sam/internet_use_control
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Phase 3: MQTT transport — retained config, status/telemetry, LWT presence, TLS/ACL design

Browse Source 
- internal/mqtt: publish each device's desired state retained on
  restrict/<device>/config; subscribe to restrict/+/status and
  restrict/+/telemetry and write reports to SQLite; publish on every state
  change, republish on connect and every 15 minutes from SQLite, so the broker
  is repaired from the source of truth.
- store: presence (devices.online and last_seen, audited only on transitions),
  telemetry upsert per (device, day, app, domain) via migration 002, allow and
  block lists read into the config payload, device lookup by topic.
- config: MQTT settings. TLS plus per-device credentials are required; the
  pre-TLS shared broker needs an explicit CONTROL_MQTT_INSECURE escape hatch.
- web: republish config after lock, unlock, expiry, create and edit; broker card
  on the status partial.
- deploy/mosquitto: TLS listener, topic ACL, credential provisioning and a
  verifier that proves the policy on a throwaway broker. Not applied to the
  shared Mosquitto on .13 — that change needs Sam's approval.
- cmd/control: mqtt-clients prints the MQTT identity of every device.
- paho.mqtt.golang v1.5.1, which pulls golang.org/x/net and with it the
  golang.org/x/crypto bump to v0.42.0.

Verified on .13: retained config delivered to a fresh subscriber; a client
killed without DISCONNECT drove the broker's retained will and the service
flipped the device offline; telemetry landed in SQLite; make mqtt-verify passed
13/13; the service connected over TLS with credentials and a CA.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
Sam Rolfe
2026-10-13 14:37:43 +11:00
parent 7c88d3f52b
commit 14b304e0b0
31 changed files with 2624 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files

139
cmd/control/main.go
View File

@@ -1,8 +1,8 @@
// Command control is the Internet Use Control Control Service.
//
// It is the single source of truth for the family's device rules
// (SYSTEM_MAP.md). Phase 2: device registry, desired state in SQLite, manual
// lock/unlock from the dashboard, and the audit log.
// (SYSTEM_MAP.md). Phase 3: publishes each device's desired state to the broker,
// retained, and consumes device presence and telemetry reports from it.
package main
import (
@@ -22,6 +22,7 @@ import (
"gitea.lab.audasmedia.com.au/sam/internet_use_control/internal/auth"
"gitea.lab.audasmedia.com.au/sam/internet_use_control/internal/config"
"gitea.lab.audasmedia.com.au/sam/internet_use_control/internal/mqtt"
"gitea.lab.audasmedia.com.au/sam/internet_use_control/internal/store"
"gitea.lab.audasmedia.com.au/sam/internet_use_control/internal/web"
)
@@ -29,12 +30,20 @@ import (
// version is injected with -ldflags at build time.
var version = "dev"
// republishInterval is how often the retained config is refreshed from SQLite.
// The broker is transport, not storage: if its retained store is ever lost, the
// service repairs it from the database without a restart.
const republishInterval = 15 * time.Minute
func main() {
if len(os.Args) > 1 {
switch os.Args[1] {
case "hash-password":
hashPassword(os.Args[2:])
return
case "mqtt-clients":
mqttClients(os.Args[2:])
return
case "version":
fmt.Println(version)
return
@@ -77,7 +86,46 @@ func run() error {
log.Warn("admin password is plaintext; set CONTROL_ADMIN_PASSWORD_HASH to use bcrypt")
}
srv, err := web.New(cfg, st, am, log)
ctx, cancel := context.WithCancel(context.Background())
defer cancel()
// The broker link (Phase 3). It is optional on purpose: the dashboard must
// keep working while the broker is down, and the device keeps its last state
// (AGENTS.md §10 rule 2).
var (
link *mqtt.Link
pub web.Publisher
)
if cfg.MQTTEnabled {
link, err = mqtt.New(mqtt.Options{
Broker: cfg.MQTTBroker,
ClientID: cfg.MQTTClientID,
Username: cfg.MQTTUsername,
Password: cfg.MQTTPassword,
CAFile: cfg.MQTTCAFile,
Actor: "device",
Log: log,
Devices: st,
Source: st,
Reports: st,
OnConnected: func() { republish(ctx, log, link) },
})
if err != nil {
return err
}
pub = link
link.Start(ctx)
defer link.Stop()
go republishLoop(ctx, log, link)
if !cfg.MQTTTLS() {
log.Warn("mqtt is running without TLS; the shared broker has no TLS listener yet (AGENTS.md §10 rule 6)",
"broker", cfg.MQTTBroker)
}
} else {
log.Warn("mqtt is disabled; device config stays in SQLite and is not published")
}
srv, err := web.New(cfg, st, am, log, pub)
if err != nil {
return err
}
@@ -109,16 +157,95 @@ func run() error {
case sig := <-stop:
log.Info("shutting down", "signal", sig.String())
}
cancel()
ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
defer cancel()
if err := httpServer.Shutdown(ctx); err != nil {
ctxShutdown, cancelShutdown := context.WithTimeout(context.Background(), 10*time.Second)
defer cancelShutdown()
if err := httpServer.Shutdown(ctxShutdown); err != nil {
return fmt.Errorf("shutdown: %w", err)
}
log.Info("stopped", "uptime", time.Since(started).Round(time.Second).String())
return nil
}
// republish pushes every device's retained config. It runs once per connect and
// then periodically, so the broker's view of the desired state is rebuilt from
// SQLite, the source of truth.
func republish(ctx context.Context, log *slog.Logger, link *mqtt.Link) {
if link == nil {
return
}
ctx, cancel := context.WithTimeout(ctx, 30*time.Second)
defer cancel()
n, err := link.PublishAll(ctx)
if err != nil {
log.Error("mqtt publish all", "published", n, "err", err)
return
}
log.Info("mqtt retained config refreshed", "devices", n)
}
func republishLoop(ctx context.Context, log *slog.Logger, link *mqtt.Link) {
ticker := time.NewTicker(republishInterval)
defer ticker.Stop()
for {
select {
case <-ctx.Done():
return
case <-ticker.C:
if !link.Connected() {
continue
}
republish(ctx, log, link)
}
}
}
// mqttClients prints the MQTT identity of every registered device, one device
// per line, as tab-separated fields:
//
// <token>\t<config topic>\t<platform>\t<child>\t<name>
//
// provision-clients.sh uses it to create one broker account per device. Real
// tabs, not padded columns: names contain spaces, so a space-separated field
// would not be safe to parse. The token is the MQTT username and the middle
// level of the device's topics (deploy/mosquitto/README.md). It is not a secret
// and this never prints one.
func mqttClients(args []string) {
dbPath := env("CONTROL_DB_PATH", "/data/control.db")
for i := 0; i < len(args); i++ {
if (args[i] == "--db" || args[i] == "-db") && i+1 < len(args) {
dbPath = args[i+1]
i++
}
}
st, err := store.Open(dbPath)
if err != nil {
fmt.Fprintln(os.Stderr, "control:", err)
os.Exit(1)
}
defer st.Close()
devices, err := st.ListDevices(context.Background())
if err != nil {
fmt.Fprintln(os.Stderr, "control:", err)
os.Exit(1)
}
for _, dev := range devices {
token := strings.TrimSuffix(strings.TrimPrefix(dev.Topic, mqtt.TopicPrefix+"/"), mqtt.SuffixConfig)
fmt.Printf("%s\t%s\t%s\t%s\t%s\n", token, dev.Topic, dev.Platform, dev.Child, dev.Name)
}
}
func env(key, fallback string) string {
if v := strings.TrimSpace(os.Getenv(key)); v != "" {
return v
}
return fallback
}
// hashPassword prints a bcrypt hash for the password given as an argument or
// read from stdin. It never prints the password itself.
func hashPassword(args []string) {