latest

docker/mosquitto/config/acl.conf

@@ -0,0 +1,38 @@
+# MQTT topic ACLs — first-pass static per-role credentials.
+#
+# Topic taxonomy:
+#   private/user/{userId}/notifications  - direct-to-user notifications
+#   role/{roleName}/alerts               - role-broadcast alerts
+#   module/{module}/events               - CRUD/live-update events for a module's list views
+#   broadcast/system                     - app-wide announcements
+#
+# LIMITATION (documented, not silent): static per-role credentials give
+# role-level topic isolation only, not per-user isolation. A `role_user`
+# connection can read another user's `private/user/{id}/notifications`
+# topic if it subscribes to the wildcard below. Per-user isolation requires
+# a JWT-validating auth plugin (e.g. mosquitto-go-auth) mapping topics to
+# the authenticated user's own id — deferred as a follow-up.
+
+# Backend service account: full publish access (it is the only publisher).
+user laravel_publisher
+topic readwrite #
+
+# Super Admin / Admin role: read everything relevant to admin operations.
+user role_admin
+topic read broadcast/system
+topic read role/admin/alerts
+topic read module/+/events
+topic read private/+/notifications
+
+# Manager role: module events + its own role alerts + system broadcasts.
+user role_manager
+topic read broadcast/system
+topic read role/manager/alerts
+topic read module/+/events
+topic read private/+/notifications
+
+# Standard user role: system broadcasts + its own role alerts only.
+user role_user
+topic read broadcast/system
+topic read role/user/alerts
+topic read private/+/notifications

docker/mosquitto/config/mosquitto.conf

@@ -0,0 +1,15 @@
+listener 1883
+protocol mqtt
+
+listener 9001
+protocol websockets
+
+allow_anonymous false
+password_file /mosquitto/config/passwd
+acl_file /mosquitto/config/acl.conf
+
+persistence true
+persistence_location /mosquitto/data/
+
+log_dest file /mosquitto/log/mosquitto.log
+log_dest stdout