When Quicksetup configures a system, we create a mo

output (no default for a user, which is good) <div class="snippet-clipboard-con

User-specific MQTT ACLs? about quicksetup HOT 3 CLOSED

owntracks commented on June 24, 2024

User-specific MQTT ACLs?

from quicksetup.

Comments (3)

jpmens commented on June 24, 2024 1

I have changed my mind about the dynamic security plugin for Quicksetup: far too complex, not necessarily for us, but if we'd have to support the resulting configuration.

We might be able to simplify with some Ansible/Jinja templating which picks up specific user files and inserts them into the ACL where they belong.

from quicksetup.

jpmens commented on June 24, 2024

This looks okay, using only Jinja templating:

main acl template

----
{% for f in friends %}
# main: user={{ f.username }}
{% set fragment = "t/" + f.username + ".acl" %}
{% include fragment ignore missing %}
{% endfor %}
----

fragment `t/jjolie.acl`

# --begin special for jjolie
topic read owntracks/jpmens/5s
topic read $SYS/#
# --end  special for jjolie

output

----
# main: user=jane
# main: user=ck
# main: user=ck00
# main: user=bbb
# main: user=ccc
# main: user=jip
# main: user=jjolie
# --begin special for jjolie
topic read owntracks/jpmens/5s
topic read $SYS/#
# --end  special for jjolie# main: user=iris
# main: user=iris
# main: user=iris
# main: user=andie
# main: user=huawei
# main: user=simu
# main: user=simu
----

from quicksetup.

jpmens commented on June 24, 2024

output (no default for a user, which is good)

user jip
topic readwrite owntracks/jip/#
topic read owntracks/+/+
topic read owntracks/+/+/event
topic read owntracks/+/+/info

# --begin special for jjolie
topic read owntracks/jpmens/5s
topic read $SYS/#
# --end  special for jjolie


user iris
topic readwrite owntracks/iris/#
topic read owntracks/+/+
topic read owntracks/+/+/event
topic read owntracks/+/+/info

template

{% for f in friends %}
{{ f.username | mqtt_acl() }}
{% endfor %}

new filter function

This filter tests if a fragement file for the specified username exists; if so it is read in, otherwise a default ACL for the particular user is emitted.

from ansible.errors import AnsibleFilterError
from string import Template
import os

def mqtt_acl(username):

    acl = """
user $U
topic readwrite owntracks/$U/#
topic read owntracks/+/+
topic read owntracks/+/+/event
topic read owntracks/+/+/info
"""


    path = os.path.join("t", "%s.acl" % username)
    if os.path.exists(path):
        with open(path, "r") as f:
            acl = f.read()
            return acl

    return Template(acl).safe_substitute(U=username)

class FilterModule(object):
    def filters(self):
        return {
            'mqtt_acl': mqtt_acl,
        }