Sam Rolfe
14b304e0b0
- internal/mqtt: publish each device's desired state retained on restrict/<device>/config; subscribe to restrict/+/status and restrict/+/telemetry and write reports to SQLite; publish on every state change, republish on connect and every 15 minutes from SQLite, so the broker is repaired from the source of truth. - store: presence (devices.online and last_seen, audited only on transitions), telemetry upsert per (device, day, app, domain) via migration 002, allow and block lists read into the config payload, device lookup by topic. - config: MQTT settings. TLS plus per-device credentials are required; the pre-TLS shared broker needs an explicit CONTROL_MQTT_INSECURE escape hatch. - web: republish config after lock, unlock, expiry, create and edit; broker card on the status partial. - deploy/mosquitto: TLS listener, topic ACL, credential provisioning and a verifier that proves the policy on a throwaway broker. Not applied to the shared Mosquitto on .13 — that change needs Sam's approval. - cmd/control: mqtt-clients prints the MQTT identity of every device. - paho.mqtt.golang v1.5.1, which pulls golang.org/x/net and with it the golang.org/x/crypto bump to v0.42.0. Verified on .13: retained config delivered to a fresh subscriber; a client killed without DISCONNECT drove the broker's retained will and the service flipped the device offline; telemetry landed in SQLite; make mqtt-verify passed 13/13; the service connected over TLS with credentials and a CA. Co-Authored-By: Paperclip <noreply@paperclip.ing>
29 lines
1.2 KiB
Plaintext
29 lines
1.2 KiB
Plaintext
# Topic ACL for the Internet Use Control MQTT plane (AGENTS.md §10 rule 6).
|
|
#
|
|
# Included by conf.d/webrestrict.conf, which is reached only over TLS on 8883.
|
|
# A device may read only its own config and write only its own status and
|
|
# telemetry. Without this, a child can publish a fake "unlocked" (TRANSPORT_
|
|
# DESIGN.md "Security").
|
|
#
|
|
# The MQTT username of a device IS its topic token: the middle level of its
|
|
# config topic. For restrict/harry_phone_2/config the account is
|
|
# `harry_phone_2`. List the tokens with:
|
|
#
|
|
# docker exec webrestrict-control /app/control mqtt-clients
|
|
#
|
|
# and create the accounts with deploy/mosquitto/provision-clients.sh.
|
|
|
|
# The Control Service. It publishes every device's config and reads every
|
|
# device's reports. It cannot read configs and cannot write status or telemetry.
|
|
user control-service
|
|
topic write restrict/+/config
|
|
topic read restrict/+/status
|
|
topic read restrict/+/telemetry
|
|
|
|
# One rule set for every device. %u expands to the authenticated username, so a
|
|
# device is confined to its own topics by construction — no per-device edit is
|
|
# needed when a device is added.
|
|
pattern read restrict/%u/config
|
|
pattern write restrict/%u/status
|
|
pattern write restrict/%u/telemetry
|