RyanandClaude Sonnet 5.5
37ca9d4da1
The server deployment cannot mount the Docker socket safely, so the web view's button now opens the Gitea page for a workflow_dispatch workflow that recreates the stack and replays the demo. Gitea handles who may run it. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
31 lines
1.7 KiB
Markdown
31 lines
1.7 KiB
Markdown
# mqtt-security-test
|
|
|
|
Prototype of secure board enrollment over MQTT: a Go backend and two simulated boards (C with
|
|
libsodium, C++ with OpenSSL) talk through a real Mosquitto 2.1 broker with Dynamic Security, using an
|
|
X25519 key agreement so the broker password is never transmitted.
|
|
|
|
- **[DEMO.md](DEMO.md)**: what the demo is, what it does and the 19 checks each board performs.
|
|
- **[docker/README.md](docker/README.md)**: how to run it and read the web view.
|
|
- `go/`, `c/`, `c-libsodium/`, `cpp/`, `run.sh`, `run-libsodium.sh`: fixed-key programs that check the
|
|
crypto libraries against the RFC test vectors and against each other.
|
|
|
|
## Run locally
|
|
|
|
```bash
|
|
cd docker && ./run-docker.sh # web view on http://localhost:8099, with the "Run again" button
|
|
```
|
|
|
|
## Deployment
|
|
|
|
Every push to `main` runs `.gitea/workflows/deploy.yml` on the Gitea runner: it validates the compose
|
|
files, builds all images, redeploys the stack on the server's Docker daemon with the web view published on
|
|
**port 8099** (`http://<server-ip>:8099`) and fails unless both boards pass all checks.
|
|
The public web view cannot restart anything itself (that would need the Docker socket). Its **"Run again (via Gitea)"**
|
|
button opens the Gitea Actions page for `.gitea/workflows/restart.yml`; run that workflow there ("Run workflow") to replay
|
|
the whole demo on the server without rebuilding. Only people with access to the repository can do that. To run a stack
|
|
locally with a self-contained button instead, use `docker/run-docker.sh` (it adds `docker/compose.restart.yaml`, which
|
|
mounts the Docker socket: local use only).
|
|
|
|
The compose file contains **demo secrets** (broker and service passwords, a signing seed) that protect nothing
|
|
real. Do not reuse them anywhere else.
|