🚧 Add CA and server cert management

compose.yaml

@@ -57,6 +57,9 @@ services:
       - mosquitto_config:/mosquitto/config
       - mosquitto_data:/mosquitto/data
       - mosquitto_log:/mosquitto/log
+      # Shared PKI material (spec §6): backend writes decrypted cert/key
+      # files here before a TLS config deploy; the broker reads them.
+      - mosquitto_certs:/mosquitto/certs
     networks:
       - backend-net
     ports:
@@ -120,8 +123,14 @@ services:
         condition: service_healthy
     environment:
       <<: *backend-env
+      # Where the backend publishes cert/key files for the broker (spec §6).
+      MOSQUITTO_CERTS_DIR: /mosquitto/certs
     volumes:
       - backend_data:/data
+      # Same volume the broker mounts at /mosquitto/certs — the deploy
+      # pipeline writes decrypted PEM files here (spec §29: files, not
+      # sockets).
+      - mosquitto_certs:/mosquitto/certs
     networks:
       - frontend-net
       - backend-net
@@ -157,6 +166,7 @@ volumes:
   mosquitto_config:
   mosquitto_data:
   mosquitto_log:
+  mosquitto_certs:
   backend_data:
 
 networks: