UL/ulweb
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(S2-a): keep broker credential database outside Git

Browse Source
This commit is contained in:
Brent Perteet
2026-08-20 15:52:14 -05:00
parent 8f638bfa4f
commit 8aea87c3cd
3 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
MQTT_DEVICE_AUTH.md
View File

@@ -26,6 +26,12 @@ The TLS listeners use `mosquitto/certs/public-fullchain.pem` and
deployment with owner `1883:1883` and mode `0600`. These files are deployment secrets/artifacts deployment with owner `1883:1883` and mode `0600`. These files are deployment secrets/artifacts
and are excluded from Git. and are excluded from Git.
The live password database is likewise outside Git at
`/home/ubuntu/.config/ul-platform/mosquitto.passwd`, bind-mounted read-only as
`/mosquitto/secrets/passwd`. Provisioning updates that host file and restarts Mosquitto; the
tracked `mosquitto/config/passwd` is only a legacy/bootstrap sample and must not receive new
organization credentials.
Device authentication happens on **port 8883**. A device presents a client Device authentication happens on **port 8883**. A device presents a client
certificate signed by the app's own Certificate Authority (CA); Mosquitto certificate signed by the app's own Certificate Authority (CA); Mosquitto
verifies the chain and uses the certificate's Common Name (CN) as the MQTT verifies the chain and uses the certificate's Common Name (CN) as the MQTT

1
docker-compose.yml
View File

@@ -16,6 +16,7 @@ services:
- "127.0.0.1:9001:9001" - "127.0.0.1:9001:9001"
volumes: volumes:
- ./mosquitto:/mosquitto - ./mosquitto:/mosquitto
- /home/ubuntu/.config/ul-platform/mosquitto.passwd:/mosquitto/secrets/passwd:ro
backend: backend:
build: build:

6
mosquitto/config/mosquitto.conf
View File

@@ -2,7 +2,7 @@ per_listener_settings true
# Plain MQTT — internal services and clients authenticate with username/password on port 1883 # Plain MQTT — internal services and clients authenticate with username/password on port 1883
listener 1883 0.0.0.0 listener 1883 0.0.0.0
password_file /mosquitto/config/passwd password_file /mosquitto/secrets/passwd
acl_file /mosquitto/config/devices.acl acl_file /mosquitto/config/devices.acl
allow_anonymous false allow_anonymous false
@@ -10,7 +10,7 @@ allow_anonymous false
# host loopback; nginx supplies the public WSS/TLS endpoint at /mqtt on port 443. # host loopback; nginx supplies the public WSS/TLS endpoint at /mqtt on port 443.
listener 9001 0.0.0.0 listener 9001 0.0.0.0
protocol websockets protocol websockets
password_file /mosquitto/config/passwd password_file /mosquitto/secrets/passwd
acl_file /mosquitto/config/devices.acl acl_file /mosquitto/config/devices.acl
allow_anonymous false allow_anonymous false
@@ -35,6 +35,6 @@ listener 8884 0.0.0.0
certfile /mosquitto/certs/public-fullchain.pem certfile /mosquitto/certs/public-fullchain.pem
keyfile /mosquitto/certs/public-privkey.pem keyfile /mosquitto/certs/public-privkey.pem
require_certificate false require_certificate false
password_file /mosquitto/config/passwd password_file /mosquitto/secrets/passwd
allow_anonymous false allow_anonymous false
acl_file /mosquitto/config/devices.acl acl_file /mosquitto/config/devices.acl