jtricerolph
0bdfe67bf5
New /settings/api/mqtt-clients routes (list/create/revoke/delete) manage per-consumer dynamic-security identities on the shared broker (LXC 104) — name + topic scope + publish/subscribe flags in, generated username/password out (shown once, never stored). Replaces manually running mosquitto_ctrl over SSH by hand for every new device or app that needs broker access. Implementation SSHs into the broker LXC and runs mosquitto_ctrl inside a throwaway container on its Docker network (src/lib/ssh.js + mqtt-dynsec.js) rather than reimplementing the dynamic-security plugin's JSON wire protocol from scratch — reuses the exact commands verified by hand while wiring up the water-softener and mqtt-inspector clients this session. Needs the shared deploy SSH key mounted (Dockerfile/compose changes) and MQTT_ADMIN_USER/PASS threaded in via stack-init. mqtt_clients table is bookkeeping only (name/scope/active) — the broker's own dynamic-security.json remains the source of truth for auth. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
16 lines
503 B
YAML
16 lines
503 B
YAML
services:
|
|
settings:
|
|
build: .
|
|
restart: unless-stopped
|
|
ports:
|
|
- "3080:3080"
|
|
environment:
|
|
DATABASE_URL: ${DATABASE_URL}
|
|
SETTINGS_SECRET: ${SETTINGS_SECRET}
|
|
AUTH_URL: ${AUTH_URL:-http://10.10.10.101:3001}
|
|
SSH_KEY_PATH: ${SSH_KEY_PATH:-/root/.ssh/hotel-manage_deploy}
|
|
MQTT_BROKER_HOST: ${MQTT_BROKER_HOST:-10.10.10.104}
|
|
MQTT_ADMIN_USER: ${MQTT_ADMIN_USER:-}
|
|
MQTT_ADMIN_PASS: ${MQTT_ADMIN_PASS:-}
|
|
volumes:
|
|
- /root/.ssh:/root/.ssh:ro
|