# -*- text -*-
##
##  SimpliFi — rlm_sql for FreeRADIUS 3.0.x / 3.2.x (MySQL / MariaDB)
##
##  FreeRADIUS reads users, replies and RADIUS clients (NAS) straight from the
##  SimpliFi database and writes accounting to radacct. The tables are created
##  by the SimpliFi migrations (radcheck, radreply, radgroupcheck, radgroupreply,
##  radusergroup, radacct, radpostauth, nas); the queries are tenant-agnostic
##  because RADIUS usernames and NAS addresses are globally unique.
##
##  Install:  cp deploy/freeradius/mods-available/sql /etc/freeradius/3.0/mods-available/sql
##            ln -sf ../mods-available/sql /etc/freeradius/3.0/mods-enabled/sql
##  Secrets:  put the DB credentials in /etc/freeradius/3.0/simplifi.env (see docs/RADIUS.md);
##            they are read with $ENV{} so this file holds no password.
##
##  Reference: https://wiki.freeradius.org/modules/Rlm_sql and the stock
##  raddb/mods-available/sql shipped with your FreeRADIUS version.
##

sql {
	#  MySQL/MariaDB through libmysqlclient (package freeradius-mysql).
	dialect = "mysql"
	driver = "rlm_sql_${dialect}"

	mysql {
		#  cPanel "Remote MySQL" over the internet: use TLS when the server offers it.
		#  Uncomment and point at the CA bundle if your host requires TLS.
		# tls {
		#	ca_file = "/etc/ssl/certs/ca-certificates.crt"
		#	tls_required = yes
		# }

		#  Log MySQL warnings (truncated values etc.).
		warnings = auto
	}

	#  Connection — values come from the environment of the freeradius service.
	server = $ENV{SIMPLIFI_DB_HOST}
	port = $ENV{SIMPLIFI_DB_PORT}
	login = $ENV{SIMPLIFI_DB_USER}
	password = $ENV{SIMPLIFI_DB_PASSWORD}
	radius_db = $ENV{SIMPLIFI_DB_NAME}

	#  Standard FreeRADIUS table names (SimpliFi uses the defaults).
	acct_table1 = "radacct"
	acct_table2 = "radacct"
	postauth_table = "radpostauth"
	authcheck_table = "radcheck"
	groupcheck_table = "radgroupcheck"
	authreply_table = "radreply"
	groupreply_table = "radgroupreply"
	usergroup_table = "radusergroup"

	#  Close accounting sessions left open when a NAS reboots (Accounting-On/Off).
	delete_stale_sessions = yes

	#  Users with a radusergroup row get the group's check/reply attributes too.
	read_groups = yes

	#  Load RADIUS clients (routers / APs) from the "nas" table that SimpliFi maintains
	#  when a device is saved in RADIUS mode. Clients are read at start-up only, so
	#  restart FreeRADIUS when the table changes (deploy/freeradius/simplifi-nas-reload.sh
	#  does this from cron) or use the dynamic-clients virtual server instead.
	read_clients = yes
	client_table = "nas"

	#  Connection pool. A small VPS needs few connections; cPanel MySQL usually
	#  limits each user to ~25 connections.
	pool {
		start = 2
		min = 2
		max = 10
		spare = 3
		uses = 0
		retry_delay = 30
		lifetime = 0
		idle_timeout = 60
	}

	group_attribute = "SQL-Group"

	#  Stock MySQL queries shipped with FreeRADIUS. They match the SimpliFi schema
	#  (including the IPv6 / class accounting columns added by migration
	#  2026_10_20_020000_add_freeradius_v3_columns_to_radacct_table).
	$INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf
}
