5de7b4d7a2
BLE-only locators can't hold the MQTT/TLS connection themselves — a phone relays their data — so handing the phone a device's permanent client-cert key would export its identity to every phone it pairs with. Instead the device signs a server-issued nonce with its permanent key over BLE; once verified, the backend mints a short-lived session certificate for the phone's actual MQTT connection, keeping the permanent key on-device always. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
84 lines
2.5 KiB
YAML
84 lines
2.5 KiB
YAML
services:
|
|
postgres:
|
|
image: postgis/postgis:17-3.5
|
|
environment:
|
|
POSTGRES_DB: ulhub
|
|
POSTGRES_USER: ulhub
|
|
POSTGRES_PASSWORD: development
|
|
volumes:
|
|
- postgres-data:/var/lib/postgresql/data
|
|
|
|
mosquitto:
|
|
image: eclipse-mosquitto:2
|
|
ports:
|
|
- "1883:1883"
|
|
- "8883:8883"
|
|
- "9001:9001"
|
|
volumes:
|
|
- ./mosquitto:/mosquitto
|
|
|
|
backend:
|
|
build:
|
|
context: ./backend
|
|
dockerfile: Dockerfile
|
|
ports:
|
|
- "3001:3001"
|
|
depends_on:
|
|
- postgres
|
|
- mosquitto
|
|
# Development mounts: mount source for hot-reload and keep container node_modules
|
|
volumes:
|
|
- ./backend:/usr/src/app:delegated
|
|
- /usr/src/app/node_modules
|
|
- ./mosquitto/certs:/mosquitto-certs
|
|
environment:
|
|
DATABASE_URL: postgresql://ulhub:development@postgres:5432/ulhub
|
|
JWT_SECRET: ${JWT_SECRET:-dev-only-insecure-secret}
|
|
MQTT_HOST: mosquitto
|
|
MQTT_PORT: 1883
|
|
MQTT_USERNAME: ${MQTT_BACKEND_USERNAME:-backend}
|
|
MQTT_PASSWORD: ${MQTT_BACKEND_PASSWORD:-backendpass}
|
|
MQTT_CERTS_DIR: /mosquitto-certs
|
|
MQTT_TLS_PORT: 8883
|
|
# Must match the CN the broker's server cert was provisioned for
|
|
# (Settings → MQTT Certs), not this container's docker-network hostname —
|
|
# used by the simulator's MQTTS transport to verify the broker's identity.
|
|
MQTT_TLS_SERVERNAME: ${MQTT_TLS_SERVERNAME:-localhost}
|
|
# BLE challenge-response session certs (backend/src/device-mqtt-auth):
|
|
# how long a nonce is redeemable for, and how long the short-lived
|
|
# session cert it produces is valid before a phone must re-challenge.
|
|
MQTT_CHALLENGE_TTL_SECONDS: ${MQTT_CHALLENGE_TTL_SECONDS:-120}
|
|
MQTT_SESSION_CERT_HOURS: ${MQTT_SESSION_CERT_HOURS:-24}
|
|
NODE_ENV: development
|
|
command: sh -c "npx prisma migrate deploy && npm run start:dev"
|
|
|
|
web:
|
|
build:
|
|
context: ./web
|
|
dockerfile: Dockerfile
|
|
ports:
|
|
- "3000:3000"
|
|
depends_on:
|
|
- backend
|
|
# Development mount: mount web code into container for Next.js dev server
|
|
volumes:
|
|
- ./web:/usr/src/app:delegated
|
|
- /usr/src/app/node_modules
|
|
environment:
|
|
BACKEND_HOST: http://backend:3001
|
|
NEXT_PUBLIC_GOOGLE_MAPS_API_KEY: ${NEXT_PUBLIC_GOOGLE_MAPS_API_KEY:-}
|
|
NODE_ENV: development
|
|
command: npm run dev
|
|
|
|
pgadmin:
|
|
image: dpage/pgadmin4:8
|
|
environment:
|
|
PGADMIN_DEFAULT_EMAIL: admin@example.com
|
|
PGADMIN_DEFAULT_PASSWORD: admin
|
|
ports:
|
|
- "5050:80"
|
|
depends_on:
|
|
- postgres
|
|
|
|
volumes:
|
|
postgres-data: |