UL/ulweb
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(S2-a): keep broker credential database outside Git

Browse Source
This commit is contained in:
Brent Perteet
2026-08-20 15:52:14 -05:00
parent 8f638bfa4f
commit 8aea87c3cd
3 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
MQTT_DEVICE_AUTH.md
View File

@@ -26,6 +26,12 @@ The TLS listeners use `mosquitto/certs/public-fullchain.pem` and
deployment with owner `1883:1883` and mode `0600`. These files are deployment secrets/artifacts
and are excluded from Git.
The live password database is likewise outside Git at
`/home/ubuntu/.config/ul-platform/mosquitto.passwd`, bind-mounted read-only as
`/mosquitto/secrets/passwd`. Provisioning updates that host file and restarts Mosquitto; the
tracked `mosquitto/config/passwd` is only a legacy/bootstrap sample and must not receive new
organization credentials.
Device authentication happens on **port 8883**. A device presents a client
certificate signed by the app's own Certificate Authority (CA); Mosquitto
verifies the chain and uses the certificate's Common Name (CN) as the MQTT