24 lines
862 B
Plaintext
24 lines
862 B
Plaintext
# HomeOS MQTT ACLs — least privilege per client role.
|
|
|
|
# Backend (Laravel listener + drivers): full access to the bus.
|
|
user laravel
|
|
topic readwrite #
|
|
|
|
# Discovery sidecar (Phase 4): only publishes discovery findings.
|
|
user sidecar
|
|
topic write homeos/discovery/#
|
|
|
|
# Ring bridge (ring-mqtt add-on): owns the ring/ namespace only. Cloud-bridged devices —
|
|
# it publishes their state and reads its own command topics, nothing else on the bus.
|
|
user ring
|
|
topic readwrite ring/#
|
|
|
|
# Physical devices: each authenticates with its OWN credentials (username = its topic
|
|
# prefix, provisioned at onboarding) and is bound to its own prefix via %u — a compromised
|
|
# or misconfigured device cannot publish status for, or control, another device.
|
|
pattern write %u/status/#
|
|
pattern write %u/events/#
|
|
pattern write %u/online
|
|
pattern read %u/command/#
|
|
pattern readwrite %u/rpc
|