broad-announce/deploy/emqx

EMQX M4 deployment

This directory is mounted into the emqx container.

Files

• auth-built-in-db-bootstrap.csv — read once on first EMQX boot. No comments, no empty lines — the EMQX CSV parser rejects both with bad_format. Username format: <source_id>-<company_id> for sources, ingestd for the subscriber. Password == HMAC secret so the same secret serves as both MQTT auth and per-message HMAC.

• acl.conf — Erlang-term ACL rules. Re-read on EMQX SIGHUP. Each user can only publish to its own ba/<company>/<source>/incoming. ingestd can subscribe to ba/+/+/incoming. Default deny on #.

Auth additions after first boot

The CSV is one-shot. To add a new source after first boot, use the EMQX HTTP API:

curl -X POST -u admin:public http://emqx:18083/api/v5/authentication/1/users \
  -H "Content-Type: application/json" \
  -d '{"user_id":"newsrc-co123","password":"<hmac-secret>","is_superuser":false}'

(M11 will swap this for a Postgres-backed chain that reads the sources table directly.)

Config

Auth + ACL chains are configured via env vars on the emqx service in docker-compose.yml (search EMQX_AUTHENTICATION__ and EMQX_AUTHORIZATION__). Env vars beat emqx.conf in precedence and let us keep the volume mounts to just acl.conf + the CSV.