Sam Rolfe
14b304e0b0
- internal/mqtt: publish each device's desired state retained on restrict/<device>/config; subscribe to restrict/+/status and restrict/+/telemetry and write reports to SQLite; publish on every state change, republish on connect and every 15 minutes from SQLite, so the broker is repaired from the source of truth. - store: presence (devices.online and last_seen, audited only on transitions), telemetry upsert per (device, day, app, domain) via migration 002, allow and block lists read into the config payload, device lookup by topic. - config: MQTT settings. TLS plus per-device credentials are required; the pre-TLS shared broker needs an explicit CONTROL_MQTT_INSECURE escape hatch. - web: republish config after lock, unlock, expiry, create and edit; broker card on the status partial. - deploy/mosquitto: TLS listener, topic ACL, credential provisioning and a verifier that proves the policy on a throwaway broker. Not applied to the shared Mosquitto on .13 — that change needs Sam's approval. - cmd/control: mqtt-clients prints the MQTT identity of every device. - paho.mqtt.golang v1.5.1, which pulls golang.org/x/net and with it the golang.org/x/crypto bump to v0.42.0. Verified on .13: retained config delivered to a fresh subscriber; a client killed without DISCONNECT drove the broker's retained will and the service flipped the device offline; telemetry landed in SQLite; make mqtt-verify passed 13/13; the service connected over TLS with credentials and a CA. Co-Authored-By: Paperclip <noreply@paperclip.ing>
79 lines
2.5 KiB
Makefile
79 lines
2.5 KiB
Makefile
IMAGE ?= webrestrict/control:0.3.0-phase3
|
|
BUILD_VERSION ?= 0.3.0-phase3
|
|
|
|
# Bounded docker helper for the Go toolchain. The container runs as the current
|
|
# user, so the repository and the module cache stay owned by you.
|
|
GO_IMAGE ?= golang:1.25-alpine
|
|
GO_RUN = timeout 600 docker run --rm --network host --user "$$(id -u):$$(id -g)" \
|
|
-e HOME=/src/.gocache -e GOMODCACHE=/src/.gocache/mod -e GOCACHE=/src/.gocache/build \
|
|
-v "$$PWD":/src -w /src $(GO_IMAGE)
|
|
|
|
# Scratch broker used by `make mqtt-verify` (see deploy/mosquitto/README.md).
|
|
MQTT_VERIFY_PORT ?= 18883
|
|
MQTT_IMAGE ?= eclipse-mosquitto:latest
|
|
|
|
.PHONY: help test vet build up down restart logs ps hash-password deps fmt \
|
|
mqtt-tls mqtt-verify mqtt-config
|
|
|
|
help:
|
|
@echo "make test run go test ./... in golang:1.25-alpine"
|
|
@echo "make vet run go vet ./... in golang:1.25-alpine"
|
|
@echo "make build build the container image ($(IMAGE))"
|
|
@echo "make up docker compose up -d --build"
|
|
@echo "make down docker compose down"
|
|
@echo "make logs follow container logs"
|
|
@echo "make ps docker compose ps"
|
|
@echo "make hash-password generate a bcrypt hash (PASSWORD=...)"
|
|
@echo "make deps go mod tidy + download (writes go.mod/go.sum)"
|
|
@echo "make mqtt-tls generate the lab CA and broker certificate"
|
|
@echo "make mqtt-config build the scratch broker config in deploy/mosquitto/build/"
|
|
@echo "make mqtt-verify prove TLS + credentials + topic ACLs on a scratch broker"
|
|
|
|
test:
|
|
$(GO_RUN) go test ./...
|
|
|
|
vet:
|
|
$(GO_RUN) go vet ./...
|
|
|
|
deps:
|
|
$(GO_RUN) sh -c 'go mod tidy'
|
|
|
|
fmt:
|
|
$(GO_RUN) sh -c 'go fmt ./...'
|
|
|
|
build:
|
|
docker build --build-arg VERSION=$(BUILD_VERSION) -t $(IMAGE) .
|
|
|
|
up:
|
|
docker compose up -d --build
|
|
|
|
down:
|
|
docker compose down
|
|
|
|
restart:
|
|
docker compose restart control
|
|
|
|
logs:
|
|
docker compose logs -f control
|
|
|
|
ps:
|
|
docker compose ps
|
|
|
|
hash-password:
|
|
@test -n "$(PASSWORD)" || (echo "usage: make hash-password PASSWORD=secret"; exit 2)
|
|
docker run --rm --entrypoint /app/control $(IMAGE) hash-password '$(PASSWORD)'
|
|
|
|
# --- MQTT ---------------------------------------------------------------
|
|
# These targets never touch the shared Mosquitto. They build the material and
|
|
# prove it on a scratch broker on $(MQTT_VERIFY_PORT). See deploy/mosquitto/README.md.
|
|
|
|
mqtt-tls:
|
|
deploy/mosquitto/generate-tls.sh
|
|
|
|
mqtt-config: mqtt-tls
|
|
deploy/mosquitto/build-config.sh
|
|
|
|
mqtt-verify: mqtt-config
|
|
MQTT_VERIFY_PORT=$(MQTT_VERIFY_PORT) MQTT_IMAGE=$(MQTT_IMAGE) \
|
|
deploy/mosquitto/verify-isolation.sh
|