38 lines
1.5 KiB
Plaintext
38 lines
1.5 KiB
Plaintext
# HomeOS MQTT ACLs — least privilege per client role.
|
|
|
|
# Backend (Laravel listener + drivers): full access to the bus.
|
|
user laravel
|
|
topic readwrite #
|
|
|
|
# Discovery sidecar (Phase 4): only publishes discovery findings.
|
|
user sidecar
|
|
topic write homeos/discovery/#
|
|
|
|
# Ring bridge (ring-mqtt add-on): owns the ring/ namespace only. Cloud-bridged devices —
|
|
# it publishes their state and reads its own command topics, nothing else on the bus.
|
|
user ring
|
|
topic readwrite ring/#
|
|
|
|
# Shared device account (default onboarding): every Shelly signs in as `shelly` with one
|
|
# password (Home-Assistant style, no per-device setup). Scoped to device topics only — it can
|
|
# publish status/events for any prefix and do RPC, but cannot touch homeos/, ring/ or $SYS.
|
|
# `+` matches exactly one prefix level, so `+/status/#` = <prefix>/status/…, `+/rpc` covers both
|
|
# the device's <prefix>/rpc request topic and its homeos/rpc reply topic (src=homeos).
|
|
user shelly
|
|
topic write +/status/#
|
|
topic write +/events/#
|
|
topic write +/online
|
|
topic write +/debug/#
|
|
topic read +/command/#
|
|
topic read +/settings/#
|
|
topic readwrite +/rpc
|
|
|
|
# Per-device credentials (optional hardening): a device can instead authenticate with its OWN
|
|
# username = topic prefix (provisioned on the device detail page) and be bound to just its
|
|
# prefix via %u — a compromised device then cannot publish for, or control, another.
|
|
pattern write %u/status/#
|
|
pattern write %u/events/#
|
|
pattern write %u/online
|
|
pattern read %u/command/#
|
|
pattern readwrite %u/rpc
|