mosquitto: its directories are placed, not stated, and it runs the build in use

The module stated /var/lib/mosquitto-module and /services/mosquitto/data — novox's layout, a path no definition may carry (ADR 0112). State, grants and data are now placed directories (${dir:state}, ${dir:grants}, ${dir:data}), the admin secret lives beside the broker account under the mesh's own state, and the receives/grants maps follow the grants directory. Paths inside the sidecar are its own view and are unchanged. Image pinned to the 2.1.2 build ace's predecessor runs (2026-09-17); the old pin was the same version, built in June. Found preparing ace, whose broker carries a password-file user (an IoT switch and home-assistant). Carrying it is a data step, not a manifest one: the migration repo has scripts/mosquitto-pwdfile-to-dynsec.py, which moves $7$ PBKDF2 entries into the dynsec store hash-for-hash (tested end to end).
2026-09-29 23:05:41 +02:00
3 changed files with 24 additions and 65 deletions
@@ -23,13 +23,13 @@
    "mqtt-topic": {}
  },
  "receives": {
-    "mqtt-topic": "/var/lib/mosquitto-module/grants/mesh.json"
+    "mqtt-topic": "${dir:grants}/mesh.json"
  },
  "grants": {
-    "mqtt-topic": "/var/lib/mosquitto-module/grants"
+    "mqtt-topic": "${dir:grants}"
  },
  "own-secrets": {
-    "admin": "/var/lib/mosquitto-module/admin.secret",
+    "admin": "/var/lib/mesh/mosquitto/admin",
    "broker": "/var/lib/mesh/mosquitto/broker"
  },
  "listens": [
@@ -58,26 +58,24 @@
    {
      "id": "state",
      "type": "directory",
-      "path": "/var/lib/mosquitto-module",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "."
    },
    {
-      "id": "grants-dir",
+      "id": "grants",
      "type": "directory",
-      "path": "/var/lib/mosquitto-module/grants",
      "mode": "0700"
    },
    {
      "id": "data",
      "type": "directory",
-      "path": "/services/mosquitto/data",
      "mode": "0700",
      "owner": "1883:1883"
    },
    {
      "id": "server-conf",
      "type": "file",
-      "path": "/var/lib/mosquitto-module/mosquitto.conf",
+      "path": "${dir:state}/mosquitto.conf",
      "mode": "0600",
      "owner": "1883:1883",
      "content": "persistence true\npersistence_location /mosquitto/data\n\nlog_dest stdout\nlog_type warning\nlog_type error\nlog_type notice\n\n# Every client authenticates; identities and their per-topic ACLs are managed\n# at runtime by the dynamic security plugin, whose store the plugin itself owns.\nallow_anonymous false\nplugin /usr/lib/mosquitto_dynamic_security.so\nplugin_opt_config_file /mosquitto/data/dynamic-security.json\n\n# MQTT listener\nlistener 1883\n\n# MQTT-over-WebSockets listener\nlistener 8081\nprotocol websockets\n"
@@ -93,8 +91,8 @@
      "name": "mosquitto-bootstrap",
      "run-once": true,
      "volumes": [
-        "/services/mosquitto/data:/mosquitto/data",
-        "/var/lib/mosquitto-module/admin.secret:/run/secrets/admin:ro"
+        "${dir:data}:/mosquitto/data",
+        "/var/lib/mesh/mosquitto/admin:/run/secrets/admin:ro"
      ],
      "env": {
        "MESH_PROVISION_MQTT": "mosquitto:1883",
@@ -112,15 +110,15 @@
      "id": "server",
      "type": "container",
      "name": "mosquitto",
-      "image": "eclipse-mosquitto@sha256:6f8d8a947c506f8a2290ec65cd4bd2bc7cb4d43fb5f6271f861cb013e2ef9797",
+      "image": "eclipse-mosquitto@sha256:38c0da4f2ef84284d47b3b3eeea1cb3bdeabe81ee10caf0cd5c5ff61ee3ea408",
      "network": "mosquitto",
      "ports": [
        "1883",
        "8081"
      ],
      "volumes": [
-        "/services/mosquitto/data:/mosquitto/data",
-        "/var/lib/mosquitto-module/mosquitto.conf:/mosquitto/config/mosquitto.conf:ro"
+        "${dir:data}:/mosquitto/data",
+        "${dir:state}/mosquitto.conf:/mosquitto/config/mosquitto.conf:ro"
      ]
    },
    {
@@ -130,8 +128,8 @@
      "network": "mosquitto",
      "volumes": [
        "/var/lib/mesh/mosquitto/broker:/run/secrets/broker:ro",
-        "/var/lib/mosquitto-module/grants:/var/lib/mosquitto-module/grants:ro",
-        "/var/lib/mosquitto-module/admin.secret:/run/secrets/admin:ro"
+        "${dir:grants}:/var/lib/mosquitto-module/grants:ro",
+        "/var/lib/mesh/mosquitto/admin:/run/secrets/admin:ro"
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
@@ -3,8 +3,7 @@
 //
 // Node-RED exposes a runtime admin API under its base URL: GET/POST /flows for the whole flow
 // configuration, GET /nodes for installed node modules. A default install has no auth; when
-// adminAuth is on, a bearer token is required — the module's settings accept the mesh-minted
-// api-token, which the runtime config file carries as `token`.
+// adminAuth is on, a bearer token (minted at /auth/token) is required.

 import { readFileSync } from "node:fs";

@@ -89,13 +88,8 @@ export class NodeRedClient {
  async deployFlows(config: any[], type = "full"): Promise<{ rev?: string; nodeCount: number }> {
    const body = await this.req("/flows", {
      method: "POST",
-      // v2 answers { rev }; v1 answers 204 with no body, which req() cannot parse.
-      headers: this.headers({
-        "Content-Type": "application/json",
-        "Node-RED-API-Version": "v2",
-        "Node-RED-Deployment-Type": type,
-      }),
-      body: JSON.stringify({ flows: config }),
+      headers: this.headers({ "Content-Type": "application/json", "Node-RED-Deployment-Type": type }),
+      body: JSON.stringify(config),
    });
    return { rev: body?.rev, nodeCount: config.length };
  }
@@ -5,8 +5,6 @@
    "flows.deployed"
  ],
  "own-secrets": {
-    "admin": "/var/lib/mesh/nodered/admin",
-    "api-token": "/var/lib/mesh/nodered/api-token",
    "broker": "/var/lib/mesh/nodered/broker"
  },
  "capabilities": [
@@ -28,58 +26,26 @@
      "path": "/var/lib/mesh/nodered",
      "mode": "0700"
    },
-    {
-      "id": "state",
-      "type": "directory",
-      "mode": "0700",
-      "place": "."
-    },
    {
      "id": "data",
      "type": "directory",
+      "path": "/services/nodered/data",
      "mode": "0700",
      "owner": "1000:1000"
    },
-    {
-      "id": "settings-code",
-      "type": "file",
-      "path": "${dir:state}/settings.js",
-      "mode": "0600",
-      "owner": "1000:1000",
-      "content": "// Node-RED's settings, written by the mesh from the nodered module. What an assignment may change\n// is settings.json beside this file (merged key by key); the credentials are the mesh's secrets and\n// reach Node-RED only through this file. The flows' own credentials stay encrypted in the user\n// directory under the key Node-RED keeps there (.config.runtime.json), which is data, not this.\nconst fs = require(\"fs\");\nconst path = require(\"path\");\nconst crypto = require(\"crypto\");\n\nconst ADMIN_PASSWORD = \"${secret:admin}\";\nconst API_TOKEN = \"${secret:api-token}\";\nconst ADMIN = { username: \"admin\", permissions: \"*\" };\n\nconst settings = JSON.parse(fs.readFileSync(path.join(__dirname, \"settings.json\"), \"utf8\"));\n// The mesh's keys, not Node-RED's: endpoints lands in every merged file; timeZone is the\n// assignment's way to set the zone flows schedule and format in.\nif (settings.timeZone) process.env.TZ = settings.timeZone;\ndelete settings.timeZone;\ndelete settings.endpoints;\n\nfunction same(a, b) {\n  const x = crypto.createHash(\"sha256\").update(String(a)).digest();\n  const y = crypto.createHash(\"sha256\").update(String(b)).digest();\n  return crypto.timingSafeEqual(x, y);\n}\n\n// The admin secret is a password, or, accepted from an existing install, the bcrypt hash its\n// settings held, so the password people already use keeps working.\nfunction passwordMatches(given) {\n  if (/^\\$2[aby]\\$\\d\\d\\$/.test(ADMIN_PASSWORD)) return require(\"bcryptjs\").compare(String(given), ADMIN_PASSWORD);\n  return Promise.resolve(same(given, ADMIN_PASSWORD));\n}\n\nmodule.exports = Object.assign(settings, {\n  uiPort: 1880,\n  adminAuth: {\n    type: \"credentials\",\n    users: (username) => Promise.resolve(username === ADMIN.username ? ADMIN : null),\n    authenticate: (username, password) =>\n      username === ADMIN.username\n        ? passwordMatches(password).then((ok) => (ok ? ADMIN : null))\n        : Promise.resolve(null),\n    // The module's own tools call the admin API with this bearer token.\n    tokens: (token) => Promise.resolve(same(token, API_TOKEN) ? { username: \"mesh\", permissions: \"*\" } : null),\n  },\n});\n"
-    },
-    {
-      "id": "settings",
-      "type": "file",
-      "path": "${dir:state}/settings.json",
-      "mode": "0600",
-      "owner": "1000:1000",
-      "merge": "json",
-      "content": "{\n  \"flowFile\": \"flows.json\",\n  \"flowFilePretty\": true,\n  \"diagnostics\": { \"enabled\": true, \"ui\": true },\n  \"runtimeState\": { \"enabled\": false, \"ui\": false },\n  \"logging\": { \"console\": { \"level\": \"info\", \"metrics\": false, \"audit\": false } },\n  \"exportGlobalContextKeys\": false,\n  \"externalModules\": {},\n  \"editorTheme\": { \"projects\": { \"enabled\": false } },\n  \"functionExternalModules\": true,\n  \"debugMaxLength\": 1000,\n  \"mqttReconnectTime\": 15000,\n  \"serialReconnectTime\": 15000\n}\n"
-    },
    {
      "id": "server",
      "type": "container",
      "name": "nodered",
-      "image": "nodered/node-red@sha256:a649dd711d55490151a2c39a8e48ad0c44325488fbc0e66315f2d2e19e5e1ace",
+      "image": "nodered/node-red@sha256:02a2b92a41b73d2bc388238b86e4fcaab7fb5466373adb24e1df6aa5845265ff",
      "env": {
        "TZ": "Etc/UTC"
      },
      "ports": [
        "1880"
      ],
-      "args": [
-        "--settings",
-        "/config/settings.js"
-      ],
      "volumes": [
-        "${dir:data}:/data",
-        "${dir:state}/settings.js:/config/settings.js:ro",
-        "${dir:state}/settings.json:/config/settings.json:ro"
-      ],
-      "restart-on": [
-        "settings-code",
-        "settings"
+        "/services/nodered/data:/data"
      ]
    },
    {
@@ -87,7 +53,8 @@
      "type": "file",
      "path": "/var/lib/mesh/nodered/config.json",
      "mode": "0600",
-      "content": "{\n  \"token\": \"${secret:api-token}\"\n}\n"
+      "content": "{}\n",
+      "merge": "json"
    },
    {
      "id": "runtime",
@@ -100,7 +67,7 @@
      ],
      "env": {
        "MESH_BROKER_FILE": "/run/secrets/broker",
-        "MESH_NODERED_URL": "http://127.0.0.1:${port:1880}",
+        "MESH_NODERED_URL": "http://127.0.0.1:1880",
        "MESH_NODERED_CONFIG_FILE": "/run/config/config.json"
      },
      "restart-on": [
@@ -119,7 +86,7 @@
    }
  },
  "binds": {
-    "route": "${dir:state}/route.json"
+    "route": "/var/lib/mesh/nodered/route.json"
  },
  "build": {
    "on": [