ACL preview

The acl.conf this registry currently implies — 0 active devices, 2 rule lines. Nothing on this page is written or sent anywhere.

Generated acl.conf

# Generated file — do not edit by hand.
#
# Produced from the device registry by the device-registry service. Any manual
# change here is lost on the next regeneration; change the registry instead.
#
# Each "user <name>" block's <name> is the certificate CN, which Mosquitto
# sets as the MQTT username via use_identity_as_username (see mosquitto.conf)
# — i.e. it can only be that value if the client presented a CA-signed
# certificate with that CN. There is no catch-all rule below, so any identity
# not listed here gets zero topic access by default.

# BEGIN role:monitor
# dev-only observability identity — read access to every tenant, see issue-monitor-cert.sh
user monitor
topic read tenant/+/device/+/telemetry
# END role:monitor

The monitor role block is included (REGISTRY_ACL_INCLUDE_MONITOR=true). It grants read access across every tenant and exists for dev observability only.

Applying it (manual, phase 1)

Copy the file into the mounted directory, never over the file itself — a Docker file bind mount follows the inode, so replacing the file leaves the container reading the old one and SIGHUP re-reads that same stale inode.

scp acl.conf <host>:/data/iotsensor/config/
ssh <host> "docker kill -s HUP \$(docker ps --format '{{.Names}}' | grep mosquitto)"

Reloading the ACL does not drop connections. Reloading a CRL that Mosquitto cannot parse kills the broker, which is why any file this service ever writes must be written to a temporary path, verified, and only then moved.

An ACL rejection is invisible to the client: a device missing from this file can still connect and its publish still returns success — the message simply goes nowhere. Confirm delivery on the subscriber side, not the publisher's return code.