42 lines
1.5 KiB
Bash
Executable File
42 lines
1.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Generate the Mosquitto password file from .env credentials. Run on the HOST
|
|
# (needs docker + the eclipse-mosquitto image), before `docker compose up`:
|
|
# bash docker/mosquitto/gen-passwd.sh
|
|
#
|
|
# Any empty MQTT_*_PASSWORD in .env is filled with a fresh random value and
|
|
# written back, so a first run is secure without manual steps.
|
|
#
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")/../.." # repo root
|
|
|
|
ensure_pw() {
|
|
local key="$1" val
|
|
val="$(grep "^${key}=" .env | cut -d= -f2-)"
|
|
if [ -z "$val" ]; then
|
|
val="$(openssl rand -hex 16)"
|
|
sed -i "s|^${key}=.*|${key}=${val}|" .env
|
|
fi
|
|
printf '%s' "$val"
|
|
}
|
|
|
|
# Backend + discovery accounts. Physical devices get PER-DEVICE credentials provisioned
|
|
# at onboarding (username = topic prefix) — never a shared account.
|
|
LPASS="$(ensure_pw MQTT_AUTH_PASSWORD)"
|
|
DPASS="$(ensure_pw MQTT_SIDECAR_PASSWORD)"
|
|
|
|
# Export + forward with bare `-e NAME` so docker passes the values verbatim (no host
|
|
# interpolation). Read inside the container (single-quoted body) as env vars, so any
|
|
# character in a password — quotes, $, ;, backticks — is handled safely.
|
|
export LPASS DPASS
|
|
|
|
docker run --rm -e LPASS -e DPASS \
|
|
-v "$(pwd)/docker/mosquitto/config:/cfg" \
|
|
eclipse-mosquitto:2 sh -c '
|
|
rm -f /cfg/passwd
|
|
mosquitto_passwd -c -b /cfg/passwd laravel "$LPASS"
|
|
mosquitto_passwd -b /cfg/passwd sidecar "$DPASS"
|
|
chown 1883:1883 /cfg/passwd && chmod 0600 /cfg/passwd
|
|
'
|
|
echo 'Mosquitto passwd generated (users: laravel, sidecar).'
|