# EMQX M4 deployment

This directory is mounted into the `emqx` container.

## Files

- `auth-built-in-db-bootstrap.csv` — read once on first EMQX
  boot. **No comments, no empty lines** — the EMQX CSV parser
  rejects both with `bad_format`. Username format:
  `<source_id>-<company_id>` for sources, `ingestd` for the
  subscriber. Password == HMAC secret so the same secret
  serves as both MQTT auth and per-message HMAC.

- `acl.conf` — Erlang-term ACL rules. Re-read on EMQX SIGHUP.
  Each user can only publish to its own
  `ba/<company>/<source>/incoming`. `ingestd` can subscribe
  to `ba/+/+/incoming`. Default deny on `#`.

## Auth additions after first boot

The CSV is one-shot. To add a new source after first boot, use
the EMQX HTTP API:

```bash
curl -X POST -u admin:public http://emqx:18083/api/v5/authentication/1/users \
  -H "Content-Type: application/json" \
  -d '{"user_id":"newsrc-co123","password":"<hmac-secret>","is_superuser":false}'
```

(M11 will swap this for a Postgres-backed chain that reads
the `sources` table directly.)

## Config

Auth + ACL chains are configured via env vars on the
`emqx` service in `docker-compose.yml` (search
`EMQX_AUTHENTICATION__` and `EMQX_AUTHORIZATION__`). Env vars
beat `emqx.conf` in precedence and let us keep the volume
mounts to just `acl.conf` + the CSV.