🚧 WIP

mosquitto/Dockerfile

@@ -0,0 +1,14 @@
+# Broker image: pinned upstream base + the platform bootstrap config.
+#
+# Why bake the config in instead of bind-mounting or entrypoint-copying:
+#   * A FRESH mosquitto_config volume gets seeded from the IMAGE content
+#     (Docker copy-up) — so first boot starts with OUR dynsec-enabled
+#     config, not the stock anonymous one.
+#   * Once the volume has content (bootstrap or deployed revisions), the
+#     image never touches it again — control-sidecar deploys survive
+#     restarts and image rebuilds.
+#   * Bind-mounting the active file would break the control sidecar's
+#     atomic os.replace() activation on deploy.
+FROM eclipse-mosquitto:2.1.2-alpine
+
+COPY bootstrap/mosquitto.conf /mosquitto/config/mosquitto.conf

mosquitto/bootstrap/mosquitto.conf

@@ -10,8 +10,8 @@
 #
 # NOTE (2.1 deprecations, spec §3.1): we use `plugin`/`global_plugin`,
 # NOT the deprecated password_file/acl_file/per_listener_settings options.
-
-per_listener_settings false
+# Default auth behaviour in 2.x is already global (per_listener_settings
+# is unset), so nothing is lost by omitting it here.
 
 # --- Internal management listener (backend-net only) ---
 # Plaintext is acceptable here because the network is isolated and the