Add MQTT enrollment demo with Gitea deploy pipeline

Go backend plus C (libsodium) and C++ (OpenSSL) simulated boards enroll through a Mosquitto 2.1 broker with Dynamic Security using X25519/HKDF/ Ed25519; a web view shows the run live. The Gitea workflow validates and builds the images, redeploys the stack on the server with the viewer on port 8099 and fails unless both boards pass all checks. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-10-24 21:25:14 +03:30
commit bf40b92c52
109 changed files with 15357 additions and 0 deletions
@@ -0,0 +1,28 @@
+# mqtt-security-test
+
+Prototype of secure board enrollment over MQTT: a Go backend and two simulated boards (C with
+libsodium, C++ with OpenSSL) talk through a real Mosquitto 2.1 broker with Dynamic Security, using an
+X25519 key agreement so the broker password is never transmitted.
+
+- **[DEMO.md](DEMO.md)**: what the demo is, what it does and the 19 checks each board performs.
+- **[docker/README.md](docker/README.md)**: how to run it and read the web view.
+- `go/`, `c/`, `c-libsodium/`, `cpp/`, `run.sh`, `run-libsodium.sh`: fixed-key programs that check the
+  crypto libraries against the RFC test vectors and against each other.
+
+## Run locally
+
+```bash
+cd docker && ./run-docker.sh      # web view on http://localhost:8099, with the "Run again" button
+```
+
+## Deployment
+
+Every push to `main` runs `.gitea/workflows/deploy.yml` on the Gitea runner: it validates the compose
+files, builds all images, redeploys the stack on the server's Docker daemon with the web view published on
+**port 8099** (`http://<server-ip>:8099`) and fails unless both boards pass all checks.
+The public deployment has no "Run again" button, because that needs the Docker socket; to replay the run,
+start the workflow manually (Actions, "Run workflow"). To run the server stack with the button anyway,
+add `-f docker/compose.restart.yaml` and understand it gives the viewer control of Docker on the host.
+
+The compose file contains **demo secrets** (broker and service passwords, a signing seed) that protect nothing
+real. Do not reuse them anywhere else.