TP3-Rebuild: ap1+ap2 als reine Standalone-APs (CAPsMAN weg)

Beide hAP ax² neu als Standalone-Access-Points provisioniert, kein CAPsMAN mehr:
- ap1 10.40.99.11 (core ether15), ap2 10.40.99.12 (branch ether24)
- Uplink geraeteseitig auf ether1 (PoE-Port, poe-out=off); ether2 aus Trunk entfernt
- 6 SSIDs (main WPA3+FT; infra/iot/media/untrusted/guest WPA2+3), iot nur 2,4 GHz,
  media FT=no; jede SSID mit eigenem datapath bridge+vlan-id -> TP3.1-Leck strukturell weg
- Kanaele non-DFS: ap1 ch36/ch1, ap2 ch149/ch11
- Einheitliches Admin-PW auf allen 4 MikroTik (core/branch/ap1/ap2)

Nautobot As-built (nautobot/ingest-ap-rebuild.py): ap1/ap2 Rolle Wireless AP + Active,
Mgmt .99.11/.99.12, ether1-Trunk, stale L3-Objekte (vlan10-90/100, wg-hub) entfernt;
crs326-core primary_ip4 auf .99.1 korrigiert. Verifiziert per GraphQL.

Doku: CLAUDE.md Hardware-Tabelle + teilprojekte.md TP3 aktualisiert.
Configs/PSKs liegen gitignored unter routeros/.secrets/.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CLAUDE.md

@@ -31,8 +31,9 @@ GW je VLAN = `.1` · APs: ap1=`.1`, ap2=`.2` · Switches: ALLNET=`.11`, Omada=`.
 | ~~Omada Access-Switch (sw2)~~ | — | ❌ **abgebaut 2026-07-23** (TP15 Branch-Tausch) — durch `crs326-branch` in Technik OG ersetzt, physisch entfernt |
 | **crs326-branch** (CRS326, Technik OG) | **10.40.99.2** (VLAN99; temp VLAN10 `.10.2`) · Bootstrap Rev4 2026-08-08 | RouterOS 7.19.5 · `admin`/`~/.secrets` (`CRS326_BRANCH_*`) · REST `http://10.40.99.2/rest` · MikroMCP `routers.yaml` (live nach MCP-Neustart) · **TP15 ✅: ersetzt sw2** (L2-Switch), volle Portbelegung (ether1 Uplink-Trunk, 2/8 NAS, 3 Drucker, 4 Dock, 5/6 Sonos, 7 macmini, 24 ap2) · sw-id RGZJ-UK0T, MAC 04:F4:1C:B4:15:58 |
 | **crs326-core** (CRS326, Technik UG) | **10.40.99.1** (VLAN99-SVI = L3-GW; same-subnet-Fallback `10.40.10.1`) · Identity `crs326-core` | RouterOS 7.19.5 · `admin`/`~/.secrets` (`CRS326_CORE_*`) · MikroMCP routerId `crs326-core` (nach MCP-Neustart) · **TP15/TP21.1 ✅ 2026-08-08: PRODUKTIVER L3-Router** (ersetzt ap1) — Routing/DHCP (7 Server + 54 Leases)/DNS (plain `1.1.1.1`, DoH-Cloudflare-TODO)/NAT/WG-Hub (fm+dw live); WAN `vlan100`=Liwest `90.146.33.177` · sw-id 4W04-URHT, MAC 04:F4:1C:B4:17:76 |
-| hAP ax² #1 (ap1) | ❌ **Werksreset + getrennt (2026-08-08)** — L3-Rolle → `crs326-core`; Ziel-Mgmt `10.40.99.11` | wird **reiner AP** (WLAN-Neuprovisionierung, eigene Session) · alte L3-Config-Referenz = `routeros/ap1-pre-core-cutover-20260806-073616.rsc` |
+| hAP ax² #1 (ap1) | **10.40.99.11** (VLAN99) · Identity `ap1` | RouterOS 7.23.2 · `admin`/`~/.secrets` (`ROUTER_AP1_*`) · REST `http://10.40.99.11/rest` · MikroMCP `ap1` (live nach MCP-Neustart) · **TP3-Rebuild ✅ 2026-08-08: reiner Standalone-AP, KEIN CAPsMAN** — Uplink `ether1` (PoE-Port, `poe-out=off`) an crs326-core `ether15`; 6 SSIDs dirtyvader-main/-infra/-iot/-media/-untrusted/-guest, ch36/ch1; jede SSID mit `datapath` (TP3.1-Leck gefixt) · MAC D0:EA:11:4D:40:E0 · Config-Referenz `routeros/.secrets/ap1-prov-base.rsc` |
-| hAP ax² #2 (ap2) | 10.40.41.2 (VLAN1, TP19.1-Umzug auf `.99.2` vertagt bis TP21/Nautobot) | MikroMCP (live) · **Port 2 am Omada-Switch** |
+| hAP ax² #2 (ap2) | **10.40.99.12** (VLAN99) · Identity `ap2` | RouterOS 7.23.2 · `admin`/`~/.secrets` (`ROUTER_AP2_*`) · REST `http://10.40.99.12/rest` · MikroMCP `ap2` · **TP3-Rebuild ✅ 2026-08-08: reiner Standalone-AP** — Uplink `ether1` (PoE) an crs326-branch `ether24`; identisch zu ap1, ch149/ch11 · MAC D0:EA:11:4D:40:3A · Config `routeros/.secrets/ap2-prov-base.rsc` |
+| **🔑 Einheitliches Admin-PW (2026-08-08)** | alle 4 MikroTik (core/branch/ap1/ap2) | user `admin`, gleiches PW (`~/.secrets/credentials.env` → `ROUTER_*_PASS`/`CRS326_*_PASS`; „Überlebensversicherung", User-Vorgabe). Werks-Defaults ap1/ap2 damit obsolet. |
 | NAS (nas-bf, DS923) | 10.40.20.10 | SSH `adm.christoph@10.40.20.10` (kein PW nötig) · Docker (Portainer endpointId=14) |
 | platform-pg (LXC 105, pve) | 10.40.20.20 | SSH via pve (`pct exec 105 --`) · **TP20 ✅ 2026-07-16: PG16, DB `nautobot`, Creds `postgres/.secrets`** |
 | Nautobot (Portainer-Stack, NAS) | 10.40.20.30 | Portainer ep14, Stack Id 203 · **TP21 ✅ 2026-07-16: `ghcr.io/nautobot/nautobot:3.1.7`, DB=platform-pg, Creds in `docs/nas-vlan20/stacks/210-nautobot.yml` (gitignored)** — Golden-Config-App/Device-Adoption noch offen |

docs/teilprojekte.md

@@ -107,6 +107,7 @@ Kontrolle: MikroMCP (MikroTik) live · ALLNET = Klickanleitungen · Omada → Co
   - **Begründung (kein Widerspruch zu Nautobot, aber ein echter Reibungspunkt):** CAPsMAN erzeugt auf dem CAP **dynamische** Objekte (`wifi13–22`), die nie in dessen eigener Config stehen → Golden-Config-Compliance sieht auf ap2 faktisch nichts. Genau diese Halbheit war die Ursache von TP3.1 (CAPsMAN schrieb `datapath.vlan-id` nicht auf die Leitung und legte die tagged-Member am CAP nicht an).
   - **Was NICHT verloren geht:** 802.11r/k/v braucht kein CAPsMAN, sondern nur gleiche SSID/PSK/Mobility-Domain → Fast-Roaming bleibt. Preis: Radio-/Kanaländerungen sind zwei Deployments statt eines Provision-Pushes — mit Nautobot ohnehin ein Job-Run.
   - **Reihenfolge:** WLAN-Neuprovisionierung erst **nach** dem CRS326-Bring-up (TP15), da Routing/DHCP/DNS vorher umziehen.
+  - ✅ **DURCH (2026-08-08): beide APs als reine Standalone-APs neu provisioniert, CAPsMAN weg.** ap1 `10.40.99.11` (an core `ether15`), ap2 `10.40.99.12` (an branch `ether24`); Uplink geräteseitig auf **`ether1`** (PoE-Port, `poe-out=off`) umgestellt, ether2 aus dem Trunk entfernt. 6 SSIDs (main WPA3+FT / infra/iot/media/untrusted/guest WPA2+3, iot nur 2,4 GHz, media FT=no); **jede SSID mit eigenem `datapath` bridge+vlan-id** → das TP3.1-„cfg-main-2g ohne datapath"-Leck ist strukturell weg. Kanäle non-DFS ap1 ch36/ch1, ap2 ch149/ch11. Client-Test grün (VLAN10/30-Leases korrekt). Configs `routeros/.secrets/ap{1,2}-prov-base.rsc`, PSKs `routeros/.secrets/wlan-psks.env`, As-built → Nautobot via `nautobot/ingest-ap-rebuild.py`. **Einheitliches Admin-PW auf allen 4 MikroTik** (User-Vorgabe). Henne-Ei beim Bring-up: Werks-`192.168.88.1` über Core-Temp-Pfad (`192.168.88.2` + masq, wieder entfernt) via scp+`/import`; Werks-Inline-Overrides auf wifi1/wifi2 mussten geleert werden (`!configuration.ssid !security.*`), sonst funkt die Main-VAP die Werks-SSID. Offen: DoH auf core (nur plain 1.1.1.1), breiterer CLAUDE.md-Gotcha-Cleanup (ap1-als-L3-Router-Referenzen sind überholt).
 
 ### TP3.1 — ap2 VLAN-Trunk-Fix ▸ ✅ Config live (2026-07-01) — `routeros/tp3.1-ap2-vlan.rsc`
 - **Root Cause:** ap2 (CAP, local forwarding) hatte `bridge vlan-filtering=no` → `datapath.vlan-id` wurde nie

nautobot/ingest-ap-rebuild.py

@@ -0,0 +1,212 @@
+#!/usr/bin/env python3
+"""BF-Netzwerk -> Nautobot: ap1/ap2 As-built als REINE Access Points (TP3-Rebuild, 2026-08-08).
+
+Governance-Auflage "intended config zurueckschreiben" nach dem WLAN-Neuaufbau (CAPsMAN abgeschafft,
+L3 auf crs326-core). Re-modelliert ap1 + ap2 identisch als Standalone-APs:
+
+  - Rolle Router -> Wireless AP, Status Active
+  - Mgmt vlan99: ap1 10.40.99.11, ap2 10.40.99.12 (primary_ip4)
+  - Uplink = ether1 (PoE-Port), Trunk: native VLAN1 + tagged 10/20/30/40/50/90/99
+  - WLAN-VAPs (wifi1/wifi2 master + Slaves) je SSID->VLAN
+  - ENTFERNT die stale L3-Objekte von ap1: vlan10/20/30/40/50/90/100 (SVIs), wg-hub
+
+Muster wie ingest-crs326-ports.py: get-or-create + Delta-PATCH, idempotent.
+Verifikation NUR per GraphQL (tagged_vlans liest sich per REST als null).
+PSKs werden bewusst NICHT modelliert (liegen lokal am Geraet).
+
+  export NAUTOBOT_TOKEN=...
+  python3 nautobot/ingest-ap-rebuild.py          # Dry-Run
+  python3 nautobot/ingest-ap-rebuild.py --apply  # schreiben
+"""
+import json, os, sys, urllib.request, urllib.error, urllib.parse
+
+BASE = "http://10.40.20.30:8080/api"
+TOKEN = os.environ.get("NAUTOBOT_TOKEN", "")
+DRY = "--apply" not in sys.argv
+log = []
+
+
+def req(method, path, data=None):
+    url = path if path.startswith("http") else f"{BASE}{path}"
+    body = json.dumps(data).encode() if data is not None else None
+    r = urllib.request.Request(url, data=body, method=method)
+    r.add_header("Authorization", f"Token {TOKEN}")
+    r.add_header("Content-Type", "application/json")
+    r.add_header("Accept", "application/json")
+    try:
+        with urllib.request.urlopen(r, timeout=30) as resp:
+            raw = resp.read()
+            return json.loads(raw) if raw else {}
+    except urllib.error.HTTPError as e:
+        print(f"!! {method} {url}\n   payload={json.dumps(data)}\n   -> {e.code} {e.read().decode()[:500]}")
+        raise
+
+
+def find(path, **params):
+    q = "&".join(f"{k}={urllib.parse.quote(str(v))}" for k, v in params.items())
+    res = req("GET", f"{path}?{q}&limit=2")
+    return res["results"][0] if res.get("count") else None
+
+
+def goc(path, match, payload, label=None):
+    name = label or payload.get("name") or str(match)
+    obj = find(path, **match)
+    if obj:
+        log.append(f"  = {name}")
+        return obj
+    if DRY:
+        log.append(f"  + {name}  (dry-run)")
+        return {"id": f"DRY-{name}"}
+    obj = req("POST", path + "/", payload)
+    log.append(f"  + {name}")
+    return obj
+
+
+def patch(path, obj, payload, label):
+    delta = {}
+    for k, v in payload.items():
+        cur = obj.get(k)
+        cur_id = cur.get("id") if isinstance(cur, dict) else cur
+        if cur_id != v:
+            delta[k] = v
+    if not delta:
+        log.append(f"  = {label} (unveraendert)")
+        return obj
+    if DRY:
+        log.append(f"  ~ {label}: {list(delta)}  (dry-run)")
+        return obj
+    out = req("PATCH", f"{path}/{obj['id']}/", delta)
+    log.append(f"  ~ {label}: {list(delta)}")
+    return out
+
+
+def sid(name):
+    return find("/extras/statuses", name=name)["id"]
+
+
+def rid(name):
+    return find("/extras/roles", name=name)["id"]
+
+
+ETH, VIRT, BR, WIFI = "1000base-t", "virtual", "bridge", "ieee802.11ax"
+S_ACTIVE = sid("Active")
+R_AP = rid("Wireless AP")
+
+vg = find("/ipam/vlan-groups", name="BF")
+V = {vid: find("/ipam/vlans", vid=vid, vlan_group=vg["id"]) for vid in (1, 10, 20, 30, 40, 50, 90, 99)}
+ns_global = find("/ipam/namespaces", name="Global")["id"]
+
+DEVS = {n: find("/dcim/devices", name=n) for n in ("ap1", "ap2")}
+TRUNK = [10, 20, 30, 40, 50, 90, 99]
+STALE = ["vlan10", "vlan20", "vlan30", "vlan40", "vlan50", "vlan90", "vlan100", "wg-hub"]
+
+# VAP -> (Band-Beschreibung, VLAN)  — Master fuehren dirtyvader-main (VLAN10)
+VAPS = {
+    "wifi1": ("5GHz master - dirtyvader-main", 10),
+    "wifi2": ("2.4GHz master - dirtyvader-main", 10),
+    "w5-infra": ("5G slave - dirtyvader-infra", 20),
+    "w5-media": ("5G slave - dirtyvader-media", 40),
+    "w5-untrusted": ("5G slave - dirtyvader-untrusted", 50),
+    "w5-guest": ("5G slave - dirtyvader-guest", 90),
+    "w2-infra": ("2.4G slave - dirtyvader-infra", 20),
+    "w2-iot": ("2.4G slave - dirtyvader-iot (nur 2.4GHz)", 30),
+    "w2-media": ("2.4G slave - dirtyvader-media", 40),
+    "w2-untrusted": ("2.4G slave - dirtyvader-untrusted", 50),
+    "w2-guest": ("2.4G slave - dirtyvader-guest", 90),
+}
+MGMT = {"ap1": "10.40.99.11/24", "ap2": "10.40.99.12/24"}
+
+
+def ifc(dev, name, typ, desc, mode=None, untagged=None, tagged=None):
+    obj = goc("/dcim/interfaces", {"device": dev, "name": name},
+              {"device": DEVS[dev]["id"], "name": name, "type": typ,
+               "status": S_ACTIVE, "description": desc}, label=f"{dev}:{name}")
+    if DRY or str(obj["id"]).startswith("DRY"):
+        return obj
+    # Beim Zurueckstufen (kein tagged-Mode) zuerst tagged_vlans leeren, sonst 400 beim mode-Clear
+    if not tagged:
+        req("PATCH", f"/dcim/interfaces/{obj['id']}/", {"tagged_vlans": []})
+    p = {"description": desc, "type": typ, "mode": mode or "",
+         "untagged_vlan": V[untagged]["id"] if untagged is not None else None}
+    obj = patch("/dcim/interfaces", obj, p, f"{dev}:{name}")
+    if tagged:
+        req("PATCH", f"/dcim/interfaces/{obj['id']}/", {"tagged_vlans": [V[t]["id"] for t in tagged]})
+    return obj
+
+
+def remove_iface(dev, name):
+    o = find("/dcim/interfaces", device=dev, name=name)
+    if not o:
+        log.append(f"  . {dev}:{name} (schon weg)")
+        return
+    if DRY:
+        log.append(f"  - {dev}:{name}  (dry-run)")
+        return
+    req("DELETE", f"/dcim/interfaces/{o['id']}/")
+    log.append(f"  - {dev}:{name}")
+
+
+def assign_mgmt(dev_obj, addr, desc):
+    """IP get-or-create, exklusiv an dev:vlan99 haengen (fremde Assignments loesen), primary setzen."""
+    ip = find("/ipam/ip-addresses", address=addr) or goc(
+        "/ipam/ip-addresses", {"address": addr},
+        {"address": addr, "status": S_ACTIVE, "namespace": ns_global, "description": desc}, label=addr)
+    if DRY or str(ip["id"]).startswith("DRY"):
+        return
+    intf = find("/dcim/interfaces", device=dev_obj["name"], name="vlan99")
+    assigns = req("GET", f"/ipam/ip-address-to-interface/?ip_address={ip['id']}&limit=50").get("results", [])
+    have = False
+    for a in assigns:
+        if a["interface"]["id"] == intf["id"]:
+            have = True
+        else:
+            req("DELETE", f"/ipam/ip-address-to-interface/{a['id']}/")
+            log.append(f"  - {addr} losgeloest von {a['interface'].get('display', '?')}")
+    if not have:
+        req("POST", "/ipam/ip-address-to-interface/", {"ip_address": ip["id"], "interface": intf["id"]})
+        log.append(f"  + {addr} -> {dev_obj['name']}:vlan99")
+    req("PATCH", f"/dcim/devices/{dev_obj['id']}/", {"primary_ip4": ip["id"]})
+
+
+def set_mgmt(dev, addr):
+    assign_mgmt(DEVS[dev], addr, f"{dev} Mgmt (VLAN99)")
+
+
+# --- Core-Mgmt-Konsistenz: crs326-core primary = .99.1 (das stale .99.11 wandert unten zu ap1) ---
+core = find("/dcim/devices", name="crs326-core")
+if core:
+    print("== crs326-core: Mgmt-IP korrigieren -> 10.40.99.1")
+    assign_mgmt(core, "10.40.99.1/24", "crs326-core Mgmt/GW SVI (VLAN99)")
+
+
+COMMENT = ("TP3-Rebuild 2026-08-08: reiner Standalone-AP (kein CAPsMAN). L3 auf crs326-core. "
+           "Uplink ether1 (PoE, poe-out=off), Trunk native VLAN1 + tagged 10/20/30/40/50/90/99. "
+           "6 SSIDs dirtyvader-main/-infra/-iot/-media/-untrusted/-guest. PSKs lokal am Geraet.")
+
+for dev in ("ap1", "ap2"):
+    if not DEVS[dev]:
+        print(f"!! Device {dev} nicht in Nautobot gefunden - uebersprungen")
+        continue
+    print(f"== {dev}: -> reiner Access Point")
+    patch("/dcim/devices", DEVS[dev], {"role": R_AP, "status": S_ACTIVE}, f"{dev} role/status")
+    ifc(dev, "bridge", BR, "vlan-filtering=yes; VLAN1 untagged, 10-99 tagged")
+    ifc(dev, "ether1", ETH, "Uplink-Trunk (PoE-Port, poe-out=off): native VLAN1 + tagged 10/20/30/40/50/90/99",
+        mode="tagged", untagged=1, tagged=TRUNK)
+    ifc(dev, "ether2", ETH, "frei (Alt-Uplink, seit ether1-Umstellung ungenutzt)")
+    for n in (3, 4, 5):
+        ifc(dev, f"ether{n}", ETH, "frei")
+    ifc(dev, "vlan99", VIRT, "Mgmt SVI (VLAN99)", mode="tagged", tagged=[99])
+    if not DRY:
+        v99 = find("/dcim/interfaces", device=dev, name="vlan99")
+        br = find("/dcim/interfaces", device=dev, name="bridge")
+        req("PATCH", f"/dcim/interfaces/{v99['id']}/", {"parent_interface": br["id"]})
+    for name, (desc, vlan) in VAPS.items():
+        ifc(dev, name, WIFI, desc, mode="access", untagged=vlan)
+    for name in STALE:
+        remove_iface(dev, name)
+    set_mgmt(dev, MGMT[dev])
+    if not DRY:
+        req("PATCH", f"/dcim/devices/{DEVS[dev]['id']}/", {"comments": COMMENT})
+
+print("\n".join(log))
+print(f"\n{'DRY-RUN - nichts geschrieben. Mit --apply ausfuehren.' if DRY else 'ANGEWENDET.'}")