# HomeOS MQTT ACLs — least privilege per client role.

# Backend (Laravel listener + drivers): full access to the bus.
user laravel
topic readwrite #

# Discovery sidecar (Phase 4): publishes discovery findings + listens for a rescan command.
user sidecar
topic write homeos/discovery/#
topic read homeos/sidecar/rescan

# Ring bridge (ring-mqtt add-on): owns the ring/ namespace only. Cloud-bridged devices —
# it publishes their state and reads its own command topics, nothing else on the bus.
user ring
topic readwrite ring/#

# Shared device account (default onboarding): every Shelly signs in as `shelly` with one
# password (Home-Assistant style, no per-device setup). Scoped to device topics only.
# `+` matches exactly one prefix level (so `+/status/#` = <prefix>/status/…). Deliberately NO
# write to `+/rpc`: devices only READ RPC requests HomeOS sends to their own <prefix>/rpc and
# reply on the fixed `homeos/rpc` topic (src=homeos) — this denies a compromised device the
# ability to publish Switch.Set to ANOTHER device's <prefix>/rpc (cross-device command injection).
# Reserved namespaces (homeos/, ring/) still match `+`; the ingest path rejects those prefixes.
user shelly
topic write +/status/#
topic write +/events/#
topic write +/online
topic write +/debug/#
topic read +/rpc
topic write homeos/rpc

# Per-device credentials (optional hardening): a device can instead authenticate with its OWN
# username = topic prefix (provisioned on the device detail page) and be bound to just its
# prefix via %u — a compromised device then cannot publish for, or control, another.
pattern write %u/status/#
pattern write %u/events/#
pattern write %u/online
pattern read %u/command/#
pattern readwrite %u/rpc