🚧 WIP

compose.yaml

@@ -38,7 +38,13 @@ services:
       retries: 12
 
   mosquitto:
-    image: eclipse-mosquitto:2.1.2-alpine
+    # Broker image = pinned base (eclipse-mosquitto:2.1.2-alpine, pinned
+    # inside mosquitto/Dockerfile) with our bootstrap config BAKED IN.
+    # Docker's copy-up then seeds a fresh mosquitto_config volume with
+    # OUR dynsec-enabled config instead of the stock anonymous one;
+    # existing volumes (holding deployed revisions) are never touched.
+    build:
+      context: ./mosquitto
     restart: unless-stopped
     # Spec §29: no docker.sock. Control sidecar shares the broker's PID namespace
     # and the mosquitto_config volume; it signals PID 1 (the broker) directly.
@@ -55,14 +61,17 @@ services:
     # Release 1 ships an internal-only, plaintext listener on the backend
       # network for the management channel; production listeners are added
       # through the platform (spec §60). Nothing is published to the host.
-    # Healthcheck: dynsec denies anonymous clients, so we must connect as
-    # the seeded 'admin' (password from env, $$ = escaped for compose).
+    # Healthcheck: a REAL dynamic-security roundtrip via mosquitto_ctrl —
+    # proves broker up + dynsec plugin loaded + admin auth works, exactly
+    # what the backend depends on. NOT a $SYS probe: the 2.1 auto-generated
+    # admin role set does not guarantee $SYS read access.
+    # ($$ escapes compose interpolation; resolved inside the container.)
     healthcheck:
-      test: ["CMD-SHELL", "mosquitto_sub -h 127.0.0.1 -u admin -P \"$$MOSQUITTO_DYNSEC_PASSWORD\" -t '$$SYS/broker/version' -C 1 -W 3 >/dev/null 2>&1"]
+      test: ["CMD-SHELL", "mosquitto_ctrl -h 127.0.0.1 -u admin -P \"$$MOSQUITTO_DYNSEC_PASSWORD\" dynsec listClients >/dev/null 2>&1"]
       interval: 10s
       timeout: 5s
       retries: 12
-      start_period: 10s
+      start_period: 15s
 
   mosquitto-control:
     build: