UL/ulweb
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(S2-a): ingest durable app MQTT points securely

Browse Source
This commit is contained in:
Brent Perteet
2026-08-20 15:22:40 -05:00
parent daa3407b9d
commit 8bcc12ec96
14 changed files with 979 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
mosquitto/config/devices.acl
View File

@@ -12,10 +12,22 @@ topic readwrite #
topic readwrite $SYS/#
# Backend service: reads all device traffic, writes job acks back to devices,
# and publishes on behalf of the /sim simulator tool (devices/<serial>/log)
# and publishes on behalf of the /sim simulator tool (devices/<serial>/log).
# Also ingests the SRS §3.4.2 ul/# namespace (app + device-direct) and writes the
# application-level acks back on ul/{orgId}/{clientClass}/{clientId}/ack.
user backend
topic read devices/#
topic write devices/+/jobs/ack
topic write devices/+/log
topic read ul/#
topic write ul/+/+/+/ack
# --- App-client namespace confinement (S2-a / SRS §3.4.2 Topic scheme) --------------
# The interim app credential uses username == orgId, so %u confines it to that tenant.
# The '+' clientId wildcard is the accepted Sprint 2 tradeoff: clients within one org share
# the credential and can see that org's ack topics until OIDC-derived per-client identity lands.
# Publish/read permissions are narrower than readwrite '#': only durable point input and acks.
pattern write ul/%u/app/+/log/points
pattern read ul/%u/app/+/ack
# testuser is a demo *device*: only the per-device pattern rule above applies

28
mosquitto/config/mosquitto.conf
View File

@@ -6,11 +6,6 @@ password_file /mosquitto/config/passwd
acl_file /mosquitto/config/devices.acl
allow_anonymous false
# WebSocket — browser clients, no authentication required
listener 9001 0.0.0.0
protocol websockets
allow_anonymous true
# TLS MQTT — devices authenticate with client certificates (port 8883)
# require_certificate true forces client cert; cert CN becomes the MQTT username.
# ACL restricts each device to devices/<serial_number>/#
@@ -19,20 +14,19 @@ allow_anonymous true
# since there's no config/cert hot-reload.
listener 8883 0.0.0.0
cafile /mosquitto/certs/ca.crt
certfile /mosquitto/certs/server.crt
keyfile /mosquitto/certs/server.key
certfile /etc/letsencrypt/live/dev.hub.umagul.net/fullchain.pem
keyfile /etc/letsencrypt/live/dev.hub.umagul.net/privkey.pem
require_certificate true
use_identity_as_username true
allow_anonymous false
acl_file /mosquitto/config/devices.acl
# TLS MQTT — admin access via username/password, no client cert required (port 8884)
# Connect with CA cert for server verification, then username/password.
# listener 8884 0.0.0.0
# cafile /mosquitto/certs/ca.crt
# certfile /mosquitto/certs/server.crt
# keyfile /mosquitto/certs/server.key
# require_certificate false
# password_file /mosquitto/config/passwd
# allow_anonymous false
# acl_file /mosquitto/config/devices.acl
# TLS MQTT — app/admin username+password access (port 8884). App usernames are orgIds;
# devices.acl confines them to ul/{orgId}/app/... . No anonymous listener is exposed.
listener 8884 0.0.0.0
certfile /etc/letsencrypt/live/dev.hub.umagul.net/fullchain.pem
keyfile /etc/letsencrypt/live/dev.hub.umagul.net/privkey.pem
require_certificate false
password_file /mosquitto/config/passwd
allow_anonymous false
acl_file /mosquitto/config/devices.acl