# Top-level docker-compose environment variables
# Copy to .env and fill in values before running `docker compose up`

# -----------------------------------------------------------------------
# MQTT broker credentials
# These are injected into the mosquitto container at startup to build the
# password file. Use different values in production — do NOT reuse defaults.
# -----------------------------------------------------------------------

# C2-core service account (full broker access via the "c2core" dynsec role)
MQTT_C2_USER=drb-c2-core
MQTT_C2_PASS=change-me-c2

# Seeds mosquitto's built-in dynamic-security plugin's one-time "admin"
# bootstrap client on first boot (read directly by mosquitto, no entrypoint
# scripting involved). Must be >=12 chars. c2-core needs this SAME value as
# MQTT_DYNSEC_ADMIN_PASS in drb-c2-core/.env to log in as "admin" and
# administer node credentials — see app/internal/dynsec.py.
MOSQUITTO_DYNSEC_PASSWORD=change-me-dynsec-admin-min-12-chars

# There is no shared node credential anymore. Each node authenticates as
# username=<node_id>, password=<its node_keys.api_key> — checked by
# mosquitto's dynamic-security plugin (not an HTTP backend — that was an
# earlier, since-rejected design using the now-archived mosquitto-go-auth).
# Nodes obtain that key via the enrollment flow — see ENROLLMENT_TOKEN in
# drb-c2-core/.env.example.