Codex
30 lines
1.0 KiB
Plaintext
30 lines
1.0 KiB
Plaintext
%% Qipai EMQX ACL for the selected Jilian device protocol.
|
|
%% EMQX ACL files use Erlang tuple rules and are matched from top to bottom.
|
|
%% Device MQTT username must equal its DeviceID. Credentials are created outside Git.
|
|
|
|
%% A device may publish only its uplink and will topics.
|
|
{allow, {clientid, {re, "^qipai-device-[A-Za-z0-9_-]+$"}}, publish, [
|
|
"/devicesend/${username}",
|
|
"/devicewill/${username}"
|
|
]}.
|
|
|
|
%% A device may subscribe only to its command topic.
|
|
{allow, {clientid, {re, "^qipai-device-[A-Za-z0-9_-]+$"}}, subscribe, [
|
|
"/deviceaccept/${username}"
|
|
]}.
|
|
|
|
%% Backend service subscribes to uplink/will and publishes commands.
|
|
{allow, {username, "qipai_backend_prod"}, subscribe, [
|
|
"/devicesend/+",
|
|
"/devicewill/+"
|
|
]}.
|
|
{allow, {username, "qipai_backend_prod"}, publish, [
|
|
"/deviceaccept/+"
|
|
]}.
|
|
|
|
%% Do not expose system topics or broad wildcards to ordinary clients.
|
|
{deny, all, subscribe, ["$SYS/#", {eq, "#"}, {eq, "+/#"}]}.
|
|
|
|
%% Production default: deny anything not explicitly allowed above.
|
|
{deny, all}.
|