refactor(mosquitto): split mosquitto out of home-assistant config

2021-12-12 19:20:31 +01:00 · 2021-12-12 19:20:31 +01:00 · 48f9a63794
commit 48f9a63794
parent 4211fceda9
3 changed files with 78 additions and 70 deletions
--- a/services/mosquitto.nix
+++ b/services/mosquitto.nix
@ -0,0 +1,64 @@
+{ config, pkgs, ... }:
+
+with pkgs;
+
+let
+  host = "mqtt.felschr.com";
+  port = 1883;
+  wsPort = 9001;
+in {
+  services.nginx = {
+    virtualHosts."${mqttHost}" = {
+      serverAliases = [ "mqtt.home.felschr.com" ];
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://localhost:${toString wsPort}";
+        proxyWebsockets = true;
+      };
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ port ];
+
+  services.mosquitto = {
+    enable = true;
+    listeners = [
+      {
+        port = port;
+        users = {
+          "hass" = {
+            acl = [
+              "readwrite homeassistant/#"
+              "readwrite tasmota/#"
+              "readwrite owntracks/#"
+            ];
+            hashedPasswordFile = "/etc/nixos/secrets/mqtt/hass";
+          };
+          "tasmota" = {
+            acl = [ "readwrite tasmota/#" "readwrite homeassistant/#" ];
+            hashedPasswordFile = "/etc/nixos/secrets/mqtt/tasmota";
+          };
+          "owntracks" = {
+            acl = [ "readwrite owntracks/#" ];
+            hashedPasswordFile = "/etc/nixos/secrets/mqtt/owntracks";
+          };
+        };
+      }
+      {
+        port = wsPort;
+        settings.protocol = "websockets";
+        users = {
+          "felix" = {
+            acl = [ "read owntracks/#" "readwrite owntracks/felix/#" ];
+            hashedPasswordFile = "/etc/nixos/secrets/mqtt/felix";
+          };
+          "birgit" = {
+            acl = [ "read owntracks/#" "readwrite owntracks/birgit/#" ];
+            hashedPasswordFile = "/etc/nixos/secrets/mqtt/birgit";
+          };
+        };
+      }
+    ];
+  };
+}