jtricerolph
0bdfe67bf5
New /settings/api/mqtt-clients routes (list/create/revoke/delete) manage per-consumer dynamic-security identities on the shared broker (LXC 104) — name + topic scope + publish/subscribe flags in, generated username/password out (shown once, never stored). Replaces manually running mosquitto_ctrl over SSH by hand for every new device or app that needs broker access. Implementation SSHs into the broker LXC and runs mosquitto_ctrl inside a throwaway container on its Docker network (src/lib/ssh.js + mqtt-dynsec.js) rather than reimplementing the dynamic-security plugin's JSON wire protocol from scratch — reuses the exact commands verified by hand while wiring up the water-softener and mqtt-inspector clients this session. Needs the shared deploy SSH key mounted (Dockerfile/compose changes) and MQTT_ADMIN_USER/PASS threaded in via stack-init. mqtt_clients table is bookkeeping only (name/scope/active) — the broker's own dynamic-security.json remains the source of truth for auth. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
8 lines
177 B
Docker
8 lines
177 B
Docker
FROM node:22-alpine
|
|
RUN apk add --no-cache openssh-client
|
|
WORKDIR /app
|
|
COPY package.json ./
|
|
RUN npm install --omit=dev
|
|
COPY src/ ./src/
|
|
EXPOSE 3080
|
|
CMD ["node", "src/index.js"]
|