🚧 WIP

2026-09-19 09:40:24 +02:00
parent ee4800993d
commit 19bccce083
13 changed files with 435 additions and 43 deletions
@@ -130,13 +130,18 @@ def _post_broker_health() -> bool:
    Uses mosquitto_ctrl rather than a $SYS subscription, because the 2.1
    auto-generated admin role set is not guaranteed to include $SYS read
    access — but it must always be able to administer dynamic security.
+
+    NOTE: this sidecar shares the broker's PID namespace but NOT its
+    network namespace — 127.0.0.1 here is the SIDECAR's loopback, where
+    nothing listens. The broker is reached via Docker DNS ("mosquitto")
+    on the backend-net network.
    """
    username = os.environ.get("MOSQUITTO_DYNSEC_USERNAME", "admin")
    token_pw = os.environ.get("MOSQUITTO_DYNSEC_PASSWORD", "")
    cmd = [
        "mosquitto_ctrl",
        "-h",
-        "127.0.0.1",
+        "mosquitto",
        "-u",
        username,
        "-P",