feat(S2-a): ingest durable app MQTT points securely

mosquitto/config/mosquitto.conf

@@ -6,11 +6,6 @@ password_file /mosquitto/config/passwd
 acl_file /mosquitto/config/devices.acl
 allow_anonymous false
 
-# WebSocket — browser clients, no authentication required
-listener 9001 0.0.0.0
-protocol websockets
-allow_anonymous true
-
 # TLS MQTT — devices authenticate with client certificates (port 8883)
 # require_certificate true forces client cert; cert CN becomes the MQTT username.
 # ACL restricts each device to devices/<serial_number>/#
@@ -19,20 +14,19 @@ allow_anonymous true
 # since there's no config/cert hot-reload.
 listener 8883 0.0.0.0
 cafile /mosquitto/certs/ca.crt
-certfile /mosquitto/certs/server.crt
-keyfile /mosquitto/certs/server.key
+certfile /etc/letsencrypt/live/dev.hub.umagul.net/fullchain.pem
+keyfile /etc/letsencrypt/live/dev.hub.umagul.net/privkey.pem
 require_certificate true
 use_identity_as_username true
 allow_anonymous false
 acl_file /mosquitto/config/devices.acl
 
-# TLS MQTT — admin access via username/password, no client cert required (port 8884)
-# Connect with CA cert for server verification, then username/password.
-# listener 8884 0.0.0.0
-# cafile /mosquitto/certs/ca.crt
-# certfile /mosquitto/certs/server.crt
-# keyfile /mosquitto/certs/server.key
-# require_certificate false
-# password_file /mosquitto/config/passwd
-# allow_anonymous false
-# acl_file /mosquitto/config/devices.acl
+# TLS MQTT — app/admin username+password access (port 8884). App usernames are orgIds;
+# devices.acl confines them to ul/{orgId}/app/... . No anonymous listener is exposed.
+listener 8884 0.0.0.0
+certfile /etc/letsencrypt/live/dev.hub.umagul.net/fullchain.pem
+keyfile /etc/letsencrypt/live/dev.hub.umagul.net/privkey.pem
+require_certificate false
+password_file /mosquitto/config/passwd
+allow_anonymous false
+acl_file /mosquitto/config/devices.acl