','Framed-IP-Address','=','204.110.188.141'),
+(685,'janiscable','Framed-IP-Address','=','204.110.188.196'),
+(687,'radiantlifeministries','Framed-IP-Address','=','204.110.188.134'),
+(688,'rogerbatt','Framed-IP-Address','=','204.110.188.40'),
+(689,'dejadodson','Framed-IP-Address','=','204.110.188.236'),
+(690,'johnlooper','Framed-IP-Address','=','204.110.188.144'),
+(691,'marcuspatton','Framed-IP-Address','=','204.110.188.170'),
+(692,'scottanderson','Framed-IP-Address','=','100.64.48.1'),
+(693,'terrymiesen','Framed-IP-Address','=','100.64.144.1');
+/*!40000 ALTER TABLE `radreply` ENABLE KEYS */;
+UNLOCK TABLES;
+
+--
+-- Dumping data for table `radusergroup`
+--
+
+LOCK TABLES `radusergroup` WRITE;
+/*!40000 ALTER TABLE `radusergroup` DISABLE KEYS */;
+INSERT INTO `radusergroup` (`username`, `groupname`, `priority`) VALUES ('shannellrichards','delinquent',1),
+('joaniestanley','delinquent',1),
+('marlenvillanueva','delinquent',1),
+('brucejordan','delinquent',1),
+('dominiquegreen','delinquent',1);
+/*!40000 ALTER TABLE `radusergroup` ENABLE KEYS */;
+UNLOCK TABLES;
+
+--
+-- Dumping data for table `radgroupcheck`
+--
+
+LOCK TABLES `radgroupcheck` WRITE;
+/*!40000 ALTER TABLE `radgroupcheck` DISABLE KEYS */;
+INSERT INTO `radgroupcheck` (`id`, `groupname`, `attribute`, `op`, `value`) VALUES (1,'daloRADIUS-Disabled-Users','Auth-Type',':=','Reject'),
+(2,'daloRADIUS-Disabled-Users','Auth-Type',':=','Reject');
+/*!40000 ALTER TABLE `radgroupcheck` ENABLE KEYS */;
+UNLOCK TABLES;
+
+--
+-- Dumping data for table `radgroupreply`
+--
+
+LOCK TABLES `radgroupreply` WRITE;
+/*!40000 ALTER TABLE `radgroupreply` DISABLE KEYS */;
+INSERT INTO `radgroupreply` (`id`, `groupname`, `attribute`, `op`, `value`) VALUES (128,'delinquent','Mikrotik-Rate-Limit',':=','1M 1M 1M 1 9 1'),
+(129,'delinquent','Fall-Through','=','No'),
+(138,'inactive','Mikrotik-Rate-Limit',':=','1M 1M 1M 1 9 1'),
+(137,'inactive','Fall-Through','=','No'),
+(136,'delinquent-temp','Mikrotik-Rate-Limit',':=','100M 100M 100M 1 9 1');
+/*!40000 ALTER TABLE `radgroupreply` ENABLE KEYS */;
+UNLOCK TABLES;
+/*!40103 SET TIME_ZONE=@OLD_TIME_ZONE */;
+
+/*!40101 SET SQL_MODE=@OLD_SQL_MODE */;
+/*!40014 SET FOREIGN_KEY_CHECKS=@OLD_FOREIGN_KEY_CHECKS */;
+/*!40101 SET CHARACTER_SET_CLIENT=@OLD_CHARACTER_SET_CLIENT */;
+/*!40101 SET CHARACTER_SET_RESULTS=@OLD_CHARACTER_SET_RESULTS */;
+/*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */;
+/*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */;
+
+-- Dump completed on 2026-07-11 14:24:49

ansible/roles/freeradius/handlers/main.yml

@@ -0,0 +1,15 @@
+---
+- name: restart freeradius
+  ansible.builtin.service:
+    name: "{{ freeradius_service_name }}"
+    state: restarted
+
+- name: reload freeradius
+  ansible.builtin.service:
+    name: "{{ freeradius_service_name }}"
+    state: reloaded
+
+- name: restart mariadb
+  ansible.builtin.service:
+    name: mariadb
+    state: restarted

ansible/roles/freeradius/tasks/main.yml

@@ -0,0 +1,270 @@
+---
+- name: Install FreeRADIUS and MySQL packages
+  ansible.builtin.apt:
+    name: "{{ freeradius_packages }}"
+    state: present
+  notify: restart freeradius
+
+- name: Set MariaDB to listen on all interfaces
+  ansible.builtin.lineinfile:
+    path: /etc/mysql/mariadb.conf.d/50-server.cnf
+    regexp: '^bind-address'
+    line: 'bind-address = 0.0.0.0'
+  notify: restart mariadb
+
+- name: Deploy MariaDB tuning config
+  ansible.builtin.template:
+    src: mariadb-tuning.cnf.j2
+    dest: /etc/mysql/mariadb.conf.d/99-freeradius-tuning.cnf
+    owner: root
+    group: root
+    mode: '0644'
+  notify: restart mariadb
+
+- name: Create radius database
+  ansible.mysql.mysql_db:
+    name: "{{ freeradius_db_name }}"
+    state: present
+    login_unix_socket: /run/mysqld/mysqld.sock
+  when: freeradius_seed_db | bool
+
+- name: Create radius database user
+  ansible.mysql.mysql_user:
+    name: "{{ freeradius_db_user }}"
+    password: "{{ vault_freeradius_db_password }}"
+    priv: "{{ freeradius_db_name }}.*:SELECT,INSERT,UPDATE,DELETE"
+    host: localhost
+    state: present
+    login_unix_socket: /run/mysqld/mysqld.sock
+  when: freeradius_seed_db | bool
+
+- name: Copy schema SQL to server
+  ansible.builtin.copy:
+    src: schema.sql
+    dest: /tmp/radius-schema.sql
+    owner: root
+    group: root
+    mode: '0640'
+  when: freeradius_seed_db | bool
+
+- name: Seed radius database schema
+  ansible.mysql.mysql_db:
+    name: "{{ freeradius_db_name }}"
+    state: import
+    target: /tmp/radius-schema.sql
+    login_unix_socket: /run/mysqld/mysqld.sock
+  when: freeradius_seed_db | bool
+
+- name: Clean up schema SQL
+  ansible.builtin.file:
+    path: /tmp/radius-schema.sql
+    state: absent
+  when: freeradius_seed_db | bool
+
+- name: Ensure freeradius config directory exists
+  ansible.builtin.file:
+    path: "{{ freeradius_config_dir }}"
+    state: directory
+    owner: root
+    group: freerad
+    mode: '0750'
+
+- name: Ensure mods-enabled directory exists
+  ansible.builtin.file:
+    path: "{{ freeradius_config_dir }}/mods-enabled"
+    state: directory
+    owner: root
+    group: freerad
+    mode: '0750'
+
+- name: Ensure sites-enabled directory exists
+  ansible.builtin.file:
+    path: "{{ freeradius_config_dir }}/sites-enabled"
+    state: directory
+    owner: root
+    group: freerad
+    mode: '0750'
+
+- name: Ensure sql config directories exist
+  ansible.builtin.file:
+    path: "{{ freeradius_config_dir }}/mods-config/sql/main/{{ freeradius_sql_dialect }}"
+    state: directory
+    owner: root
+    group: freerad
+    mode: '0750'
+
+- name: Deploy radiusd.conf
+  ansible.builtin.template:
+    src: radiusd.conf.j2
+    dest: "{{ freeradius_config_dir }}/radiusd.conf"
+    owner: root
+    group: freerad
+    mode: '0640'
+  notify: restart freeradius
+
+- name: Deploy clients.conf
+  ansible.builtin.template:
+    src: clients.conf.j2
+    dest: "{{ freeradius_config_dir }}/clients.conf"
+    owner: root
+    group: freerad
+    mode: '0640'
+  notify: restart freeradius
+
+- name: Deploy SQL module config
+  ansible.builtin.template:
+    src: sql.j2
+    dest: "{{ freeradius_config_dir }}/mods-available/sql"
+    owner: root
+    group: freerad
+    mode: '0640'
+  notify: restart freeradius
+
+- name: Deploy SQL queries.conf
+  ansible.builtin.copy:
+    src: queries.conf
+    dest: "{{ freeradius_config_dir }}/mods-config/sql/main/{{ freeradius_sql_dialect }}/queries.conf"
+    owner: root
+    group: freerad
+    mode: '0640'
+  notify: restart freeradius
+
+- name: Deploy cache module config
+  ansible.builtin.template:
+    src: cache.j2
+    dest: "{{ freeradius_config_dir }}/mods-available/cache"
+    owner: root
+    group: freerad
+    mode: '0640'
+  notify: restart freeradius
+
+- name: Deploy default virtual server
+  ansible.builtin.template:
+    src: default.j2
+    dest: "{{ freeradius_config_dir }}/sites-available/default"
+    owner: root
+    group: freerad
+    mode: '0640'
+  notify: restart freeradius
+
+- name: Deploy inner-tunnel virtual server
+  ansible.builtin.template:
+    src: inner-tunnel.j2
+    dest: "{{ freeradius_config_dir }}/sites-available/inner-tunnel"
+    owner: root
+    group: freerad
+    mode: '0640'
+  notify: restart freeradius
+
+- name: Deploy CoA virtual server
+  ansible.builtin.template:
+    src: coa.j2
+    dest: "{{ freeradius_config_dir }}/sites-available/coa"
+    owner: root
+    group: freerad
+    mode: '0640'
+  notify: restart freeradius
+
+- name: Deploy proxy.conf
+  ansible.builtin.template:
+    src: proxy.conf.j2
+    dest: "{{ freeradius_config_dir }}/proxy.conf"
+    owner: root
+    group: freerad
+    mode: '0640'
+  notify: restart freeradius
+
+- name: Enable SQL module
+  ansible.builtin.file:
+    src: "{{ freeradius_config_dir }}/mods-available/sql"
+    dest: "{{ freeradius_config_dir }}/mods-enabled/sql"
+    state: link
+    force: true
+    owner: root
+    group: freerad
+  notify: restart freeradius
+
+- name: Enable cache module
+  ansible.builtin.file:
+    src: "{{ freeradius_config_dir }}/mods-available/cache"
+    dest: "{{ freeradius_config_dir }}/mods-enabled/cache"
+    state: link
+    force: true
+    owner: root
+    group: freerad
+  notify: restart freeradius
+
+- name: Enable default site
+  ansible.builtin.file:
+    src: "{{ freeradius_config_dir }}/sites-available/default"
+    dest: "{{ freeradius_config_dir }}/sites-enabled/default"
+    state: link
+    force: true
+    owner: root
+    group: freerad
+  notify: restart freeradius
+
+- name: Enable CoA site
+  ansible.builtin.file:
+    src: "{{ freeradius_config_dir }}/sites-available/coa"
+    dest: "{{ freeradius_config_dir }}/sites-enabled/coa"
+    state: link
+    force: true
+    owner: root
+    group: freerad
+  notify: restart freeradius
+
+- name: Seed NAS clients from ansible vars
+  ansible.mysql.mysql_query:
+    login_db: "{{ freeradius_db_name }}"
+    login_unix_socket: /run/mysqld/mysqld.sock
+    query: >-
+      INSERT INTO nas (nasname, shortname, type, ports, secret, server, community, description)
+      VALUES ('{{ item.nasname }}', '{{ item.shortname }}', '{{ item.type | default('other') }}',
+              {{ item.ports | default(0) }}, '{{ item.secret }}',
+              {{ ("'" + item.server + "'") if item.server is defined and item.server else 'NULL' }},
+              {{ ("'" + item.community + "'") if item.community is defined and item.community else 'NULL' }},
+              {{ ("'" + item.description + "'") if item.description is defined and item.description else 'NULL' }})
+      ON DUPLICATE KEY UPDATE
+        shortname = VALUES(shortname), type = VALUES(type),
+        secret = VALUES(secret), server = VALUES(server),
+        community = VALUES(community), description = VALUES(description)
+  loop: "{{ freeradius_nas_clients }}"
+  when: freeradius_seed_nas | bool and freeradius_nas_clients | length > 0
+
+- name: Copy user data SQL to server
+  ansible.builtin.copy:
+    src: seed-data.sql
+    dest: /tmp/radius-seed-data.sql
+    owner: root
+    group: root
+    mode: '0640'
+  when: freeradius_load_user_data | bool
+
+- name: Load user data from SQL dump
+  ansible.mysql.mysql_db:
+    name: "{{ freeradius_db_name }}"
+    state: import
+    target: /tmp/radius-seed-data.sql
+    login_unix_socket: /run/mysqld/mysqld.sock
+  when: freeradius_load_user_data | bool
+
+- name: Clean up user data SQL
+  ansible.builtin.file:
+    path: /tmp/radius-seed-data.sql
+    state: absent
+  when: freeradius_load_user_data | bool
+
+- name: Remove default symlinks that conflict with our config
+  ansible.builtin.file:
+    path: "{{ freeradius_config_dir }}/mods-enabled/{{ item }}"
+    state: absent
+  loop:
+    - sql
+  when: false  # only enable when needed
+
+- name: Start and enable freeradius
+  ansible.builtin.service:
+    name: "{{ freeradius_service_name }}"
+    state: started
+    enabled: true

ansible/roles/freeradius/templates/cache.j2

@@ -0,0 +1,28 @@
+# -*- text -*-
+##
+## mods-available/cache -- Attribute cache (reduces SQL load)
+##
+## Managed by Ansible — do not edit manually.
+##
+
+cache {
+	driver = "rlm_cache_rbtree"
+
+	key = "%{User-Name}"
+
+	# Cache entries for 24 hours
+	ttl = 86400
+
+	add_stats = no
+
+	update {
+		# Cache the Cleartext-Password so PAP/CHAP/MS-CHAP work without SQL
+		&control:Cleartext-Password += &control:Cleartext-Password
+
+		# Cache group membership
+		&control:SQL-Group += &control:SQL-Group
+
+		# Cache all reply attributes (Framed-IP-Address, rate limits, etc.)
+		&reply: += &reply:[*]
+	}
+}

ansible/roles/freeradius/templates/clients.conf.j2

@@ -0,0 +1,38 @@
+# -*- text -*-
+##
+## clients.conf -- FreeRADIUS client definitions
+##
+## Managed by Ansible — do not edit manually.
+##
+{% for client in freeradius_clients %}
+client {{ client.name }} {
+	ipaddr = {{ client.ipaddr }}
+	proto = *
+	secret = {{ client.secret }}
+{% if client.shortname is defined %}
+	shortname = {{ client.shortname }}
+{% endif %}
+	require_message_authenticator = no
+{% if client.nas_type is defined %}
+	nas_type = {{ client.nas_type }}
+{% else %}
+	nas_type = other
+{% endif %}
+{% if client.virtual_server is defined %}
+	virtual_server = {{ client.virtual_server }}
+{% endif %}
+{% if client.limit is defined %}
+	limit {
+{% for k, v in client.limit.items() %}
+		{{ k }} = {{ v }}
+{% endfor %}
+	}
+{% else %}
+	limit {
+		max_connections = 16
+		lifetime = 0
+		idle_timeout = 30
+	}
+{% endif %}
+}
+{% endfor %}

ansible/roles/freeradius/templates/coa.j2

@@ -0,0 +1,53 @@
+# -*- text -*-
+##
+## sites-available/coa -- Receive CoA/Disconnect and proxy to NAS
+##
+## Managed by Ansible — do not edit manually.
+##
+## gaiia sends CoA-Request or Disconnect-Request with User-Name
+## and/or Acct-Session-Id. This server looks up the active session
+## in radacct, finds the NAS, and proxies the request to it.
+##
+
+listen {
+	type = coa
+	ipaddr = *
+	port = 3799
+	virtual_server = coa
+}
+
+server coa {
+	recv-coa {
+		#
+		#  Try to find the NAS shortname from the active session.
+		#  Lookup by Acct-Session-Id first (most specific), then User-Name.
+		#
+		{% if freeradius_sql_dialect == 'mysql' -%}
+		update control {
+			&Tmp-String-0 := "%{sql:SELECT nas.shortname FROM radacct INNER JOIN nas ON radacct.nasipaddress = nas.nasname WHERE radacct.acctsessionid = '%{Acct-Session-Id}' AND radacct.AcctStopTime IS NULL LIMIT 1}"
+		}
+		if (control:Tmp-String-0 == "") {
+			update control {
+				&Tmp-String-0 := "%{sql:SELECT nas.shortname FROM radacct INNER JOIN nas ON radacct.nasipaddress = nas.nasname WHERE radacct.username = '%{User-Name}' AND radacct.AcctStopTime IS NULL LIMIT 1}"
+			}
+		}
+		{% endif -%}
+
+		#
+		#  If we found a NAS, set the home_server_pool and proxy to it.
+		#
+		if (control:Tmp-String-0 != "") {
+			update request {
+				&Home-Server-Pool := "coa-pool-%{control:Tmp-String-0}"
+			}
+		}
+		else {
+			# No active session found — reject
+			reject
+		}
+	}
+
+	send-coa {
+		ok
+	}
+}

ansible/roles/freeradius/templates/default.j2

@@ -0,0 +1,127 @@
+# -*- text -*-
+##
+## sites-available/default -- default virtual server
+##
+## Managed by Ansible — do not edit manually.
+##
+
+server default {
+
+listen {
+	type = auth
+	ipaddr = *
+	port = 0
+	limit {
+		max_connections = 16
+		lifetime = 0
+		idle_timeout = 30
+	}
+}
+
+listen {
+	ipaddr = *
+	port = 0
+	type = acct
+	limit {
+	}
+}
+
+listen {
+	type = auth
+	ipv6addr = ::
+	port = 0
+	limit {
+		max_connections = 16
+		lifetime = 0
+		idle_timeout = 30
+	}
+}
+
+listen {
+	ipv6addr = ::
+	port = 0
+	type = acct
+	limit {
+	}
+}
+
+authorize {
+	filter_username
+	preprocess
+	chap
+	mschap
+	digest
+	suffix
+	cache {
+		ok = return
+	}
+	files
+	sql
+	expiration
+	logintime
+	pap
+}
+
+authenticate {
+	Auth-Type PAP {
+		pap
+	}
+	Auth-Type CHAP {
+		chap
+	}
+	Auth-Type MS-CHAP {
+		mschap
+	}
+	mschap
+	digest
+}
+
+preacct {
+	preprocess
+	acct_unique
+	suffix
+	files
+}
+
+accounting {
+	detail
+	unix
+	-sql
+	exec
+	attr_filter.accounting_response
+}
+
+session {
+	sql
+}
+
+post-auth {
+	if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) {
+		update reply {
+			&User-Name !* ANY
+		}
+	}
+	update {
+		&reply: += &session-state:
+	}
+	-sql
+	cache
+	exec
+
+	Post-Auth-Type REJECT {
+		-sql
+		attr_filter.access_reject
+		remove_reply_message_if_eap
+	}
+
+	Post-Auth-Type Challenge {
+	}
+}
+
+pre-proxy {
+}
+
+post-proxy {
+}
+
+}

ansible/roles/freeradius/templates/inner-tunnel.j2

@@ -0,0 +1,74 @@
+# -*- text -*-
+##
+## sites-available/inner-tunnel -- EAP inner tunnel virtual server
+##
+## Managed by Ansible — do not edit manually.
+##
+
+server inner-tunnel {
+
+listen {
+	ipaddr = 127.0.0.1
+	port = 18120
+	type = auth
+}
+
+authorize {
+	filter_username
+	suffix
+	update control {
+		&Proxy-To-Realm := LOCAL
+	}
+	sql
+	chap
+	mschap
+	pap
+	eap {
+		ok = return
+	}
+	cache {
+		ok = return
+	}
+	files
+	expiration
+	logintime
+}
+
+authenticate {
+	Auth-Type PAP {
+		pap
+	}
+	Auth-Type CHAP {
+		chap
+	}
+	Auth-Type MS-CHAP {
+		mschap
+	}
+	mschap
+	eap
+}
+
+session {
+}
+
+post-auth {
+	-sql
+	cache
+
+	Post-Auth-Type REJECT {
+		-sql
+		attr_filter.access_reject
+		update outer.session-state {
+			&Module-Failure-Message := &request:Module-Failure-Message
+		}
+	}
+}
+
+pre-proxy {
+}
+
+post-proxy {
+	eap
+}
+
+}

ansible/roles/freeradius/templates/mariadb-tuning.cnf.j2

@@ -0,0 +1,33 @@
+#
+# MariaDB performance tuning for FreeRADIUS
+# Managed by Ansible — do not edit manually.
+#
+[mariadbd]
+
+# --- Connections ---
+max_connections        = 100
+thread_cache_size      = 16
+skip-name-resolve
+
+# --- InnoDB ---
+# 512M is plenty — the radius DB is small but InnoDB benefits from headroom
+innodb_buffer_pool_size = 512M
+innodb_buffer_pool_instances = 1
+innodb_flush_log_at_trx_commit = 2
+innodb_log_file_size   = 128M
+innodb_file_per_table  = 1
+innodb_flush_method    = fsync
+
+# --- Tables ---
+table_open_cache       = 256
+table_definition_cache = 400
+
+# --- Query Cache ---
+# Disabled by default in MariaDB 10.6+ — leave off for FreeRADIUS
+# (most queries are single-row lookups, query cache adds overhead)
+query_cache_type        = 0
+
+# --- Binary Logging ---
+# Disable unless replication is needed — saves disk I/O
+# skip-log-bin is default in Debian, explicit for safety
+disable_log_bin

ansible/roles/freeradius/templates/proxy.conf.j2

@@ -0,0 +1,56 @@
+# -*- text -*-
+##
+## proxy.conf -- Proxy and home_server configuration
+##
+## Managed by Ansible — do not edit manually.
+##
+
+# CoA/Disconnect home_server for each NAS
+{% for nas in freeradius_nas_clients %}
+home_server coa-{{ nas.shortname }} {
+	type = coa
+	ipaddr = {{ nas.nasname }}
+	port = 3799
+	secret = {{ nas.secret }}
+	coa {
+		irt = 2
+		mrt = 16
+		mrc = 5
+		mrd = 30
+	}
+}
+home_server_pool coa-pool-{{ nas.shortname }} {
+	type = fail-over
+	home_server = coa-{{ nas.shortname }}
+	virtual_server = originate-coa-relay
+}
+{% endfor %}
+
+# Originate CoA response handler virtual server
+server originate-coa-relay {
+	post-proxy {
+		switch &proxy-reply:Packet-Type {
+			case CoA-ACK {
+				ok
+			}
+			case CoA-NAK {
+				ok
+			}
+			case Disconnect-ACK {
+				ok
+			}
+			case Disconnect-NAK {
+				ok
+			}
+			case {
+				fail
+			}
+		}
+		Post-Proxy-Type Fail-CoA {
+			ok
+		}
+		Post-Proxy-Type Fail-Disconnect {
+			ok
+		}
+	}
+}

ansible/roles/freeradius/templates/radiusd.conf.j2

@@ -0,0 +1,91 @@
+# -*- text -*-
+##
+## radiusd.conf -- FreeRADIUS server configuration
+##
+## Managed by Ansible — do not edit manually.
+##
+
+prefix = /usr
+exec_prefix = /usr
+sysconfdir = /etc
+localstatedir = /var
+sbindir = /usr/sbin
+logdir = ${localstatedir}/log/freeradius
+raddbdir = ${sysconfdir}/freeradius/3.0
+radacctdir = ${logdir}/radacct
+
+name = radiusd
+
+confdir = ${raddbdir}
+modconfdir = ${confdir}/mods-config
+certdir = ${confdir}/certs
+cadir   = ${confdir}/certs
+run_dir = ${localstatedir}/run/${name}
+
+db_dir = ${localstatedir}/lib/radiusd
+
+libdir = /usr/lib/freeradius
+
+pidfile = ${run_dir}/${name}.pid
+
+max_request_time = 30
+cleanup_delay = 5
+max_requests = 16384
+
+hostname_lookups = no
+
+unlang {
+}
+
+log {
+	destination = files
+	colourise = yes
+	msg_denied = "You are already logged in - access denied"
+	file = ${logdir}/radius.log
+	syslog_facility = daemon
+	stripped_names = no
+	auth = yes
+	auth_badpass = no
+	auth_goodpass = no
+	msg_goodpass = ""
+	msg_badpass = ""
+}
+
+checkrad = ${sbindir}/checkrad
+
+ENV {
+}
+
+security {
+	max_attributes = 200
+	reject_delay = 1
+	status_server = yes
+	allow_vulnerable_openssl = "CVE-2016-6304"
+}
+
+proxy_requests  = yes
+
+$INCLUDE clients.conf
+$INCLUDE proxy.conf
+
+thread pool {
+	start_servers = 5
+	max_servers = 32
+	min_spare_servers = 3
+	max_spare_servers = 10
+	max_requests_per_server = 0
+	auto_limit_acct = no
+}
+
+modules {
+	$INCLUDE mods-enabled/
+}
+
+instantiate {
+}
+
+policy {
+	$INCLUDE policy.d/
+}
+
+$INCLUDE sites-enabled/

ansible/roles/freeradius/templates/sql.j2

@@ -0,0 +1,74 @@
+# -*- text -*-
+##
+## mods-available/sql -- SQL module configuration
+##
+## Managed by Ansible — do not edit manually.
+##
+
+sql {
+	dialect = "{{ freeradius_sql_dialect }}"
+	driver = "{{ freeradius_sql_driver }}"
+
+	sqlite {
+		filename = "/tmp/freeradius.db"
+		busy_timeout = 200
+		bootstrap = "${modconfdir}/${..:name}/main/sqlite/schema.sql"
+	}
+
+	mysql {
+		warnings = auto
+	}
+
+	postgresql {
+		send_application_name = yes
+	}
+
+	mongo {
+		appname = "freeradius"
+		tls {
+			certificate_file = /path/to/file
+			certificate_password = "password"
+			ca_file = /path/to/file
+			ca_dir = /path/to/directory
+			crl_file = /path/to/file
+			weak_cert_validation = false
+			allow_invalid_hostname = false
+		}
+	}
+
+	server = "{{ freeradius_db_host }}"
+	port = {{ freeradius_db_port }}
+	login = "{{ freeradius_db_user }}"
+	password = "{{ vault_freeradius_db_password }}"
+
+	radius_db = "{{ freeradius_db_name }}"
+
+	acct_table1 = "radacct"
+	acct_table2 = "radacct"
+	postauth_table = "radpostauth"
+	authcheck_table = "radcheck"
+	groupcheck_table = "radgroupcheck"
+	authreply_table = "radreply"
+	groupreply_table = "radgroupreply"
+	usergroup_table = "radusergroup"
+
+	delete_stale_sessions = yes
+
+	pool {
+		start = ${thread[pool].start_servers}
+		min = ${thread[pool].min_spare_servers}
+		max = ${thread[pool].max_servers}
+		spare = ${thread[pool].max_spare_servers}
+		uses = 0
+		retry_delay = 30
+		lifetime = 0
+		idle_timeout = 60
+	}
+
+	read_clients = {{ 'yes' if freeradius_read_clients else 'no' }}
+	client_table = "{{ freeradius_client_table }}"
+
+	group_attribute = "SQL-Group"
+
+	$INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf
+}

tofu/flatcar-resolver.bu

@@ -128,10 +128,7 @@ systemd:
         ExecStartPre=/usr/bin/docker pull mvance/unbound:latest
         ExecStart=/usr/bin/docker run \
           --name unbound \
-          -p 204.110.191.240:53:53/udp \
+          --network host \
-          -p 204.110.191.240:53:53/tcp \
-          -p 127.0.0.1:8953:8953/tcp \
-          -p 127.0.0.1:8080:8080/tcp \
           -v /etc/unbound:/opt/unbound/etc/unbound:ro \
           mvance/unbound:latest
         ExecStop=/usr/bin/docker stop unbound

tofu/flatcar-resolver2.bu

@@ -128,10 +128,7 @@ systemd:
         ExecStartPre=/usr/bin/docker pull mvance/unbound:latest
         ExecStart=/usr/bin/docker run \
           --name unbound \
-          -p 204.110.191.250:53:53/udp \
+          --network host \
-          -p 204.110.191.250:53:53/tcp \
-          -p 127.0.0.1:8953:8953/tcp \
-          -p 127.0.0.1:8080:8080/tcp \
           -v /etc/unbound:/opt/unbound/etc/unbound:ro \
           mvance/unbound:latest
         ExecStop=/usr/bin/docker stop unbound