Sam Rolfe
14b304e0b0
- internal/mqtt: publish each device's desired state retained on restrict/<device>/config; subscribe to restrict/+/status and restrict/+/telemetry and write reports to SQLite; publish on every state change, republish on connect and every 15 minutes from SQLite, so the broker is repaired from the source of truth. - store: presence (devices.online and last_seen, audited only on transitions), telemetry upsert per (device, day, app, domain) via migration 002, allow and block lists read into the config payload, device lookup by topic. - config: MQTT settings. TLS plus per-device credentials are required; the pre-TLS shared broker needs an explicit CONTROL_MQTT_INSECURE escape hatch. - web: republish config after lock, unlock, expiry, create and edit; broker card on the status partial. - deploy/mosquitto: TLS listener, topic ACL, credential provisioning and a verifier that proves the policy on a throwaway broker. Not applied to the shared Mosquitto on .13 — that change needs Sam's approval. - cmd/control: mqtt-clients prints the MQTT identity of every device. - paho.mqtt.golang v1.5.1, which pulls golang.org/x/net and with it the golang.org/x/crypto bump to v0.42.0. Verified on .13: retained config delivered to a fresh subscriber; a client killed without DISCONNECT drove the broker's retained will and the service flipped the device offline; telemetry landed in SQLite; make mqtt-verify passed 13/13; the service connected over TLS with credentials and a CA. Co-Authored-By: Paperclip <noreply@paperclip.ing>
36 lines
1.4 KiB
Plaintext
36 lines
1.4 KiB
Plaintext
# Per-device MQTT security for the Internet Use Control Control Service.
|
|
#
|
|
# APPLY WITH deploy/mosquitto/README.md. This fragment is included by the shared
|
|
# Mosquitto on `.13`; it does not replace its configuration (AGENTS.md §11
|
|
# Phase 3, §10 rule 6).
|
|
#
|
|
# Two listeners, two planes:
|
|
# * 1883 stays exactly as it is — plain, anonymous. n8n and the rest of the
|
|
# lab keep working (N8N_DEFAULT_MQTT_BROKER_URL=mqtt://192.168.20.13:1883).
|
|
# * 8883 is new and is the ONLY listener the kids' devices use: TLS, a
|
|
# required account, and a topic ACL.
|
|
#
|
|
# `per_listener_settings true` belongs in the main mosquitto.conf, before the
|
|
# first listener, not here. It is what keeps the 1883 plane anonymous while the
|
|
# 8883 plane requires credentials.
|
|
|
|
listener 8883 0.0.0.0
|
|
|
|
# No anonymous devices. A device reads only its own config and writes only its
|
|
# own status and telemetry (webrestrict.acl).
|
|
allow_anonymous false
|
|
password_file /mosquitto/config/conf.d/webrestrict.passwd
|
|
acl_file /mosquitto/config/conf.d/webrestrict.acl
|
|
|
|
# TLS. The lab CA is generated by generate-tls.sh; every device and the Control
|
|
# Service trust the same CA, so a rogue broker on the LAN cannot hand a device
|
|
# its rules.
|
|
tls_version tlsv1.2
|
|
cafile /mosquitto/config/tls/ca.crt
|
|
certfile /mosquitto/config/tls/server.crt
|
|
keyfile /mosquitto/config/tls/server.key
|
|
|
|
# A device proves who it is with a password; it does not need its own client
|
|
# certificate.
|
|
require_certificate false
|