# Per-device MQTT security for the Internet Use Control Control Service.
#
# APPLY WITH deploy/mosquitto/README.md. This fragment is included by the shared
# Mosquitto on `.13`; it does not replace its configuration (AGENTS.md §11
# Phase 3, §10 rule 6).
#
# Two listeners, two planes:
#   * 1883 stays exactly as it is — plain, anonymous. n8n and the rest of the
#     lab keep working (N8N_DEFAULT_MQTT_BROKER_URL=mqtt://192.168.20.13:1883).
#   * 8883 is new and is the ONLY listener the kids' devices use: TLS, a
#     required account, and a topic ACL.
#
# `per_listener_settings true` belongs in the main mosquitto.conf, before the
# first listener, not here. It is what keeps the 1883 plane anonymous while the
# 8883 plane requires credentials.

listener 8883 0.0.0.0

# No anonymous devices. A device reads only its own config and writes only its
# own status and telemetry (webrestrict.acl).
allow_anonymous false
password_file /mosquitto/config/conf.d/webrestrict.passwd
acl_file /mosquitto/config/conf.d/webrestrict.acl

# TLS. The lab CA is generated by generate-tls.sh; every device and the Control
# Service trust the same CA, so a rogue broker on the LAN cannot hand a device
# its rules.
tls_version tlsv1.2
cafile /mosquitto/config/tls/ca.crt
certfile /mosquitto/config/tls/server.crt
keyfile /mosquitto/config/tls/server.key

# A device proves who it is with a password; it does not need its own client
# certificate.
require_certificate false