Sam Rolfe
14b304e0b0
- internal/mqtt: publish each device's desired state retained on restrict/<device>/config; subscribe to restrict/+/status and restrict/+/telemetry and write reports to SQLite; publish on every state change, republish on connect and every 15 minutes from SQLite, so the broker is repaired from the source of truth. - store: presence (devices.online and last_seen, audited only on transitions), telemetry upsert per (device, day, app, domain) via migration 002, allow and block lists read into the config payload, device lookup by topic. - config: MQTT settings. TLS plus per-device credentials are required; the pre-TLS shared broker needs an explicit CONTROL_MQTT_INSECURE escape hatch. - web: republish config after lock, unlock, expiry, create and edit; broker card on the status partial. - deploy/mosquitto: TLS listener, topic ACL, credential provisioning and a verifier that proves the policy on a throwaway broker. Not applied to the shared Mosquitto on .13 — that change needs Sam's approval. - cmd/control: mqtt-clients prints the MQTT identity of every device. - paho.mqtt.golang v1.5.1, which pulls golang.org/x/net and with it the golang.org/x/crypto bump to v0.42.0. Verified on .13: retained config delivered to a fresh subscriber; a client killed without DISCONNECT drove the broker's retained will and the service flipped the device offline; telemetry landed in SQLite; make mqtt-verify passed 13/13; the service connected over TLS with credentials and a CA. Co-Authored-By: Paperclip <noreply@paperclip.ing>
46 lines
1.4 KiB
Bash
Executable File
46 lines
1.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Build the scratch broker configuration used by `make mqtt-verify`.
|
|
#
|
|
# It mirrors the proposed change to the shared Mosquitto on `.13` exactly:
|
|
# the existing plain listener is left as it is, and the webrestrict listener is
|
|
# added beside it. The verification runs this config on a separate, throwaway
|
|
# container, so nothing shared is touched.
|
|
#
|
|
# build/mosquitto.conf the scratch main configuration (generated)
|
|
# conf.d/ the real listener, ACL and password files
|
|
|
|
set -euo pipefail
|
|
|
|
here="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
|
|
out="$here/build"
|
|
|
|
mkdir -p "$out"
|
|
|
|
cat >"$out/mosquitto.conf" <<'EOF'
|
|
# GENERATED by deploy/mosquitto/build-config.sh — do not edit.
|
|
#
|
|
# The scratch broker for `make mqtt-verify`. It is the proposed shape of the
|
|
# shared Mosquitto on `.13`:
|
|
#
|
|
# * the plain 1883 listener is unchanged, still anonymous, so n8n and the rest
|
|
# of the lab keep working;
|
|
# * the 8883 listener (conf.d/webrestrict.conf) is TLS-only and needs an
|
|
# account;
|
|
# * `per_listener_settings true` is what keeps those two planes apart. It
|
|
# belongs in the main configuration, before the first listener, and is the
|
|
# only change to the existing lines of mosquitto.conf.
|
|
persistence false
|
|
log_dest stdout
|
|
connection_messages true
|
|
|
|
per_listener_settings true
|
|
|
|
listener 1883 0.0.0.0
|
|
allow_anonymous true
|
|
|
|
include_dir /mosquitto/config/conf.d
|
|
EOF
|
|
|
|
echo "build-config: wrote $out/mosquitto.conf"
|