Sam Rolfe
14b304e0b0
- internal/mqtt: publish each device's desired state retained on restrict/<device>/config; subscribe to restrict/+/status and restrict/+/telemetry and write reports to SQLite; publish on every state change, republish on connect and every 15 minutes from SQLite, so the broker is repaired from the source of truth. - store: presence (devices.online and last_seen, audited only on transitions), telemetry upsert per (device, day, app, domain) via migration 002, allow and block lists read into the config payload, device lookup by topic. - config: MQTT settings. TLS plus per-device credentials are required; the pre-TLS shared broker needs an explicit CONTROL_MQTT_INSECURE escape hatch. - web: republish config after lock, unlock, expiry, create and edit; broker card on the status partial. - deploy/mosquitto: TLS listener, topic ACL, credential provisioning and a verifier that proves the policy on a throwaway broker. Not applied to the shared Mosquitto on .13 — that change needs Sam's approval. - cmd/control: mqtt-clients prints the MQTT identity of every device. - paho.mqtt.golang v1.5.1, which pulls golang.org/x/net and with it the golang.org/x/crypto bump to v0.42.0. Verified on .13: retained config delivered to a fresh subscriber; a client killed without DISCONNECT drove the broker's retained will and the service flipped the device offline; telemetry landed in SQLite; make mqtt-verify passed 13/13; the service connected over TLS with credentials and a CA. Co-Authored-By: Paperclip <noreply@paperclip.ing>
67 lines
2.7 KiB
Plaintext
67 lines
2.7 KiB
Plaintext
# Control Service configuration — template.
|
|
#
|
|
# Copy to control-service.env and fill in real values. The real file is
|
|
# gitignored and must never be committed. docker compose loads it with env_file.
|
|
#
|
|
# Secrets in this lab also live in ~/.config/environment.d/10-secrets.conf; the
|
|
# same variable names can be exported there instead. The service reads only the
|
|
# process environment, so either source works.
|
|
|
|
# Listen address inside the container.
|
|
CONTROL_ADDR=:8791
|
|
|
|
# SQLite database on the persistent volume.
|
|
CONTROL_DB_PATH=/data/control.db
|
|
|
|
CONTROL_APP_ENV=production
|
|
CONTROL_LOG_LEVEL=info
|
|
|
|
# Signs the session cookie. Set to a long random string (>= 16 chars).
|
|
# Generate: openssl rand -hex 32
|
|
CONTROL_SESSION_SECRET=change-me-to-a-long-random-string
|
|
|
|
# Session lifetime (Go duration).
|
|
CONTROL_SESSION_TTL=12h
|
|
|
|
# Secure cookie flag. Keep true behind Caddy/HTTPS. Set false only for
|
|
# plain-HTTP local testing.
|
|
CONTROL_COOKIE_SECURE=true
|
|
|
|
# The single dashboard login (Sam).
|
|
CONTROL_ADMIN_USERNAME=sam
|
|
|
|
# Option A (simple): plaintext password. Constant-time compared at login.
|
|
CONTROL_ADMIN_PASSWORD=change-me
|
|
|
|
# Option B (preferred): a bcrypt hash; leave CONTROL_ADMIN_PASSWORD empty.
|
|
# Generate: docker run --rm --entrypoint /app/control webrestrict/control:0.3.0-phase3 hash-password 'your-password'
|
|
# CONTROL_ADMIN_PASSWORD_HASH=$2a$10$...
|
|
|
|
# --- MQTT (Phase 3) --------------------------------------------------------
|
|
# The broker is transport only. SQLite stays the source of truth, and only the
|
|
# Control Service publishes config (AGENTS.md §10 rules 5-6).
|
|
|
|
# Turn the broker link on or off. With it off the dashboard still works and the
|
|
# config stays in SQLite, unpublished.
|
|
CONTROL_MQTT_ENABLED=true
|
|
|
|
# The shared Mosquitto on `.13`, seen from inside this container. The compose
|
|
# file maps host.docker.internal to the host gateway.
|
|
# When the TLS listener exists, change this to tls://host.docker.internal:8883.
|
|
CONTROL_MQTT_BROKER=tcp://host.docker.internal:1883
|
|
|
|
# The Control Service identity. The broker ACL gives it write access to every
|
|
# config topic and read access to every status and telemetry topic, nothing else.
|
|
CONTROL_MQTT_CLIENT_ID=control-service
|
|
# CONTROL_MQTT_USERNAME=control-service
|
|
# CONTROL_MQTT_PASSWORD=change-me
|
|
|
|
# PEM bundle used to verify the broker certificate. Required for a tls:// broker.
|
|
CONTROL_MQTT_CA_FILE=/etc/webrestrict/tls/ca.crt
|
|
|
|
# TEMPORARY. The shared Mosquitto has no TLS listener yet, so a plaintext,
|
|
# credential-less link is allowed. The service refuses to start without
|
|
# credentials or TLS unless this is true, and it logs a warning when it is.
|
|
# Set to false as soon as deploy/mosquitto/ is applied (AGENTS.md §10 rule 6).
|
|
CONTROL_MQTT_INSECURE=true
|