From 12c9ad73bbc506f5823b7b1fd9ab26a880f5577c Mon Sep 17 00:00:00 2001 From: Logan Cusano Date: Sun, 9 Aug 2026 22:28:38 -0400 Subject: [PATCH] Document the no-$-in-vault-values rule that caused the MQTT auth failure A password containing "$fP" was interpolated away by compose, giving mosquitto and c2-core two different passwords and producing "MQTT connect refused: Not authorized" with nothing in the logs pointing at the cause. Recorded next to the values so the next person generating credentials sees it. Co-Authored-By: Claude Opus 5 --- infra/ansible/vault.yml.example | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/infra/ansible/vault.yml.example b/infra/ansible/vault.yml.example index 1ee84e0..81ca1dc 100644 --- a/infra/ansible/vault.yml.example +++ b/infra/ansible/vault.yml.example @@ -4,6 +4,13 @@ # Edit later with: # ansible-vault edit vault.yml +# DO NOT put a literal "$" in any value here. Docker compose interpolates the +# top-level .env, and depending on version it also interpolates env_file, so a +# password like "aB$fPx" is read as the variable $fPx and silently replaced +# with an empty string — on one side of the connection but not the other. +# That produced "MQTT connect refused: Not authorized" with no obvious cause. +# Generate with: openssl rand -hex 32 (hex output has no shell metacharacters) + # ── MQTT ───────────────────────────────────────────────────────────────────── vault_mqtt_c2_user: drb-c2-core vault_mqtt_c2_pass: "CHANGE_ME"