842cb23e1f
Introduces a CA/PKI module so field devices can authenticate to Mosquitto over TLS (8883) with per-device client certificates (CN = serial number) instead of a shared password, with matching Devices/MQTT-Certs UI. Adds live transmitter position tracking alongside logged points, an MQTTS transport option in the simulator for exercising the real cert-auth path, and Swagger API docs at /api/docs. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
39 lines
1.4 KiB
Plaintext
39 lines
1.4 KiB
Plaintext
per_listener_settings true
|
|
|
|
# Plain MQTT — internal services and clients authenticate with username/password on port 1883
|
|
listener 1883 0.0.0.0
|
|
password_file /mosquitto/config/passwd
|
|
acl_file /mosquitto/config/devices.acl
|
|
allow_anonymous false
|
|
|
|
# WebSocket — browser clients, no authentication required
|
|
listener 9001 0.0.0.0
|
|
protocol websockets
|
|
allow_anonymous true
|
|
|
|
# TLS MQTT — devices authenticate with client certificates (port 8883)
|
|
# require_certificate true forces client cert; cert CN becomes the MQTT username.
|
|
# ACL restricts each device to devices/<serial_number>/#
|
|
# Certs are issued by the backend's certificates module (see backend/src/certificates/)
|
|
# into ./mosquitto/certs — requires a broker restart after CA init/provisioning
|
|
# since there's no config/cert hot-reload.
|
|
listener 8883 0.0.0.0
|
|
cafile /mosquitto/certs/ca.crt
|
|
certfile /mosquitto/certs/server.crt
|
|
keyfile /mosquitto/certs/server.key
|
|
require_certificate true
|
|
use_identity_as_username true
|
|
allow_anonymous false
|
|
acl_file /mosquitto/config/devices.acl
|
|
|
|
# TLS MQTT — admin access via username/password, no client cert required (port 8884)
|
|
# Connect with CA cert for server verification, then username/password.
|
|
# listener 8884 0.0.0.0
|
|
# cafile /mosquitto/certs/ca.crt
|
|
# certfile /mosquitto/certs/server.crt
|
|
# keyfile /mosquitto/certs/server.key
|
|
# require_certificate false
|
|
# password_file /mosquitto/config/passwd
|
|
# allow_anonymous false
|
|
# acl_file /mosquitto/config/devices.acl
|