|
 |
0b0750 |
# MQTT scripts
|
|
|
0b0750 |
|
|
|
0b0750 |
The mqtt.git.centos.org server requires authentication. As a result we've provided some client server scripts that will let you protect your keys.
|
|
|
0b0750 |
|
|
|
0b0750 |
These can also be used as a basis for building your own MQTT automation scripts.
|
|
|
0b0750 |
|
|
|
0b0750 |
## Scripts:
|
|
|
0b0750 |
|
|
|
0b0750 |
* send-mqtt-to-dbus.py - Connects the MQTT messages to a dbus interface.
|
|
|
0b0750 |
To fully protect your keys you can setup the system bus (a config is provided by --dbus-config)
|
|
|
0b0750 |
Then you can have this run as a dedicated user that has access to your keys.
|
|
|
0b0750 |
See the `on_mqtt_connect` and `on_mqtt_message` functions for customizing the behavior.
|
|
|
0b0750 |
|
|
|
0b0750 |
* listen-on-dbus-for-mqtt-signals.py - Listens to messages sent to dbus and performs an action.
|
|
|
0b0750 |
You can set this to run a generic command or customize it to fit your needs.
|
|
|
0b0750 |
See the `signal_recieved` function for customizing the behavior.
|
|
|
0b0750 |
|
|
|
0b0750 |
* example-safe-command.py - It is an example of how to run a command from listen-on-dbus-for-mqtt-signals.py
|
|
|
0b0750 |
|
|
|
0b0750 |
* send-mqtt-to-irc.py - An untested IRC bot that will (in theory) chat out the messages.
|
|
|
0b0750 |
|
|
|
0b0750 |
## Systemd Unit:
|
|
|
0b0750 |
|
|
|
0b0750 |
Some sample systemd unit files are provided to work with the example scripts.
|
|
|
0b0750 |
|
|
|
0b0750 |
NOTE: They require customization before use.
|
|
|
0b0750 |
You must at minimum set the User= to a trusted user.
|
|
|
0b0750 |
|
|
|
0b0750 |
* listen-on-dbus-for-mqtt-signals.service
|
|
|
0b0750 |
You should adjust the path of commands and select a safe command to execute.
|
|
|
0b0750 |
|
|
|
0b0750 |
* send-mqtt-to-dbus.service
|
|
|
0b0750 |
You should setup the system dbus profile with --dbus-config
|
|
|
0b0750 |
|
|
|
0b0750 |
## Container notes:
|
|
|
0b0750 |
|
|
|
0b0750 |
It is _not_ considered safe to share the host dbus (system or session) with a container. This can permit the container to escape into the host and violate the security of your system.
|
|
|
0b0750 |
|
|
|
0b0750 |
For example, here is how you can reboot a host from dbus if you've got rights.
|
|
|
0b0750 |
```
|
|
|
0b0750 |
DBUS_SYSTEM_BUS_ADDRESS=unix:path=/run/dbus/system_bus_socket \
|
|
|
0b0750 |
dbus-send --system --print-reply \
|
|
|
0b0750 |
--dest=org.freedesktop.systemd1 \
|
|
|
0b0750 |
/org/freedesktop/systemd1 \
|
|
|
0b0750 |
org.freedesktop.systemd1.Manager.Reboot
|
|
|
0b0750 |
```
|