40 lines
1.7 KiB
Plaintext
40 lines
1.7 KiB
Plaintext
# HomeOS MQTT ACLs — least privilege per client role.
|
|
|
|
# Backend (Laravel listener + drivers): full access to the bus.
|
|
user laravel
|
|
topic readwrite #
|
|
|
|
# Discovery sidecar (Phase 4): publishes discovery findings + listens for a rescan command.
|
|
user sidecar
|
|
topic write homeos/discovery/#
|
|
topic read homeos/sidecar/rescan
|
|
|
|
# Ring bridge (ring-mqtt add-on): owns the ring/ namespace only. Cloud-bridged devices —
|
|
# it publishes their state and reads its own command topics, nothing else on the bus.
|
|
user ring
|
|
topic readwrite ring/#
|
|
|
|
# Shared device account (default onboarding): every Shelly signs in as `shelly` with one
|
|
# password (Home-Assistant style, no per-device setup). Scoped to device topics only.
|
|
# `+` matches exactly one prefix level (so `+/status/#` = <prefix>/status/…). Deliberately NO
|
|
# write to `+/rpc`: devices only READ RPC requests HomeOS sends to their own <prefix>/rpc and
|
|
# reply on the fixed `homeos/rpc` topic (src=homeos) — this denies a compromised device the
|
|
# ability to publish Switch.Set to ANOTHER device's <prefix>/rpc (cross-device command injection).
|
|
# Reserved namespaces (homeos/, ring/) still match `+`; the ingest path rejects those prefixes.
|
|
user shelly
|
|
topic write +/status/#
|
|
topic write +/events/#
|
|
topic write +/online
|
|
topic write +/debug/#
|
|
topic read +/rpc
|
|
topic write homeos/rpc
|
|
|
|
# Per-device credentials (optional hardening): a device can instead authenticate with its OWN
|
|
# username = topic prefix (provisioned on the device detail page) and be bound to just its
|
|
# prefix via %u — a compromised device then cannot publish for, or control, another.
|
|
pattern write %u/status/#
|
|
pattern write %u/events/#
|
|
pattern write %u/online
|
|
pattern read %u/command/#
|
|
pattern readwrite %u/rpc
|