# -*- text -*-
##
##  SimpliFi — virtual server for hotspot / PPPoE authentication (FreeRADIUS 3.x)
##
##  Replaces the stock "default" + "inner-tunnel" servers on a dedicated box:
##      rm /etc/freeradius/3.0/sites-enabled/default /etc/freeradius/3.0/sites-enabled/inner-tunnel
##      cp deploy/freeradius/sites-available/simplifi /etc/freeradius/3.0/sites-available/simplifi
##      ln -sf ../sites-available/simplifi /etc/freeradius/3.0/sites-enabled/simplifi
##
##  Hotspots log customers in with PAP or CHAP (MikroTik, CoovaChilli, Grandstream,
##  Cambium, Ruijie…); PPPoE servers may use MS-CHAPv2. Passwords are stored as
##  Cleartext-Password in radcheck, which all three methods need.
##

server simplifi {

	listen {
		type = auth
		ipaddr = *
		port = 1812
		limit {
			max_connections = 16
			lifetime = 0
			idle_timeout = 30
		}
	}

	listen {
		type = acct
		ipaddr = *
		port = 1813
	}

	#  Uncomment to accept CoA / Disconnect-Request relays later (not used by SimpliFi yet).
	# listen {
	#	type = coa
	#	ipaddr = *
	#	port = 3799
	# }

	authorize {
		#  Reject malformed user names early.
		filter_username

		preprocess

		#  CHAP (MikroTik hotspot, CoovaChilli) and MS-CHAP (PPPoE).
		chap
		mschap

		#  Users, groups and replies from the SimpliFi database.
		#  "-sql": keep answering (reject) if the database is briefly unreachable.
		-sql

		#  Expiration (radcheck) and total-time counters (Max-All-Session).
		expiration
		logintime
		noresetcounter

		pap
	}

	authenticate {
		Auth-Type PAP {
			pap
		}

		Auth-Type CHAP {
			chap
		}

		Auth-Type MS-CHAP {
			mschap
		}
	}

	preacct {
		preprocess
		acct_counters64
		update request {
			&FreeRADIUS-Acct-Session-Start-Time = "%{expr: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0}}"
		}
		acct_unique
	}

	accounting {
		#  Usage, "who is online" and Simultaneous-Use all come from radacct.
		-sql

		attr_filter.accounting_response
	}

	#  Simultaneous-Use checks look at open radacct rows.
	session {
		sql
	}

	post-auth {
		#  Log the result to radpostauth (optional; comment out to save writes).
		-sql

		Post-Auth-Type REJECT {
			-sql
			attr_filter.access_reject
		}
	}
}
