2 Commits

Include renames

Author	SHA1	Message	Date
Naeel	b23ae40975	security(iot): MQTT ACL isolation via EMQX HTTP authorization ... Each IoT device can only pub/sub to its own topics: {namespace}/{deviceId}/# Any attempt to access foreign topics → EMQX denies and disconnects. Changes: - internal/api/handler: add MQTTAcl handler (POST /internal/mqtt/acl) - internal/api/router: register /internal/mqtt/acl route - deployments/k8s/emqx.yaml: add HTTP authorization backend, no_match=deny - Operator v0.1.52 deployed Tested: own topic ALLOWED, foreign topic → authorization_permission_denied + disconnect	2026-04-04 17:51:51 +03:00
Naeel	6e3e473551	feat(iot): MQTT over WebSocket workaround via nginx-ingress ... Port 1883 blocked by NSX-T Edge firewall (DevOps to open on Monday). Temporary solution: EMQX WebSocket listener (8083) via nginx-ingress. - Service emqx-ws: selector app=emqx, port 8083 - Ingress emqx-mqtt-websocket: iot.kube5s.ru/mqtt → emqx-ws:8083 - pathType: Exact (prevents trailing slash redirect breaking WS handshake) - ssl-redirect: false (IoT devices cannot follow HTTP 301 redirects) - DNS A record iot.kube5s.ru → 185.247.187.147 created by user Tested: Connected rc=0 via paho-mqtt WebSocket from inside cluster.	2026-04-04 14:06:17 +03:00