feat(S2-a): ingest durable app MQTT points securely

docker-compose.yml

@@ -13,9 +13,12 @@ services:
     ports:
       - "1883:1883"
       - "8883:8883"
-      - "9001:9001"
+      - "8884:8884"
     volumes:
       - ./mosquitto:/mosquitto
+      # Publicly trusted server identity for app MQTTS. The device listener still
+      # validates client certificates against /mosquitto/certs/ca.crt.
+      - /etc/letsencrypt:/etc/letsencrypt:ro
 
   backend:
     build:
@@ -37,7 +40,7 @@ services:
       MQTT_HOST: mosquitto
       MQTT_PORT: 1883
       MQTT_USERNAME: ${MQTT_BACKEND_USERNAME:-backend}
-      MQTT_PASSWORD: ${MQTT_BACKEND_PASSWORD:-backendpass}
+      MQTT_PASSWORD: ${MQTT_BACKEND_PASSWORD:?set MQTT_BACKEND_PASSWORD}
       MQTT_CERTS_DIR: /mosquitto-certs
       MQTT_TLS_PORT: 8883
       # Must match the CN the broker's server cert was provisioned for
@@ -81,4 +84,4 @@ services:
       - postgres
 
 volumes:
-  postgres-data:
+  postgres-data: