# Auth: mosquitto's own built-in dynamic-security plugin — NOT
# mosquitto-go-auth (that project is archived upstream, no CVE patches;
# rejected for an internet-facing broker). This plugin ships in and is
# maintained alongside the official eclipse-mosquitto image itself.
# See MQTT-PUBLIC-AUTH-PLAN.md and app/internal/dynsec.py for the full
# design (bootstrap, roles, the two-sources-of-truth reconcile).
#
# Plugin path is DERIVED FROM SOURCE (docker/2.1-alpine/Dockerfile in
# eclipse-mosquitto/mosquitto), not observed by running the image —
# nothing in this project executes/pulls images from this machine. Verify
# it on first real deploy: `docker compose logs mosquitto` will say
# "Error: Unable to load plugin" at the exact path below if it's wrong for
# whatever patch tag ends up pinned.
plugin /usr/lib/mosquitto_dynamic_security.so
# Lives on the same persistent volume as `persistence_location` below —
# one durable volume for all broker state, survives redeploys.
plugin_opt_config_file /mosquitto/data/dynamic-security.json

allow_anonymous false
# No password_file/acl_file directive anywhere in this file — the plugin
# above is the only registered auth backend. There is no "coexist" mode:
# nothing else is registered to conflict with it.

# Internal, plaintext — c2-core's own connection only (its dynsec-admin
# control-plane calls AND its regular data-plane pub/sub both use this).
# Never published to the host in prod (docker-compose.prod.yml removes the
# port mapping); external nodes use the TLS listener below instead.
listener 1883

# Public, TLS — edge nodes connect here as username=node_id, password=api_key
# (the same credential /upload already trusts via node_keys), authorized by
# the "node" dynsec role (nodes/%u/# — %u is the dynsec-authenticated
# username, fixing the old %c-based ACL's client-ID-spoofing hole). Cert/key
# come from infra/ansible's Caddy cert-sync unit; see
# MQTT-PUBLIC-AUTH-PLAN.md "Infra" and the "Rollout order" cert-verification
# step for what happens before that cert exists.
listener 8883
certfile /mosquitto/certs/mqtt.crt
keyfile  /mosquitto/certs/mqtt.key

persistence true
persistence_location /mosquitto/data/

log_dest stdout
log_type error
log_type warning
log_type notice