feat(freeradius): add dynamic tenant VLAN assignment via unlang policy

Add hard validation to reject requests without assigned IP address,
including clear rejection message for audit trail.

.gitignore

@@ -0,0 +1 @@
+charts/

.gitlab-ci.yml

@@ -8,7 +8,7 @@ stages:
 
 variables:
   CHART_NAME: "freeradius"
-  CHART_VERSION: "1.0.9"
+  CHART_VERSION: "1.0.12"
   PACKAGE_PATH: "packages"
   ST_COMMON_PROJECT_ID: "270"
   COMMON_PROJECT_URL: "${CI_API_V4_URL}/projects/${ST_COMMON_PROJECT_ID}/packages/helm/stable"

Chart.lock

@@ -2,8 +2,5 @@ dependencies:
 - name: st-common
   repository: https://gitlab/api/v4/projects/270/packages/helm/stable
   version: 0.1.12
-- name: mariadb
-  repository: oci://registry-1.docker.io/bitnamicharts
-  version: 20.5.9
-digest: sha256:55c375d2786b3554c8e0d35dfe1e2fb4c6d67d2ba7ee5cbcdc7c3e0a9c564d01
-generated: "2025-11-25T11:46:23.835203402+01:00"
+digest: sha256:effc27041fec14dd47ce67b96daae936455482afe0a2d3d6069ebffd7e33ba2c
+generated: "2026-02-03T12:45:51.347388527+01:00"

Chart.yaml

@@ -6,10 +6,6 @@ dependencies:
 - name: st-common
   repository: https://gitlab/api/v4/projects/270/packages/helm/stable
   version: 0.1.12
-- condition: mariadb.enabled
-  name: mariadb
-  repository: oci://registry-1.docker.io/bitnamicharts
-  version: 20.x.x
 description: FreeRADIUS is a modular, high performance free RADIUS suite developed
   and distributed under the GNU General Public License, version 2, and is free for
   download and use.
@@ -31,4 +27,4 @@ sources:
 - https://freeradius.org/
 - https://github.com/FreeRADIUS/freeradius-server
 type: application
-version: 1.0.9
+version: 1.0.12

files/mods-available/sqlippool

@@ -0,0 +1,110 @@
+#  Configuration for the SQL based IP Pool module (rlm_sqlippool)
+#
+#  The database schemas are available at:
+#
+#       raddb/mods-config/sql/ippool/<DB>/schema.sql
+#
+#  $Id: f17a9898e906d3db0ad5871d8683f731f7a6baab $
+
+sqlippool {
+        # SQL instance to use (from mods-available/sql)
+        #
+        #  If you have multiple sql instances, such as "sql sql1 {...}",
+        #  use the *instance* name here: sql1.
+        sql_module_instance = "sql"
+
+        #  This is duplicative of info available in the SQL module, but
+        #  we have to list it here as we do not yet support nested
+        #  reference expansions.
+        dialect = $ENV{FREERADIUS_MODS_SQL_DIALECT}
+
+        # Name of the check item attribute to be used as a key in the SQL queries
+        pool_name = "Pool-Name"
+
+        # SQL table to use for ippool range and lease info
+        ippool_table = $ENV{FREERADIUS_MODS_SQL_TABLE_RADIPPOOL}
+
+        # IP lease duration. (Leases expire even if Acct Stop packet is lost)
+        #
+        #  Note that you SHOULD also set Session-Timeout to this value!
+        #  That way the NAS will automatically kick the user offline when the
+        #  lease expires.
+        #
+        lease_duration = 18000
+
+        #
+        # Timeout between each consecutive 'allocate_clear' queries (default: 1s)
+        # This will avoid having too many deadlock issues, especially on MySQL backend.
+        #
+        allocate_clear_timeout = 1
+
+        #
+        #  The attribute to use for IP address assignment.  The
+        #  default is Framed-IP-Address.  You can change this to any
+        #  attribute which is IPv4 or IPv6.
+        #
+        #  e.g. Framed-IPv6-Prefix, or Delegated-IPv6-Prefix.
+        #
+        #  All of the default queries use this attribute_name.  So you
+        #  can do IPv6 address assignment simply by putting IPv6
+        #  addresses into the pool, and changing the following line to
+        #  "Framed-IPv6-Prefix"
+        #
+        #  Note that you MUST use separate pools for each attribute.  i.e. one pool
+        #  for Framed-IP-Address, a different one for Framed-IPv6-prefix, etc.
+        #
+        #  This means configuring separate "sqlippool" instances, and different
+        #  "ippool_table" in SQL.  Then, populate the pool with addresses and
+        #  it will all just work.
+        #
+        attribute_name = Framed-IP-Address
+
+        #
+        #  Assign the IP address, even if the above attribute already exists
+        #  in the reply.
+        #
+#       allow_duplicates = no
+
+        #  The attribute in which an IP address hint may be supplied
+        req_attribute_name = Framed-IP-Address
+
+        # Attribute which should be considered unique per NAS
+        #
+        #  Using NAS-Port gives behaviour similar to rlm_ippool. (And ACS)
+        #  Using Calling-Station-Id works for NAS that send fixed NAS-Port
+        #  ONLY change this if you know what you are doing!
+        # pool_key = "%{NAS-Port}"
+        # pool_key = "%{Calling-Station-Id}"
+        pool_key = "%{User-Name}"
+        nas_ip_address = "%{NAS-IP-Address}"
+        ################################################################
+        #
+        #  WARNING: MySQL (MyISAM) has certain limitations that means it can
+        #           hand out the same IP address to 2 different users.
+        #
+        #           We suggest using an SQL DB with proper transaction
+        #           support, such as PostgreSQL, or using MySQL
+        #            with InnoDB.
+        #
+        ################################################################
+
+        #  These messages are added to the "control" items, as
+        #  Module-Success-Message.  They are not logged anywhere else,
+        #  unlike previous versions.  If you want to have them logged
+        #  to a file, see the "linelog" module, and create an entry
+        #  which writes Module-Success-Message message.
+        #
+        messages {
+                exists = "Existing IP: %{reply:${..attribute_name}} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})"
+
+                success = "Allocated IP: %{reply:${..attribute_name}} from %{control:${..pool_name}} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})"
+
+                clear = "Released IP %{request:${..attribute_name}} (did %{Called-Station-Id} cli %{Calling-Station-Id} user %{User-Name})"
+
+                failed = "IP Allocation FAILED from %{control:${..pool_name}} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})"
+
+                nopool = "No ${..pool_name} defined (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})"
+        }
+
+        $INCLUDE ${modconfdir}/sql/ippool/${dialect}/queries.conf
+}

files/mods-config/queries.conf

@@ -0,0 +1,694 @@
+# -*- text -*-
+#
+#  main/mysql/queries.conf-- MySQL configuration for default schema (schema.sql)
+#
+#  $Id: b31ae9c3a1bf41f030a2112d31bf3a678e76f23c $
+
+# Use the driver specific SQL escape method.
+#
+# If you enable this configuration item, the "safe_characters"
+# configuration is ignored.  FreeRADIUS then uses the MySQL escape
+# functions to escape input strings.  The only downside to making this
+# change is that the MySQL escaping method is not the same the one
+# used by FreeRADIUS.  So characters which are NOT in the
+# "safe_characters" list will now be stored differently in the database.
+#
+#auto_escape = yes
+
+# Safe characters list for sql queries. Everything else is replaced
+# with their mime-encoded equivalents.
+# The default list should be ok
+# Using 'auto_escape' is preferred
+safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /"
+
+#######################################################################
+#  Connection config
+#######################################################################
+# The character set is not configurable. The default character set of
+# the mysql client library is used. To control the character set,
+# create/edit my.cnf (typically in /etc/mysql/my.cnf or /etc/my.cnf)
+# and enter
+# [freeradius]
+# default-character-set = utf8
+#
+
+#######################################################################
+#  Query config:  Username
+#######################################################################
+# This is the username that will get substituted, escaped, and added
+# as attribute 'SQL-User-Name'. '%{SQL-User-Name}' should be used below
+# everywhere a username substitution is needed so you you can be sure
+# the username passed from the client is escaped properly.
+#
+# Uncomment the next line, if you want the sql_user_name to mean:
+#
+#       Use Stripped-User-Name, if it's there.
+#       Else use User-Name, if it's there,
+#       Else use hard-coded string "DEFAULT" as the user name.
+#sql_user_name = "%{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}}"
+#
+sql_user_name = "%{User-Name}"
+
+#######################################################################
+#  Query config:  Event-Timestamp
+#######################################################################
+# event_timestamp_epoch is the basis for the time inserted into
+# accounting records. Typically this will be the Event-Timestamp of the
+# accounting request, which is usually provided by a NAS.
+#
+# Uncomment the next line, if you want the timestamp to be based on the
+# request reception time recorded by this server, for example if you
+# distrust the provided Event-Timestamp.
+#event_timestamp_epoch = "%l"
+
+event_timestamp_epoch = "%{%{integer:Event-Timestamp}:-%l}"
+
+# event_timestamp is the SQL snippet for converting an epoch timestamp
+# to an SQL date.
+
+event_timestamp = "FROM_UNIXTIME(${event_timestamp_epoch})"
+
+#######################################################################
+#  Query config:  Class attribute
+#######################################################################
+#
+#  3.0.22 and later have a "class" column in the accounting table.
+#
+#  However, we do NOT want to break existing configurations by adding
+#  the Class attribute to the default queries.  If we did that, then
+#  systems using newer versions of the server would fail, because
+#  there is no "class" column in their accounting tables.
+#
+#  The solution to that is the following "class" subsection.  If your
+#  database has a "class" column for the various tables, then you can
+#  uncomment the configuration items here.  The queries below will
+#  then automatically insert the Class attribute into radacct,
+#  radpostauth, etc.
+#
+class {
+        #
+        #  Delete the '#' character from each of the configuration
+        #  items in this section.  This change puts the Class
+        #  attribute into the various tables.  Leave the double-quoted
+        #  string there, as the value for the configuration item.
+        #
+        #  See also policy.d/accounting, and the "insert_acct_class"
+        #  policy.  You will need to list (or uncomment)
+        #  "insert_acct_class" in the "post-auth" section in order to
+        #  create a Class attribute.
+        #
+        column_name =   # ", class"
+        packet_xlat =   # ", '%{Class}'"
+        reply_xlat =    # ", '%{reply:Class}'"
+}
+
+#######################################################################
+# Default profile
+#######################################################################
+# This is the default profile. It is found in SQL by group membership.
+# That means that this profile must be a member of at least one group
+# which will contain the corresponding check and reply items.
+# This profile will be queried in the authorize section for every user.
+# The point is to assign all users a default profile without having to
+# manually add each one to a group that will contain the profile.
+# The SQL module will also honor the User-Profile attribute. This
+# attribute can be set anywhere in the authorize section (ie the users
+# file). It is found exactly as the default profile is found.
+# If it is set then it will *overwrite* the default profile setting.
+# The idea is to select profiles based on checks on the incoming packets,
+# not on user group membership. For example:
+# -- users file --
+# DEFAULT       Service-Type == Outbound-User, User-Profile := "outbound"
+# DEFAULT       Service-Type == Framed-User, User-Profile := "framed"
+#
+# By default the default_user_profile is not set
+#
+#default_user_profile = "DEFAULT"
+
+#######################################################################
+# NAS Query
+#######################################################################
+# This query retrieves the radius clients
+#
+# 0. Row ID (currently unused)
+# 1. Name (or IP address)
+# 2. Shortname
+# 3. Type
+# 4. Secret
+# 5. Server
+#######################################################################
+
+client_query = "\
+        SELECT id, nasname, shortname, type, secret, server \
+        FROM ${client_table}"
+
+#######################################################################
+# Authorization Queries
+#######################################################################
+# These queries compare the check items for the user
+# in ${authcheck_table} and setup the reply items in
+# ${authreply_table}. You can use any query/tables
+# you want, but the return data for each row MUST
+# be in the following order:
+#
+# 0. Row ID (currently unused)
+# 1. UserName/GroupName
+# 2. Item Attr Name
+# 3. Item Attr Value
+# 4. Item Attr Operation
+#######################################################################
+# Use these for case sensitive usernames.
+
+#authorize_check_query = "\
+#       SELECT id, username, attribute, value, op \
+#       FROM ${authcheck_table} \
+#       WHERE username = BINARY '%{SQL-User-Name}' \
+#       ORDER BY id"
+
+#authorize_reply_query = "\
+#       SELECT id, username, attribute, value, op \
+#       FROM ${authreply_table} \
+#       WHERE username = BINARY '%{SQL-User-Name}' \
+#       ORDER BY id"
+
+#
+#  The default queries are case insensitive. (for compatibility with
+#  older versions of FreeRADIUS)
+#
+authorize_check_query = "\
+        SELECT id, username, attribute, value, op \
+        FROM ${authcheck_table} \
+        WHERE username = '%{SQL-User-Name}' \
+        ORDER BY id"
+
+authorize_reply_query = "\
+        SELECT id, username, attribute, value, op \
+        FROM ${authreply_table} \
+        WHERE username = '%{SQL-User-Name}' \
+        ORDER BY id"
+
+#
+#  Use these for case sensitive usernames.
+#
+#group_membership_query = "\
+#       SELECT groupname \
+#       FROM ${usergroup_table} \
+#       WHERE username = BINARY '%{SQL-User-Name}' \
+#       ORDER BY priority"
+
+group_membership_query = "\
+        SELECT groupname \
+        FROM ${usergroup_table} \
+        WHERE username = '%{SQL-User-Name}' \
+        ORDER BY priority"
+
+authorize_group_check_query = "\
+        SELECT id, groupname, attribute, \
+        Value, op \
+        FROM ${groupcheck_table} \
+        WHERE groupname = '%{${group_attribute}}' \
+        ORDER BY id"
+
+authorize_group_reply_query = "\
+        SELECT id, groupname, attribute, \
+        value, op \
+        FROM ${groupreply_table} \
+        WHERE groupname = '%{${group_attribute}}' \
+        ORDER BY id"
+
+#######################################################################
+# Simultaneous Use Checking Queries
+#######################################################################
+# simul_count_query     - query for the number of current connections
+#                       - If this is not defined, no simultaneous use checking
+#                       - will be performed by this module instance
+# simul_verify_query    - query to return details of current connections
+#                               for verification
+#                       - Leave blank or commented out to disable verification step
+#                       - Note that the returned field order should not be changed.
+#
+# Note: Sessions that started prior to the most recent reload of their NAS will
+# be correctly considered inactive, even if the radacct entry itself is not
+# marked as stopped.
+#
+#######################################################################
+
+simul_count_query = "\
+        SELECT COUNT(*) \
+        FROM ${acct_table1} a \
+        LEFT OUTER JOIN nasreload n USING (nasipaddress) \
+        WHERE username = '%{SQL-User-Name}' \
+        AND acctstoptime IS NULL \
+        AND (a.acctstarttime > n.reloadtime OR n.reloadtime IS NULL)"
+
+simul_verify_query = "\
+        SELECT \
+                radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, \
+                callingstationid, framedprotocol \
+        FROM ${acct_table1} a \
+        LEFT OUTER JOIN nasreload n USING (nasipaddress) \
+        WHERE username = '%{SQL-User-Name}' \
+        AND acctstoptime IS NULL \
+        AND (a.acctstarttime > n.reloadtime OR n.reloadtime IS NULL)"
+
+#######################################################################
+# Accounting and Post-Auth Queries
+#######################################################################
+# These queries insert/update accounting and authentication records.
+# The query to use is determined by the value of 'reference'.
+# This value is used as a configuration path and should resolve to one
+# or more 'query's. If reference points to multiple queries, and a query
+# fails, the next query is executed.
+#
+# Behaviour is identical to the old 1.x/2.x module, except we can now
+# fail between N queries, and query selection can be based on any
+# combination of attributes, or custom 'Acct-Status-Type' values.
+#######################################################################
+accounting {
+        reference = "%{tolower:type.%{%{Acct-Status-Type}:-%{Request-Processing-Stage}}.query}"
+
+        # Write SQL queries to a logfile. This is potentially useful for bulk inserts
+        # when used with the rlm_sql_null driver.
+#       logfile = ${logdir}/accounting.sql
+
+        column_list = "\
+                acctsessionid,          acctuniqueid,           username, \
+                realm,                  nasipaddress,           nasportid, \
+                nasporttype,            acctstarttime,          acctupdatetime, \
+                acctstoptime,           acctsessiontime,        acctauthentic, \
+                connectinfo_start,      connectinfo_stop,       acctinputoctets, \
+                acctoutputoctets,       calledstationid,        callingstationid, \
+                acctterminatecause,     servicetype,            framedprotocol, \
+                framedipaddress,        framedipv6address,      framedipv6prefix, \
+                framedinterfaceid,      delegatedipv6prefix     ${..class.column_name}"
+
+        type {
+                accounting-on {
+
+                        #
+                        #  "Bulk update" Accounting-On/Off strategy.
+                        #
+                        #  Immediately terminate all sessions associated with a
+                        #  given NAS.
+                        #
+                        #  Note: If a large number of sessions require closing
+                        #  then the bulk update may be take a long time to run
+                        #  and lock an excessive number of rows. See the
+                        #  strategy below for an alternative approach that does
+                        #  not touch the radacct session data.
+                        #
+                        query = "\
+                                UPDATE ${....acct_table1} \
+                                SET \
+                                        acctstoptime = ${....event_timestamp}, \
+                                        acctsessiontime = '${....event_timestamp_epoch}' \
+                                                - UNIX_TIMESTAMP(acctstarttime), \
+                                        acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' \
+                                WHERE acctstoptime IS NULL \
+                                AND nasipaddress   = '%{NAS-IP-Address}' \
+                                AND acctstarttime <= ${....event_timestamp}"
+
+                        #
+                        #  "Lightweight" Accounting-On/Off strategy.
+                        #
+                        #  Record the reload time of the NAS and let the
+                        #  administrator actually close the sessions in radacct
+                        #  out-of-band, if desired.
+                        #
+                        #  Implementation advice, together with a stored
+                        #  procedure for closing sessions and a view showing
+                        #  the effective stop time of each session is provided
+                        #  in process-radacct.sql.
+                        #
+                        #  To enable this strategy, just change the previous
+                        #  query to "-query", and this one to "query".  The
+                        #  previous one will be ignored, and this one will be
+                        #  enabled.
+                        #
+                        -query = "\
+                                INSERT INTO nasreload \
+                                SET \
+                                        nasipaddress = '%{NAS-IP-Address}', \
+                                        reloadtime = ${....event_timestamp} \
+                                ON DUPLICATE KEY UPDATE reloadtime = ${....event_timestamp}"
+
+                }
+
+                accounting-off {
+                        query = "${..accounting-on.query}"
+                }
+
+                #
+                #  Implement the "sql_session_start" policy.
+                #  See raddb/policy.d/accounting for more details.
+                #
+                #  You also need to fix the other queries as
+                #  documented below.  Look for "sql_session_start".
+                #
+                post-auth {
+                        query = "\
+                        INSERT INTO ${....acct_table1} \
+                                (${...column_list}) \
+                        VALUES(\
+                                '%{Acct-Session-Id}', \
+                                '%{Acct-Unique-Session-Id}', \
+                                '%{SQL-User-Name}', \
+                                '%{Realm}', \
+                                '%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}}', \
+                                NULLIF('%{%{NAS-Port-ID}:-%{NAS-Port}}', ''), \
+                                '%{NAS-Port-Type}', \
+                                ${....event_timestamp}, \
+                                ${....event_timestamp}, \
+                                NULL, \
+                                0, \
+                                '', \
+                                '%{Connect-Info}', \
+                                NULL, \
+                                0, \
+                                0, \
+                                '%{Called-Station-Id}', \
+                                '%{Calling-Station-Id}', \
+                                '', \
+                                '%{Service-Type}', \
+                                NULL, \
+                                '', \
+                                '', \
+                                '', \
+                                '', \
+                                '' \
+                                ${....class.packet_xlat})"
+
+                        query = "\
+                                UPDATE ${....acct_table1} SET \
+                                        AcctStartTime = ${....event_timestamp}, \
+                                        AcctUpdateTime = ${....event_timestamp}, \
+                                        ConnectInfo_start = '%{Connect-Info}', \
+                                        AcctSessionId = '%{Acct-Session-Id}' \
+                                WHERE UserName = '%{SQL-User-Name}' \
+                                        AND NASIPAddress = '%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}}' \
+                                        AND NASPortId = '%{%{NAS-Port-ID}:-%{NAS-Port}}' \
+                                        AND NASPortType = '%{NAS-Port-Type}' \
+                                        AND AcctStopTime IS NULL"
+                }
+
+                start {
+                        #
+                        #  Insert a new record into the sessions table
+                        #
+                        query = "\
+                                INSERT INTO ${....acct_table1} \
+                                        (${...column_list}) \
+                                VALUES \
+                                        ('%{Acct-Session-Id}', \
+                                        '%{Acct-Unique-Session-Id}', \
+                                        '%{SQL-User-Name}', \
+                                        '%{Realm}', \
+                                        '%{NAS-IP-Address}', \
+                                        '%{%{NAS-Port-ID}:-%{NAS-Port}}', \
+                                        '%{NAS-Port-Type}', \
+                                        ${....event_timestamp}, \
+                                        ${....event_timestamp}, \
+                                        NULL, \
+                                        '0', \
+                                        '%{Acct-Authentic}', \
+                                        '%{Connect-Info}', \
+                                        '', \
+                                        '0', \
+                                        '0', \
+                                        '%{Called-Station-Id}', \
+                                        '%{Calling-Station-Id}', \
+                                        '', \
+                                        '%{Service-Type}', \
+                                        '%{Framed-Protocol}', \
+                                        '%{Framed-IP-Address}', \
+                                        '%{Framed-IPv6-Address}', \
+                                        '%{Framed-IPv6-Prefix}', \
+                                        '%{Framed-Interface-Id}', \
+                                        '%{Delegated-IPv6-Prefix}' \
+                                        ${....class.packet_xlat})"
+
+                        #
+                        #  When using "sql_session_start", you should comment out
+                        #  the previous query, and enable this one.
+                        #
+                        #  Just change the previous query to "-query",
+                        #  and this one to "query".  The previous one
+                        #  will be ignored, and this one will be
+                        #  enabled.
+                        #
+                        -query = "\
+                                UPDATE ${....acct_table1} \
+                                SET \
+                                        AcctSessionId = '%{Acct-Session-Id}', \
+                                        AcctUniqueId = '%{Acct-Unique-Session-Id}', \
+                                        AcctAuthentic = '%{Acct-Authentic}', \
+                                        ConnectInfo_start = '%{Connect-Info}', \
+                                        ServiceType = '%{Service-Type}', \
+                                        FramedProtocol = '%{Framed-Protocol}', \
+                                        framedipaddress = '%{Framed-IP-Address}', \
+                                        framedipv6address = '%{Framed-IPv6-Address}', \
+                                        framedipv6prefix = '%{Framed-IPv6-Prefix}', \
+                                        framedinterfaceid = '%{Framed-Interface-Id}', \
+                                        delegatedipv6prefix = '%{Delegated-IPv6-Prefix}', \
+                                        AcctStartTime = ${....event_timestamp}, \
+                                        AcctUpdateTime = ${....event_timestamp} \
+                                WHERE UserName = '%{SQL-User-Name}' \
+                                        AND NASIPAddress = '%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}}' \
+                                        AND NASPortId = '%{%{NAS-Port-ID}:-%{NAS-Port}}' \
+                                        AND NASPortType = '%{NAS-Port-Type}' \
+                                        AND AcctStopTime IS NULL"
+
+                        #
+                        #  Key constraints prevented us from inserting a new session,
+                        #  use the alternate query to update an existing session.
+                        #
+                        query = "\
+                                UPDATE ${....acct_table1} SET \
+                                        acctstarttime   = ${....event_timestamp}, \
+                                        acctupdatetime  = ${....event_timestamp}, \
+                                        connectinfo_start = '%{Connect-Info}' \
+                                WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'"
+
+                }
+
+                interim-update {
+                        #
+                        #  Update an existing session and calculate the interval
+                        #  between the last data we received for the session and this
+                        #  update. This can be used to find stale sessions.
+                        #
+                        query = "\
+                                UPDATE ${....acct_table1} \
+                                SET \
+                                        acctupdatetime  = (@acctupdatetime_old:=acctupdatetime), \
+                                        acctupdatetime  = ${....event_timestamp}, \
+                                        acctinterval    = ${....event_timestamp_epoch} - \
+                                                UNIX_TIMESTAMP(@acctupdatetime_old), \
+                                        framedipaddress = '%{Framed-IP-Address}', \
+                                        framedipv6address = '%{Framed-IPv6-Address}', \
+                                        framedipv6prefix = '%{Framed-IPv6-Prefix}', \
+                                        framedinterfaceid = '%{Framed-Interface-Id}', \
+                                        delegatedipv6prefix = '%{Delegated-IPv6-Prefix}', \
+                                        acctsessiontime = %{%{Acct-Session-Time}:-NULL}, \
+                                        acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' \
+                                                << 32 | '%{%{Acct-Input-Octets}:-0}', \
+                                        acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' \
+                                                << 32 | '%{%{Acct-Output-Octets}:-0}' \
+                                WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'"
+
+                        #
+                        #  The update condition matched no existing sessions. Use
+                        #  the values provided in the update to create a new session.
+                        #
+                        query = "\
+                                INSERT INTO ${....acct_table1} \
+                                        (${...column_list}) \
+                                VALUES \
+                                        ('%{Acct-Session-Id}', \
+                                        '%{Acct-Unique-Session-Id}', \
+                                        '%{SQL-User-Name}', \
+                                        '%{Realm}', \
+                                        '%{NAS-IP-Address}', \
+                                        '%{%{NAS-Port-ID}:-%{NAS-Port}}', \
+                                        '%{NAS-Port-Type}', \
+                                        FROM_UNIXTIME(${....event_timestamp_epoch} - %{%{Acct-Session-Time}:-0}), \
+                                        ${....event_timestamp}, \
+                                        NULL, \
+                                        %{%{Acct-Session-Time}:-NULL}, \
+                                        '%{Acct-Authentic}', \
+                                        '%{Connect-Info}', \
+                                        '', \
+                                        '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', \
+                                        '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', \
+                                        '%{Called-Station-Id}', \
+                                        '%{Calling-Station-Id}', \
+                                        '', \
+                                        '%{Service-Type}', \
+                                        '%{Framed-Protocol}', \
+                                        '%{Framed-IP-Address}', \
+                                        '%{Framed-IPv6-Address}', \
+                                        '%{Framed-IPv6-Prefix}', \
+                                        '%{Framed-Interface-Id}', \
+                                        '%{Delegated-IPv6-Prefix}' \
+                                        ${....class.packet_xlat})"
+
+                        #
+                        #  When using "sql_session_start", you should comment out
+                        #  the previous query, and enable this one.
+                        #
+                        #  Just change the previous query to "-query",
+                        #  and this one to "query".  The previous one
+                        #  will be ignored, and this one will be
+                        #  enabled.
+                        #
+                        -query = "\
+                                UPDATE ${....acct_table1} \
+                                SET \
+                                        AcctSessionId = '%{Acct-Session-Id}', \
+                                        AcctUniqueId = '%{Acct-Unique-Session-Id}', \
+                                        AcctAuthentic = '%{Acct-Authentic}', \
+                                        ConnectInfo_start = '%{Connect-Info}', \
+                                        ServiceType = '%{Service-Type}', \
+                                        FramedProtocol = '%{Framed-Protocol}', \
+                                        framedipaddress = '%{Framed-IP-Address}', \
+                                        framedipv6address = '%{Framed-IPv6-Address}', \
+                                        framedipv6prefix = '%{Framed-IPv6-Prefix}', \
+                                        framedinterfaceid = '%{Framed-Interface-Id}', \
+                                        delegatedipv6prefix = '%{Delegated-IPv6-Prefix}', \
+                                        AcctUpdateTime = ${....event_timestamp}, \
+                                        AcctSessionTime = %{%{Acct-Session-Time}:-NULL}, \
+                                        AcctInputOctets = '%{%{Acct-Input-Gigawords}:-0}' \
+                                                << 32 | '%{%{Acct-Input-Octets}:-0}', \
+                                        AcctOutputOctets = '%{%{Acct-Output-Gigawords}:-0}' \
+                                                << 32 | '%{%{Acct-Output-Octets}:-0}' \
+                                WHERE UserName = '%{SQL-User-Name}' \
+                                        AND NASIPAddress = '%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}}' \
+                                        AND NASPortId = '%{%{NAS-Port-ID}:-%{NAS-Port}}' \
+                                        AND NASPortType = '%{NAS-Port-Type}' \
+                                        AND AcctStopTime IS NULL"
+
+                }
+
+                stop {
+                        #
+                        #  Session has terminated, update the stop time and statistics.
+                        #
+                        query = "\
+                                UPDATE ${....acct_table2} SET \
+                                        acctstoptime    = ${....event_timestamp}, \
+                                        acctsessiontime = %{%{Acct-Session-Time}:-NULL}, \
+                                        acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' \
+                                                << 32 | '%{%{Acct-Input-Octets}:-0}', \
+                                        acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' \
+                                                << 32 | '%{%{Acct-Output-Octets}:-0}', \
+                                        acctterminatecause = '%{Acct-Terminate-Cause}', \
+                                        connectinfo_stop = '%{Connect-Info}' \
+                                WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'"
+
+                        #
+                        #  The update condition matched no existing sessions. Use
+                        #  the values provided in the update to create a new session.
+                        #
+                        query = "\
+                                INSERT INTO ${....acct_table2} \
+                                        (${...column_list}) \
+                                VALUES \
+                                        ('%{Acct-Session-Id}', \
+                                        '%{Acct-Unique-Session-Id}', \
+                                        '%{SQL-User-Name}', \
+                                        '%{Realm}', \
+                                        '%{NAS-IP-Address}', \
+                                        '%{%{NAS-Port-ID}:-%{NAS-Port}}', \
+                                        '%{NAS-Port-Type}', \
+                                        FROM_UNIXTIME(${....event_timestamp_epoch} - %{%{Acct-Session-Time}:-0}), \
+                                        ${....event_timestamp}, \
+                                        ${....event_timestamp}, \
+                                        %{%{Acct-Session-Time}:-NULL}, \
+                                        '%{Acct-Authentic}', \
+                                        '', \
+                                        '%{Connect-Info}', \
+                                        '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', \
+                                        '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', \
+                                        '%{Called-Station-Id}', \
+                                        '%{Calling-Station-Id}', \
+                                        '%{Acct-Terminate-Cause}', \
+                                        '%{Service-Type}', \
+                                        '%{Framed-Protocol}', \
+                                        '%{Framed-IP-Address}', \
+                                        '%{Framed-IPv6-Address}', \
+                                        '%{Framed-IPv6-Prefix}', \
+                                        '%{Framed-Interface-Id}', \
+                                        '%{Delegated-IPv6-Prefix}' \
+                                        ${....class.packet_xlat})"
+
+                        #
+                        #  When using "sql_session_start", you should comment out
+                        #  the previous query, and enable this one.
+                        #
+                        #  Just change the previous query to "-query",
+                        #  and this one to "query".  The previous one
+                        #  will be ignored, and this one will be
+                        #  enabled.
+                        #
+                        -query = "\
+                                UPDATE ${....acct_table1} \
+                                SET \
+                                        AcctSessionId = '%{Acct-Session-Id}', \
+                                        AcctUniqueId = '%{Acct-Unique-Session-Id}', \
+                                        AcctAuthentic = '%{Acct-Authentic}', \
+                                        ConnectInfo_start = '%{Connect-Info}', \
+                                        ServiceType = '%{Service-Type}', \
+                                        FramedProtocol = '%{Framed-Protocol}', \
+                                        framedipaddress = '%{Framed-IP-Address}', \
+                                        framedipv6address = '%{Framed-IPv6-Address}', \
+                                        framedipv6prefix = '%{Framed-IPv6-Prefix}', \
+                                        framedinterfaceid = '%{Framed-Interface-Id}', \
+                                        delegatedipv6prefix = '%{Delegated-IPv6-Prefix}', \
+                                        AcctStopTime = ${....event_timestamp}, \
+                                        AcctUpdateTime = ${....event_timestamp}, \
+                                        AcctSessionTime = %{Acct-Session-Time}, \
+                                        AcctInputOctets = '%{%{Acct-Input-Gigawords}:-0}' \
+                                                << 32 | '%{%{Acct-Input-Octets}:-0}', \
+                                        AcctOutputOctets = '%{%{Acct-Output-Gigawords}:-0}' \
+                                                << 32 | '%{%{Acct-Output-Octets}:-0}', \
+                                        AcctTerminateCause = '%{Acct-Terminate-Cause}', \
+                                        ConnectInfo_stop = '%{Connect-Info}' \
+                                WHERE UserName = '%{SQL-User-Name}' \
+                                AND NASIPAddress = '%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}}' \
+                                AND NASPortId = '%{%{NAS-Port-ID}:-%{NAS-Port}}' \
+                                AND NASPortType = '%{NAS-Port-Type}' \
+                                AND AcctStopTime IS NULL"
+
+                }
+
+                #
+                #  No Acct-Status-Type == ignore the packet
+                #
+                accounting {
+                        query = "SELECT true"
+                }
+        }
+}
+
+
+#######################################################################
+# Authentication Logging Queries
+#######################################################################
+# postauth_query        - Insert some info after authentication
+#######################################################################
+
+post-auth {
+        # Write SQL queries to a logfile. This is potentially useful for bulk inserts
+        # when used with the rlm_sql_null driver.
+#       logfile = ${logdir}/post-auth.sql
+
+        query = "\
+                INSERT INTO ${..postauth_table} \
+                        (username, reply, reason, authdate ${..class.column_name}) \
+                VALUES ( \
+                        '%{SQL-User-Name}', \
+                        '%{reply:Packet-Type}', \
+                        '%{reply:Reply-Message}', \
+                        '%S.%M' \
+                        ${..class.reply_xlat})"
+}

files/policy/filter

@@ -0,0 +1,211 @@
+#
+#       Example of forbidding all attempts to login via
+#       realms.
+#
+deny_realms {
+        if (&User-Name && (&User-Name =~ /@|\\/)) {
+                reject
+        }
+}
+
+#
+#       Filter the username
+#
+#  Force some sanity on User-Name. This helps to avoid issues
+#  issues where the back-end database is "forgiving" about
+#  what constitutes a user name.
+#
+filter_username {
+        if (&User-Name) {
+                #
+                #  reject mixed case e.g. "UseRNaMe"
+                #
+                #if (&User-Name != "%{tolower:%{User-Name}}") {
+                #       reject
+                #}
+
+                #
+                #  reject all whitespace
+                #  e.g. "user@ site.com", or "us er", or " user", or "user "
+                #
+                if (&User-Name =~ / /) {
+                        update request {
+                                &Module-Failure-Message += 'Rejected: User-Name contains whitespace'
+                        }
+                        reject
+                }
+
+                #
+                #  reject Multiple @'s
+                #  e.g. "user@site.com@site.com"
+                #
+                if (&User-Name =~ /@[^@]*@/ ) {
+                        update request {
+                                &Module-Failure-Message += 'Rejected: Multiple @ in User-Name'
+                        }
+                        reject
+                }
+
+                #
+                #  reject double dots
+                #  e.g. "user@site..com"
+                #
+                if (&User-Name =~ /\.\./ ) {
+                        update request {
+                                &Module-Failure-Message += 'Rejected: User-Name contains multiple ..s'
+                        }
+                        reject
+                }
+
+                #
+                #  must have at least 1 string-dot-string after @
+                #  e.g. "user@site.com"
+                #
+                #  if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
+                #          update request {
+                #                  &Module-Failure-Message += 'Rejected: Realm does not have at least one dot separator'
+                #          }
+                #          reject
+                #  }
+
+                #
+                #  Realm ends with a dot
+                #  e.g. "user@site.com."
+                #
+                if (&User-Name =~ /\.$/)  {
+                        update request {
+                                &Module-Failure-Message += 'Rejected: Realm ends with a dot'
+                        }
+                        reject
+                }
+
+                #
+                #  Realm begins with a dot
+                #  e.g. "user@.site.com"
+                #
+                if (&User-Name =~ /@\./)  {
+                        update request {
+                                &Module-Failure-Message += 'Rejected: Realm begins with a dot'
+                        }
+                        reject
+                }
+        }
+}
+
+#
+#       Filter the User-Password
+#
+#  Some equipment sends passwords with embedded zeros.
+#  This policy filters them out.
+#
+filter_password {
+        if (&User-Password && \
+           (&User-Password != "%{string:User-Password}")) {
+                update request {
+                        &Tmp-String-0 := "%{string:User-Password}"
+                        &User-Password := "%{string:Tmp-String-0}"
+                        &Tmp-String-0 !* ""
+                }
+         }
+}
+
+filter_inner_identity {
+        #
+        #  No names, reject.
+        #
+        if (!&outer.request:User-Name || !&User-Name) {
+                update request {
+                        Module-Failure-Message = "User-Name is required for tunneled authentication"
+                }
+                reject
+        }
+
+        #
+        #  Do detailed checks only if the inner and outer
+        #  NAIs are different.
+        #
+        #  If the NAIs are the same, it violates user privacy,
+        #  but is allowed.
+        #
+        if (&outer.request:User-Name != &User-Name) {
+                #
+                #  Get the outer realm.
+                #
+                if (&outer.request:User-Name =~ /@([^@]+)$/) {
+                        update request {
+                                Outer-Realm-Name = "%{1}"
+                        }
+
+                        #
+                        #  When we have an outer realm name, the user portion
+                        #  MUST either be empty, or begin with "anon".
+                        #
+                        #  We don't check for the full "anonymous", because
+                        #  some vendors don't follow the standards.
+                        #
+                        if (&outer.request:User-Name !~ /^(anon|@)/) {
+                                update request {
+                                        Module-Failure-Message = "User-Name is not anonymized"
+                                }
+                                reject
+                        }
+                }
+
+                #
+                #  There's no outer realm.  The outer NAI is different from the
+                #  inner NAI.  The User-Name MUST be anonymized.
+                #
+                #  Otherwise, you could log in as outer "bob", and inner "doug",
+                #  and we'd have no idea which one was correct.
+                #
+                elsif (&outer.request:User-Name !~ /^anon/) {
+                        update request {
+                                Module-Failure-Message = "User-Name is not anonymized"
+                        }
+                        reject
+                }
+
+                #
+                #  Get the inner realm.
+                #
+                if (&User-Name =~ /@([^@]+)$/) {
+                        update request {
+                                Inner-Realm-Name = "%{1}"
+                        }
+
+                        #
+                        #  Note that we do EQUALITY checks for realm names.
+                        #  There is no simple way to do case insensitive checks
+                        #  on internationalized domain names.  There is no reason
+                        #  to allow outer "anonymous@EXAMPLE.COM" and inner
+                        #  "user@example.com".  The user should enter the same
+                        #  realm for both identities.
+                        #
+                        #  If the inner realm isn't the same as the outer realm,
+                        #  the inner realm MUST be a subdomain of the outer realm.
+                        #
+                        if (&Outer-Realm-Name && \
+                            (&Inner-Realm-Name != &Outer-Realm-Name) && \
+                            (&Inner-Realm-Name !~ /\.%{Outer-Realm-Name}$/)) {
+                                update request {
+                                        Module-Failure-Message = "Inner realm '%{Inner-Realm-Name}' and outer realm '%{Outer-Realm-Name}' are not from the same domain."
+                                }
+                                reject
+                        }
+
+                        #
+                        #  It's OK to have an inner realm and no outer realm.
+                        #
+                        #  That won't work for roaming, but the local RADIUS server
+                        #  can still authenticate the user.
+                        #
+                }
+
+                #
+                #  It's OK to have an outer realm and no inner realm.
+                #
+                #  It will work for roaming, and the local RADIUS server
+                #  can authenticate the user without the realm.
+                #
+        }
+}

files/policy/vlan

@@ -0,0 +1,15 @@
+vlan_test {
+
+    if (&User-Name =~ /.+@(.+)/) {
+
+        update control {
+            Tmp-String-0 := "%{1}"
+        }
+
+        update reply {
+            Tunnel-Type := VLAN
+            Tunnel-Medium-Type := IEEE-802
+            Tunnel-Private-Group-Id := "%{sql:SELECT vlan_id FROM tenant_subnets WHERE tenant_id='%{control:Tmp-String-0}'}"
+        }
+    }
+}

files/schema/mysql.sql

@@ -163,3 +163,22 @@ CREATE TABLE IF NOT EXISTS nas (
   PRIMARY KEY (id),
   KEY nasname (nasname)
 ) ENGINE = INNODB;
+
+#
+# Table structure for table 'radippool'
+#
+CREATE TABLE IF NOT EXISTS radippool (
+  id                    int(11) unsigned NOT NULL auto_increment,
+  pool_name             varchar(30) NOT NULL,
+  framedipaddress       varchar(15) NOT NULL default '',
+  nasipaddress          varchar(15) NOT NULL default '',
+  calledstationid       VARCHAR(30) NOT NULL default '',
+  callingstationid      VARCHAR(30) NOT NULL default '',
+  expiry_time           DATETIME NOT NULL default NOW(),
+  username              varchar(64) NOT NULL default '',
+  pool_key              varchar(64) NOT NULL default '',
+  PRIMARY KEY (id),
+  KEY radippool_poolname_expire (pool_name, expiry_time),
+  UNIQUE KEY framedipaddress_unique (framedipaddress),
+  KEY radippool_nasip_poolkey_ipaddress (nasipaddress, pool_key, framedipaddress)
+) ENGINE=InnoDB;

files/sites-available/default

@@ -417,8 +417,35 @@ authorize {
 	#  Look in an SQL database.  The schema of the database is meant to mirror the "users" file.
 	#
 	#  See "Authorization Queries" in mods-available/sql
-	-sql
+	sql
+	### Node pinning + client type (optimized)
+	update control {
+		Tmp-String-0 := "%{sql:SELECT node_ip FROM node_assignments WHERE username='%{User-Name}'}"
+		Tmp-String-1 := "%{sql:SELECT client_type FROM node_assignments WHERE username='%{User-Name}'}"
+	}
 
+	# No assignment → reject
+	if (&control:Tmp-String-0 == "") {
+		update reply {
+        	Reply-Message := "No node assignment - access denied"
+    	}
+		reject
+	}
+
+	# Wrong node → reject (string compare to avoid type mismatch)
+	if ("%{control:Tmp-String-0}" != "%{NAS-IP-Address}") {
+		update reply {
+			Reply-Message := "Wrong node %{NAS-IP-Address} expected %{control:Tmp-String-0}"
+		}
+		reject
+	}
+
+	# Engineers → dynamic pool
+	if (&control:Tmp-String-1 == "engineer") {
+		update control {
+			Pool-Name := "engineers-%{sql:SELECT SUBSTRING_INDEX('%{User-Name}','@',-1)}"
+		}
+	}
 	#  If you are using /etc/smbpasswd, and are also doing mschap authentication, the un-comment this line, and configure the 'smbpasswd' module.
 #	smbpasswd
 
@@ -619,8 +646,17 @@ accounting {
 
 	#  Return an address to the IP Pool when we see a stop record.
 	#  Ensure that &control:Pool-Name is set to determine which pool of IPs are used.
-#	sqlippool
+	# sqlippool
 
+    ### rebuild Pool-Name 
+    update control {
+        Pool-Name := "engineers-%{sql:SELECT SUBSTRING_INDEX('%{User-Name}','@',-1)}"
+    }
+
+    ### apply only for engineers
+    if (&control:Pool-Name =~ /^engineers-/) {
+        sqlippool
+    }
 	#  Log traffic to an SQL database.
 	#  See "Accounting queries" in mods-available/sql
 	sql
@@ -752,8 +788,30 @@ post-auth {
 	#
 	#  Ensure that &control:Pool-Name is set to determine which
 	#  pool of IPs are used.
-#	sqlippool
+	# sqlippool
 
+	# Engineers → dynamic IP
+    #
+	if (&control:Pool-Name =~ /^engineers-/) {
+
+		update reply {
+			Session-Timeout := 3600
+		}
+
+		sqlippool
+	}
+	#
+	# HARD CHECK: must have IP
+	#
+	if (!&reply:Framed-IP-Address) {
+		update reply {
+			Reply-Message := "No IP assigned - access denied"
+		}
+		reject
+	}
+
+	# Query VLAN ID from your DB
+	vlan_test
 
 	#  Create the CUI value and add the attribute to Access-Accept.
 	#  Uncomment the line below if *returning* the CUI.

templates/ConfigMap/envvars.yaml

@@ -38,6 +38,7 @@ data:
   FREERADIUS_MODS_SQL_TABLE_GROUPREPLY: {{ .Values.modsEnabled.sql.table.groupreply }}
   FREERADIUS_MODS_SQL_TABLE_POSTAUTH: {{ .Values.modsEnabled.sql.table.postauth }}
   FREERADIUS_MODS_SQL_TABLE_USERGROUP: {{ .Values.modsEnabled.sql.table.usergroup }}
+  FREERADIUS_MODS_SQL_TABLE_RADIPPOOL: {{ .Values.modsEnabled.sql.table.sqlippool }}
   FREERADIUS_MODS_SQL_TLS_ENABLE: {{ ternary "yes" "no" .Values.modsEnabled.sql.tls.enabled | quote }}
 
   FREERADIUS_MODS_SQL_READ_CLIENTS: {{ ternary "yes" "no" .Values.modsEnabled.sql.readClients | quote }}

templates/ConfigMap/filter.yaml

@@ -0,0 +1,19 @@
+{{- /*
+Copyright (c) 2025 Firmansyah Nainggolan. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ printf "%s-filter" (include "st-common.names.fullname" .) }}
+  namespace: {{ include "st-common.names.namespace" . | quote }}
+  labels: {{- include "st-common.labels.standard" . | nindent 4 }}
+    {{- if .Values.commonLabels }}
+      {{- include "st-common.tplvalues.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "st-common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }}
+  {{- end }}
+data:
+{{ (.Files.Glob "files/policy/filter").AsConfig | indent 2 }}

templates/ConfigMap/mods-config.yaml

@@ -0,0 +1,19 @@
+{{- /*
+Copyright (c) 2025 Firmansyah Nainggolan. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ printf "%s-mods-config" (include "st-common.names.fullname" .) }}
+  namespace: {{ include "st-common.names.namespace" . | quote }}
+  labels: {{- include "st-common.labels.standard" . | nindent 4 }}
+    {{- if .Values.commonLabels }}
+      {{- include "st-common.tplvalues.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "st-common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }}
+  {{- end }}
+data:
+{{ (.Files.Glob "files/mods-config/queries.conf").AsConfig | indent 2 }}

templates/ConfigMap/mods-enabled.yaml

@@ -18,6 +18,7 @@ metadata:
 data:
 {{ (.Files.Glob "files/mods-available/eap").AsConfig | indent 2 }}
 {{ (.Files.Glob "files/mods-available/dynamic_clients").AsConfig | indent 2 }}
+{{ (.Files.Glob "files/mods-available/sqlippool").AsConfig | indent 2 }}
 {{- if .Values.modsEnabled.sql.enabled }}
 {{ (.Files.Glob "files/mods-available/sql").AsConfig | indent 2 }}
 {{- end }}

templates/ConfigMap/radius-conf.yaml

@@ -0,0 +1,19 @@
+{{- /*
+Copyright (c) 2025 Firmansyah Nainggolan. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ printf "%s-radius-conf" (include "st-common.names.fullname" .) }}
+  namespace: {{ include "st-common.names.namespace" . | quote }}
+  labels: {{- include "st-common.labels.standard" . | nindent 4 }}
+    {{- if .Values.commonLabels }}
+      {{- include "st-common.tplvalues.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "st-common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }}
+  {{- end }}
+data:
+{{ (.Files.Glob "files/radius.conf").AsConfig | indent 2 }}

templates/ConfigMap/vlan.yaml

@@ -0,0 +1,19 @@
+{{- /*
+Copyright (c) 2025 Firmansyah Nainggolan. All Rights Reserved.
+SPDX-License-Identifier: APACHE-2.0
+*/}}
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ printf "%s-vlan" (include "st-common.names.fullname" .) }}
+  namespace: {{ include "st-common.names.namespace" . | quote }}
+  labels: {{- include "st-common.labels.standard" . | nindent 4 }}
+    {{- if .Values.commonLabels }}
+      {{- include "st-common.tplvalues.render" (dict "value" .Values.commonLabels "context" $) | nindent 4 }}
+    {{- end }}
+  {{- if .Values.commonAnnotations }}
+  annotations: {{- include "st-common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }}
+  {{- end }}
+data:
+{{ (.Files.Glob "files/policy/vlan").AsConfig | indent 2 }}

templates/Deployment.yaml

@@ -280,6 +280,21 @@ spec:
             - name: freeradius-mods
               mountPath: /etc/freeradius/mods-enabled/dynamic_clients
               subPath: dynamic_clients
+            - name: freeradius-mods
+              mountPath: /etc/freeradius/mods-enabled/sqlippool
+              subPath: sqlippool              
+            - name: freeradius-mods-config
+              mountPath: /etc/freeradius/mods-config/sql/main/mysql/queries.conf
+              subPath: queries.conf
+            - name: freeradius-radius-conf
+              mountPath: /etc/freeradius/radius.conf
+              subPath: radius.conf
+            - name: freeradius-filter
+              mountPath: /etc/freeradius/policy.d/filter
+              subPath: filter 
+            - name: freeradius-vlan
+              mountPath: /etc/freeradius/policy.d/vlan
+              subPath: vlan
             - name: freeradius-sites
               mountPath: /etc/freeradius/sites-enabled/default
               subPath: default
@@ -325,6 +340,18 @@ spec:
         - name: freeradius-sites
           configMap:
             name: {{ printf "%s-sites" (include "st-common.names.fullname" .) }}
+        - name: freeradius-mods-config
+          configMap:
+            name: {{ printf "%s-mods-config" (include "st-common.names.fullname" .) }}
+        - name: freeradius-radius-conf
+          configMap:
+            name: {{ printf "%s-radius-conf" (include "st-common.names.fullname" .) }} 
+        - name: freeradius-filter
+          configMap:
+            name: {{ printf "%s-filter" (include "st-common.names.fullname" .) }}  
+        - name: freeradius-vlan
+          configMap:
+            name: {{ printf "%s-vlan" (include "st-common.names.fullname" .) }}                
         - name: temp
           emptyDir: {}
         - name: shared-certs

values.yaml

@@ -825,6 +825,7 @@ modsEnabled:
       groupreply: radgroupreply
       postauth: radpostauth
       usergroup: radusergroup
+      sqlippool: radippool
     ## @param modsEnabled.sql.groupAttribute  The group attribute specific to this instance of rlm_sql
     ##
     groupAttribute: SQL-Group