From 8aea87c3cd8d0cfac1aed46a40a7509d8a806d00 Mon Sep 17 00:00:00 2001 From: Brent Perteet Date: Thu, 20 Aug 2026 15:52:14 -0500 Subject: [PATCH] fix(S2-a): keep broker credential database outside Git --- MQTT_DEVICE_AUTH.md | 6 ++++++ docker-compose.yml | 1 + mosquitto/config/mosquitto.conf | 6 +++--- 3 files changed, 10 insertions(+), 3 deletions(-) diff --git a/MQTT_DEVICE_AUTH.md b/MQTT_DEVICE_AUTH.md index 880da25..3f3238a 100644 --- a/MQTT_DEVICE_AUTH.md +++ b/MQTT_DEVICE_AUTH.md @@ -26,6 +26,12 @@ The TLS listeners use `mosquitto/certs/public-fullchain.pem` and deployment with owner `1883:1883` and mode `0600`. These files are deployment secrets/artifacts and are excluded from Git. +The live password database is likewise outside Git at +`/home/ubuntu/.config/ul-platform/mosquitto.passwd`, bind-mounted read-only as +`/mosquitto/secrets/passwd`. Provisioning updates that host file and restarts Mosquitto; the +tracked `mosquitto/config/passwd` is only a legacy/bootstrap sample and must not receive new +organization credentials. + Device authentication happens on **port 8883**. A device presents a client certificate signed by the app's own Certificate Authority (CA); Mosquitto verifies the chain and uses the certificate's Common Name (CN) as the MQTT diff --git a/docker-compose.yml b/docker-compose.yml index 73e769c..e18576c 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -16,6 +16,7 @@ services: - "127.0.0.1:9001:9001" volumes: - ./mosquitto:/mosquitto + - /home/ubuntu/.config/ul-platform/mosquitto.passwd:/mosquitto/secrets/passwd:ro backend: build: diff --git a/mosquitto/config/mosquitto.conf b/mosquitto/config/mosquitto.conf index 8ee63fd..a191c5e 100644 --- a/mosquitto/config/mosquitto.conf +++ b/mosquitto/config/mosquitto.conf @@ -2,7 +2,7 @@ per_listener_settings true # Plain MQTT — internal services and clients authenticate with username/password on port 1883 listener 1883 0.0.0.0 -password_file /mosquitto/config/passwd +password_file /mosquitto/secrets/passwd acl_file /mosquitto/config/devices.acl allow_anonymous false @@ -10,7 +10,7 @@ allow_anonymous false # host loopback; nginx supplies the public WSS/TLS endpoint at /mqtt on port 443. listener 9001 0.0.0.0 protocol websockets -password_file /mosquitto/config/passwd +password_file /mosquitto/secrets/passwd acl_file /mosquitto/config/devices.acl allow_anonymous false @@ -35,6 +35,6 @@ listener 8884 0.0.0.0 certfile /mosquitto/certs/public-fullchain.pem keyfile /mosquitto/certs/public-privkey.pem require_certificate false -password_file /mosquitto/config/passwd +password_file /mosquitto/secrets/passwd allow_anonymous false acl_file /mosquitto/config/devices.acl