UL/ulweb
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(S2-a): mount broker auth files outside source tree

Browse Source
This commit is contained in:
Brent Perteet
2026-08-20 15:53:20 -05:00
parent 8aea87c3cd
commit e552ae4e5c
3 changed files with 12 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
mosquitto/config/mosquitto.conf
View File

@@ -2,16 +2,16 @@ per_listener_settings true
# Plain MQTT — internal services and clients authenticate with username/password on port 1883
listener 1883 0.0.0.0
password_file /mosquitto/secrets/passwd
acl_file /mosquitto/config/devices.acl
password_file /run/secrets/mosquitto_passwd
acl_file /run/secrets/mosquitto_acl
allow_anonymous false
# Authenticated MQTT over WebSocket for app clients. Docker binds this listener only to
# host loopback; nginx supplies the public WSS/TLS endpoint at /mqtt on port 443.
listener 9001 0.0.0.0
protocol websockets
password_file /mosquitto/secrets/passwd
acl_file /mosquitto/config/devices.acl
password_file /run/secrets/mosquitto_passwd
acl_file /run/secrets/mosquitto_acl
allow_anonymous false
# TLS MQTT — devices authenticate with client certificates (port 8883)
@@ -27,7 +27,7 @@ keyfile /mosquitto/certs/public-privkey.pem
require_certificate true
use_identity_as_username true
allow_anonymous false
acl_file /mosquitto/config/devices.acl
acl_file /run/secrets/mosquitto_acl
# TLS MQTT — app/admin username+password access (port 8884). App usernames are orgIds;
# devices.acl confines them to ul/{orgId}/app/... . No anonymous listener is exposed.
@@ -35,6 +35,6 @@ listener 8884 0.0.0.0
certfile /mosquitto/certs/public-fullchain.pem
keyfile /mosquitto/certs/public-privkey.pem
require_certificate false
password_file /mosquitto/secrets/passwd
password_file /run/secrets/mosquitto_passwd
allow_anonymous false
acl_file /mosquitto/config/devices.acl
acl_file /run/secrets/mosquitto_acl