UL/ulweb
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add device-certificate mTLS auth, live position tracking, and API docs

Browse Source 
Introduces a CA/PKI module so field devices can authenticate to Mosquitto
over TLS (8883) with per-device client certificates (CN = serial number)
instead of a shared password, with matching Devices/MQTT-Certs UI. Adds
live transmitter position tracking alongside logged points, an MQTTS
transport option in the simulator for exercising the real cert-auth path,
and Swagger API docs at /api/docs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
ulhub
2026-07-18 01:40:12 +00:00
parent f1c94e9279
commit 842cb23e1f
57 changed files with 2283 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
mosquitto/config/mosquitto.conf
View File

@@ -14,14 +14,17 @@ allow_anonymous true
# TLS MQTT — devices authenticate with client certificates (port 8883)
# require_certificate true forces client cert; cert CN becomes the MQTT username.
# ACL restricts each device to devices/<serial_number>/#
# listener 8883 0.0.0.0
# cafile /mosquitto/certs/ca.crt
# certfile /mosquitto/certs/server.crt
# keyfile /mosquitto/certs/server.key
# require_certificate true
# use_identity_as_username true
# allow_anonymous false
# acl_file /mosquitto/config/devices.acl
# Certs are issued by the backend's certificates module (see backend/src/certificates/)
# into ./mosquitto/certs — requires a broker restart after CA init/provisioning
# since there's no config/cert hot-reload.
listener 8883 0.0.0.0
cafile /mosquitto/certs/ca.crt
certfile /mosquitto/certs/server.crt
keyfile /mosquitto/certs/server.key
require_certificate true
use_identity_as_username true
allow_anonymous false
acl_file /mosquitto/config/devices.acl
# TLS MQTT — admin access via username/password, no client cert required (port 8884)
# Connect with CA cert for server verification, then username/password.