Sam Rolfe
14b304e0b0
- internal/mqtt: publish each device's desired state retained on restrict/<device>/config; subscribe to restrict/+/status and restrict/+/telemetry and write reports to SQLite; publish on every state change, republish on connect and every 15 minutes from SQLite, so the broker is repaired from the source of truth. - store: presence (devices.online and last_seen, audited only on transitions), telemetry upsert per (device, day, app, domain) via migration 002, allow and block lists read into the config payload, device lookup by topic. - config: MQTT settings. TLS plus per-device credentials are required; the pre-TLS shared broker needs an explicit CONTROL_MQTT_INSECURE escape hatch. - web: republish config after lock, unlock, expiry, create and edit; broker card on the status partial. - deploy/mosquitto: TLS listener, topic ACL, credential provisioning and a verifier that proves the policy on a throwaway broker. Not applied to the shared Mosquitto on .13 — that change needs Sam's approval. - cmd/control: mqtt-clients prints the MQTT identity of every device. - paho.mqtt.golang v1.5.1, which pulls golang.org/x/net and with it the golang.org/x/crypto bump to v0.42.0. Verified on .13: retained config delivered to a fresh subscriber; a client killed without DISCONNECT drove the broker's retained will and the service flipped the device offline; telemetry landed in SQLite; make mqtt-verify passed 13/13; the service connected over TLS with credentials and a CA. Co-Authored-By: Paperclip <noreply@paperclip.ing>
26 lines
1.1 KiB
Markdown
26 lines
1.1 KiB
Markdown
# The lab CA and broker certificate
|
|
|
|
`generate-tls.sh` writes the certificate material here:
|
|
|
|
| File | Purpose | Who gets it |
|
|
|---|---|---|
|
|
| `ca.crt` | the lab CA certificate | every device and the Control Service |
|
|
| `ca.key` | the CA private key | **not** a device; keep it off-device |
|
|
| `server.crt` | the broker certificate | the broker |
|
|
| `server.key` | the broker private key | the broker |
|
|
|
|
Everything in this directory except this README is gitignored: certificates and
|
|
keys are generated per host and never committed.
|
|
|
|
```bash
|
|
make mqtt-tls # writes the four files (skips them if they exist)
|
|
make mqtt-tls-force # use generate-tls.sh --force to replace them
|
|
```
|
|
|
|
The broker runs as user `mosquitto` (uid 1883) inside its container, and this
|
|
directory is bind-mounted read-only, so the files are created mode **0644**. That
|
|
makes the private keys readable on `.13` by any local user. It is the pragmatic
|
|
choice for a LAN-only broker whose key must be readable by a container user that
|
|
does not exist on the host. Replace it with a group-mapped setup if `.13` ever
|
|
gets untrusted local users.
|