#!/bin/sh
# Demo broker start-up. Dynamic Security state is recreated on every start so each run begins clean:
# `dynsec init` writes a config containing a single admin client ("backend") that may only manage the
# plugin. The backend then creates every other role and client over MQTT.
set -e
mkdir -p /mosquitto/data
rm -f /mosquitto/data/dynamic-security.json
mosquitto_ctrl dynsec init /mosquitto/data/dynamic-security.json backend "$ADMIN_PASSWORD" >/dev/null
chown -R mosquitto:mosquitto /mosquitto/data
echo "[broker] dynamic security initialised; starting mosquitto (anonymous clients allowed, ACLs via dynsec)"
exec mosquitto -c /mosquitto/config/mosquitto.conf