UL/ulweb
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(S2-a): load public MQTT TLS cert from broker volume

Browse Source
This commit is contained in:
Brent Perteet
2026-08-20 15:27:03 -05:00
parent 8bcc12ec96
commit b66ae2cc47
3 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
MQTT_DEVICE_AUTH.md
View File

@@ -19,6 +19,11 @@ exposes three listeners, each with a different trust model:
The former anonymous WebSocket listener on `9001` is disabled. The current web portal receives
live updates from the backend rather than connecting directly to Mosquitto.
The TLS listeners use `mosquitto/certs/public-fullchain.pem` and
`mosquitto/certs/public-privkey.pem`, copied from the host's Let's Encrypt certificate during
deployment with owner `1883:1883` and mode `0600`. These files are deployment secrets/artifacts
and are excluded from Git.
Device authentication happens on **port 8883**. A device presents a client
certificate signed by the app's own Certificate Authority (CA); Mosquitto
verifies the chain and uses the certificate's Common Name (CN) as the MQTT