UL/ulweb
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(S2-a): load public MQTT TLS cert from broker volume

Browse Source
This commit is contained in:
Brent Perteet
2026-08-20 15:27:03 -05:00
parent 8bcc12ec96
commit b66ae2cc47
3 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
MQTT_DEVICE_AUTH.md
View File

@@ -19,6 +19,11 @@ exposes three listeners, each with a different trust model:
The former anonymous WebSocket listener on `9001` is disabled. The current web portal receives The former anonymous WebSocket listener on `9001` is disabled. The current web portal receives
live updates from the backend rather than connecting directly to Mosquitto. live updates from the backend rather than connecting directly to Mosquitto.
The TLS listeners use `mosquitto/certs/public-fullchain.pem` and
`mosquitto/certs/public-privkey.pem`, copied from the host's Let's Encrypt certificate during
deployment with owner `1883:1883` and mode `0600`. These files are deployment secrets/artifacts
and are excluded from Git.
Device authentication happens on **port 8883**. A device presents a client Device authentication happens on **port 8883**. A device presents a client
certificate signed by the app's own Certificate Authority (CA); Mosquitto certificate signed by the app's own Certificate Authority (CA); Mosquitto
verifies the chain and uses the certificate's Common Name (CN) as the MQTT verifies the chain and uses the certificate's Common Name (CN) as the MQTT

3
docker-compose.yml
View File

@@ -16,9 +16,6 @@ services:
- "8884:8884" - "8884:8884"
volumes: volumes:
- ./mosquitto:/mosquitto - ./mosquitto:/mosquitto
# Publicly trusted server identity for app MQTTS. The device listener still
# validates client certificates against /mosquitto/certs/ca.crt.
- /etc/letsencrypt:/etc/letsencrypt:ro
backend: backend:
build: build:

8
mosquitto/config/mosquitto.conf
View File

@@ -14,8 +14,8 @@ allow_anonymous false
# since there's no config/cert hot-reload. # since there's no config/cert hot-reload.
listener 8883 0.0.0.0 listener 8883 0.0.0.0
cafile /mosquitto/certs/ca.crt cafile /mosquitto/certs/ca.crt
certfile /etc/letsencrypt/live/dev.hub.umagul.net/fullchain.pem certfile /mosquitto/certs/public-fullchain.pem
keyfile /etc/letsencrypt/live/dev.hub.umagul.net/privkey.pem keyfile /mosquitto/certs/public-privkey.pem
require_certificate true require_certificate true
use_identity_as_username true use_identity_as_username true
allow_anonymous false allow_anonymous false
@@ -24,8 +24,8 @@ acl_file /mosquitto/config/devices.acl
# TLS MQTT — app/admin username+password access (port 8884). App usernames are orgIds; # TLS MQTT — app/admin username+password access (port 8884). App usernames are orgIds;
# devices.acl confines them to ul/{orgId}/app/... . No anonymous listener is exposed. # devices.acl confines them to ul/{orgId}/app/... . No anonymous listener is exposed.
listener 8884 0.0.0.0 listener 8884 0.0.0.0
certfile /etc/letsencrypt/live/dev.hub.umagul.net/fullchain.pem certfile /mosquitto/certs/public-fullchain.pem
keyfile /etc/letsencrypt/live/dev.hub.umagul.net/privkey.pem keyfile /mosquitto/certs/public-privkey.pem
require_certificate false require_certificate false
password_file /mosquitto/config/passwd password_file /mosquitto/config/passwd
allow_anonymous false allow_anonymous false