From fd133bf9f3c71037c149bf210b975dad54e5c6d2 Mon Sep 17 00:00:00 2001
From: Tygozwolle <tygo.vanolsttygo@gmail.com>
Date: Fri, 24 Jul 2026 12:58:07 +0200
Subject: [PATCH] feat: add FreeRADIUS configuration and containerization
 support with PostgreSQL integration

---
 radiuscontroller/Dockerfile                   |  8 +-
 radiuscontroller/raddb/clients.conf           | 11 +++
 radiuscontroller/raddb/mods-enabled/sql       | 30 +++++++
 radiuscontroller/raddb/sites-enabled/default  | 78 +++++++++++++++++++
 .../raddb/sites-enabled/inner-tunnel          | 36 +++++++++
 5 files changed, 159 insertions(+), 4 deletions(-)
 create mode 100644 radiuscontroller/raddb/clients.conf
 create mode 100644 radiuscontroller/raddb/mods-enabled/sql
 create mode 100644 radiuscontroller/raddb/sites-enabled/default
 create mode 100644 radiuscontroller/raddb/sites-enabled/inner-tunnel

diff --git a/radiuscontroller/Dockerfile b/radiuscontroller/Dockerfile
index 56579d1..b684d1b 100644
--- a/radiuscontroller/Dockerfile
+++ b/radiuscontroller/Dockerfile
@@ -34,10 +34,10 @@ FROM base AS final
 WORKDIR /app
 
 # Copy pre-configured FreeRADIUS PostgreSQL rules & EAP authentication config
-COPY raddb/clients.conf /etc/freeradius/3.0/clients.conf
-COPY raddb/mods-enabled/sql /etc/freeradius/3.0/mods-enabled/sql
-COPY raddb/sites-enabled/default /etc/freeradius/3.0/sites-enabled/default
-COPY raddb/sites-enabled/inner-tunnel /etc/freeradius/3.0/sites-enabled/inner-tunnel
+COPY radiuscontroller/raddb/clients.conf /etc/freeradius/3.0/clients.conf
+COPY radiuscontroller/raddb/mods-enabled/sql /etc/freeradius/3.0/mods-enabled/sql
+COPY radiuscontroller/raddb/sites-enabled/default /etc/freeradius/3.0/sites-enabled/default
+COPY radiuscontroller/raddb/sites-enabled/inner-tunnel /etc/freeradius/3.0/sites-enabled/inner-tunnel
 
 # Copy published application and entrypoint script
 COPY --from=publish /app/publish .
diff --git a/radiuscontroller/raddb/clients.conf b/radiuscontroller/raddb/clients.conf
new file mode 100644
index 0000000..f1bd4f7
--- /dev/null
+++ b/radiuscontroller/raddb/clients.conf
@@ -0,0 +1,11 @@
+client localhost {
+	ipaddr = 127.0.0.1
+	secret = testing123
+	shortname = localhost
+}
+
+client local_net {
+	ipaddr = 0.0.0.0/0
+	secret = radpass
+	shortname = all_clients
+}
diff --git a/radiuscontroller/raddb/mods-enabled/sql b/radiuscontroller/raddb/mods-enabled/sql
new file mode 100644
index 0000000..04bc130
--- /dev/null
+++ b/radiuscontroller/raddb/mods-enabled/sql
@@ -0,0 +1,30 @@
+sql {
+	driver = "rlm_sql_postgresql"
+	dialect = "postgresql"
+
+	server = "postgres"
+	port = 5432
+	login = "radius"
+	password = "radpass"
+	radius_db = "radius"
+
+	read_clients = yes
+	client_table = "nas"
+
+	group_attribute = "User-Group"
+
+	pool {
+		start = 2
+		min = 1
+		max = 10
+		spare = 3
+		uses = 0
+		retry_delay = 30
+		lifetime = 0
+		idle_timeout = 60
+	}
+
+	read_groups = yes
+
+	$INCLUDE ${modconfdir}/${.:name}/main/${dialect}/queries.conf
+}
diff --git a/radiuscontroller/raddb/sites-enabled/default b/radiuscontroller/raddb/sites-enabled/default
new file mode 100644
index 0000000..a7ae66d
--- /dev/null
+++ b/radiuscontroller/raddb/sites-enabled/default
@@ -0,0 +1,78 @@
+server default {
+listen {
+	type = auth
+	ipaddr = *
+	port = 1812
+	limit {
+	      max_connections = 16
+	      lifetime = 0
+	      idle_timeout = 30
+	}
+}
+
+listen {
+	type = acct
+	ipaddr = *
+	port = 1813
+	limit {
+	      max_connections = 16
+	      lifetime = 0
+	      idle_timeout = 30
+	}
+}
+
+authorize {
+	filter_username
+	preprocess
+	chap
+	mschap
+	digest
+	pap
+	eap {
+		ok = return
+	}
+	sql
+	expiration
+	logintime
+}
+
+authenticate {
+	Auth-Type PAP {
+		pap
+	}
+	Auth-Type CHAP {
+		chap
+	}
+	Auth-Type MS-CHAP {
+		mschap
+	}
+	mschap
+	eap
+}
+
+pre-proxy {
+}
+
+post-proxy {
+	eap
+}
+
+accounting {
+	detail
+	sql
+	exec
+}
+
+session {
+	sql
+}
+
+post-auth {
+	sql
+	exec
+	Post-Auth-Type REJECT {
+		sql
+		attr_filter.access_reject
+	}
+}
+}
diff --git a/radiuscontroller/raddb/sites-enabled/inner-tunnel b/radiuscontroller/raddb/sites-enabled/inner-tunnel
new file mode 100644
index 0000000..02a8e14
--- /dev/null
+++ b/radiuscontroller/raddb/sites-enabled/inner-tunnel
@@ -0,0 +1,36 @@
+server inner-tunnel {
+authorize {
+	filter_username
+	chap
+	mschap
+	pap
+	eap {
+		ok = return
+	}
+	sql
+	expiration
+	logintime
+}
+
+authenticate {
+	Auth-Type PAP {
+		pap
+	}
+	Auth-Type CHAP {
+		chap
+	}
+	Auth-Type MS-CHAP {
+		mschap
+	}
+	mschap
+	eap
+}
+
+post-auth {
+	sql
+	Post-Auth-Type REJECT {
+		sql
+		attr_filter.access_reject
+	}
+}
+}