From 42ae76227b6cdaf4d5786f0129ace9cbbafafc6b Mon Sep 17 00:00:00 2001
From: HomeOS Bootstrap <homeos@localhost>
Date: Sat, 18 Jul 2026 11:00:32 +0200
Subject: [PATCH] fix(ring): seed bridge config so it actually starts (auto,
 reproducible)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ring-mqtt v5 needs /data/config.json or it exits immediately — so "always on"
crashed. gen-passwd.sh now generates docker/ring-mqtt/config.json (the broker
mqtt_url for the least-privileged `ring` user), bind-mounted read-only into the
bridge; the token/state stays in the ring-data volume. config.json is gitignored
(has the password); a .example is committed.

Verified live: bridge starts on `docker compose up -d`, web UI answers 200 on
:55123, MQTT URL set — it only waits for the Ring login. Fully automatic, no
manual command.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .gitignore                           | 1 +
 docker-compose.yml                   | 7 +++----
 docker/mosquitto/gen-passwd.sh       | 6 ++++++
 docker/ring-mqtt/config.json.example | 3 +++
 4 files changed, 13 insertions(+), 4 deletions(-)
 create mode 100644 docker/ring-mqtt/config.json.example

diff --git a/.gitignore b/.gitignore
index 33dcc61..df7f3dd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -40,3 +40,4 @@ Thumbs.db
 
 # Codex R15 review outputs (local scratch)
 .reviews/
+docker/ring-mqtt/config.json
diff --git a/docker-compose.yml b/docker-compose.yml
index f579ade..469e142 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -96,12 +96,11 @@ services:
     depends_on:
       - mosquitto
     environment:
-      MQTTHOST: mosquitto
-      MQTTPORT: "1883"
-      MQTTUSER: ring
-      MQTTPASSWORD: ${MQTT_RING_PASSWORD}
+      RUNMODE: docker
     volumes:
       - ring-data:/data
+      # Generated by gen-passwd.sh (holds the broker mqtt_url); the token/state lives in ring-data.
+      - ./docker/ring-mqtt/config.json:/data/config.json:ro
     ports:
       # ring-mqtt setup/token web UI. Port may differ by ring-mqtt version — adjust if needed.
       - "${RING_UI_PORT:-55123}:55123"
diff --git a/docker/mosquitto/gen-passwd.sh b/docker/mosquitto/gen-passwd.sh
index 5288848..b83be9f 100755
--- a/docker/mosquitto/gen-passwd.sh
+++ b/docker/mosquitto/gen-passwd.sh
@@ -47,3 +47,9 @@ docker run --rm -e LPASS -e DPASS -e RPASS -e SPASS \
         chown '"$(id -u)"':'"$(id -g)"' /cfg/passwd && chmod 0644 /cfg/passwd
     '
 echo 'Mosquitto passwd generated (users: laravel, sidecar, ring, shelly).'
+
+# ring-mqtt bridge config — points the bridge at our broker as the least-privileged `ring` user.
+# Kept out of git (contains the password); the token/state stays in the ring-data volume.
+mkdir -p docker/ring-mqtt
+printf '{\n  "mqtt_url": "mqtt://ring:%s@mosquitto:1883"\n}\n' "$RPASS" > docker/ring-mqtt/config.json
+echo 'ring-mqtt config generated (docker/ring-mqtt/config.json).'
diff --git a/docker/ring-mqtt/config.json.example b/docker/ring-mqtt/config.json.example
new file mode 100644
index 0000000..8d154d4
--- /dev/null
+++ b/docker/ring-mqtt/config.json.example
@@ -0,0 +1,3 @@
+{
+  "mqtt_url": "mqtt://ring:REPLACED_BY_GEN_PASSWD@mosquitto:1883"
+}