From 8f638bfa4fa11dac15c8c1f5f8eb19b8da3bf161 Mon Sep 17 00:00:00 2001 From: Brent Perteet Date: Thu, 20 Aug 2026 15:44:38 -0500 Subject: [PATCH] fix(S2-a): keep plaintext MQTT inside compose network --- MQTT_DEVICE_AUTH.md | 2 +- docker-compose.yml | 1 - 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/MQTT_DEVICE_AUTH.md b/MQTT_DEVICE_AUTH.md index aafdebf..880da25 100644 --- a/MQTT_DEVICE_AUTH.md +++ b/MQTT_DEVICE_AUTH.md @@ -12,7 +12,7 @@ exposes three listeners, each with a different trust model: | Port | Protocol | Auth | Who it's for | |------|----------|------|---------------| -| `1883` | MQTT (plaintext) | username/password | internal services (e.g. the Laravel subscriber, Python publisher) | +| `1883` | MQTT (plaintext, Compose network only) | username/password | internal backend service; not host-published | | `8883` | MQTT over TLS | **client certificate** | field devices | | `443` (`/mqtt` → loopback `9001`) | MQTT over WSS/TLS | username/password | scoped app clients | | `8884` | MQTT over TLS | username/password (server cert only) | scoped app clients and administrators on networks that expose the raw port | diff --git a/docker-compose.yml b/docker-compose.yml index d535bb2..73e769c 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -11,7 +11,6 @@ services: mosquitto: image: eclipse-mosquitto:2 ports: - - "1883:1883" - "8883:8883" - "8884:8884" - "127.0.0.1:9001:9001"