boban
/
homeos
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix R15: pass MQTT passwords to the broker without shell interpolation 

gen-passwd.sh embedded passwords in `sh -c "..."`, which breaks or injects for
strong passwords containing quotes/$/;. Export them and forward with bare
`-e NAME`, reading them as env vars inside a single-quoted container script — any
character is now handled safely.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
feat/phase-1-bootstrap
HomeOS Bootstrap 2026-07-17 22:54:03 +02:00
parent ea9e35883b
commit 1eec714d4a
1 changed files with 14 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
docker/mosquitto/gen-passwd.sh
View File

@ -24,11 +24,18 @@ LPASS="$(ensure_pw MQTT_AUTH_PASSWORD)"
SPASS="$(ensure_pw MQTT_SHELLY_PASSWORD)" SPASS="$(ensure_pw MQTT_SHELLY_PASSWORD)"
DPASS="$(ensure_pw MQTT_SIDECAR_PASSWORD)" DPASS="$(ensure_pw MQTT_SIDECAR_PASSWORD)"
docker run --rm -v "$(pwd)/docker/mosquitto/config:/cfg" eclipse-mosquitto:2 sh -c " # Export + forward with bare `-e NAME` so docker passes the values verbatim (no host
# interpolation). Read inside the container (single-quoted body) as env vars, so any
# character in a password — quotes, $, ;, backticks — is handled safely.
export LPASS SPASS DPASS
docker run --rm -e LPASS -e SPASS -e DPASS \
-v "$(pwd)/docker/mosquitto/config:/cfg" \
eclipse-mosquitto:2 sh -c '
rm -f /cfg/passwd rm -f /cfg/passwd
mosquitto_passwd -c -b /cfg/passwd laravel '${LPASS}' mosquitto_passwd -c -b /cfg/passwd laravel "$LPASS"
mosquitto_passwd -b /cfg/passwd shelly '${SPASS}' mosquitto_passwd -b /cfg/passwd shelly "$SPASS"
mosquitto_passwd -b /cfg/passwd sidecar '${DPASS}' mosquitto_passwd -b /cfg/passwd sidecar "$DPASS"
chown 1883:1883 /cfg/passwd && chmod 0600 /cfg/passwd chown 1883:1883 /cfg/passwd && chmod 0600 /cfg/passwd
" '
echo 'Mosquitto passwd generated (users: laravel, shelly, sidecar).' echo 'Mosquitto passwd generated (users: laravel, shelly, sidecar).'