# HomeOS MQTT ACLs — least privilege per client role.

# Backend (Laravel listener + drivers): full access to the bus.
user laravel
topic readwrite #

# Discovery sidecar (Phase 4): only publishes discovery findings.
user sidecar
topic write homeos/discovery/#

# Ring bridge (ring-mqtt add-on): owns the ring/ namespace only. Cloud-bridged devices —
# it publishes their state and reads its own command topics, nothing else on the bus.
user ring
topic readwrite ring/#

# Shared device account (default onboarding): every Shelly signs in as `shelly` with one
# password (Home-Assistant style, no per-device setup). Scoped to device topics only — it can
# publish status/events for any prefix and do RPC, but cannot touch homeos/, ring/ or $SYS.
# `+` matches exactly one prefix level, so `+/status/#` = <prefix>/status/…, `+/rpc` covers both
# the device's <prefix>/rpc request topic and its homeos/rpc reply topic (src=homeos).
user shelly
topic write +/status/#
topic write +/events/#
topic write +/online
topic write +/debug/#
topic read +/command/#
topic read +/settings/#
topic readwrite +/rpc

# Per-device credentials (optional hardening): a device can instead authenticate with its OWN
# username = topic prefix (provisioned on the device detail page) and be bound to just its
# prefix via %u — a compromised device then cannot publish for, or control, another.
pattern write %u/status/#
pattern write %u/events/#
pattern write %u/online
pattern read %u/command/#
pattern readwrite %u/rpc