mirror of https://github.com/grafana/grafana
Alerting: Add TLS, QoS and retain options to the MQTT receiver (#92331)
Alexander Akhmetov
9 months ago
committed by
GitHub
parent
b52e6ba552
commit
e59ea00518
@ -0,0 +1,31 @@ |
||||
# NanoMQ MQTT broker |
||||
|
||||
Starts a [NanoMQ MQTT broker](https://nanomq.io/docs/en/latest/). |
||||
|
||||
## Authentication |
||||
|
||||
The broker is configured to use a simple username/password authentication. |
||||
See [./nanomq_pwd.conf](./nanomq_pwd.conf) for the default credentials. |
||||
|
||||
## TLS Certificates |
||||
|
||||
If you want to configure an MQTT contact point in Grafana Alerting with TLS, you need to provide a certificate and key. |
||||
|
||||
You can find them in `/etc/certs` directory in the container: |
||||
|
||||
``` shell |
||||
docker exec devenv-mqtt-1 ls /etc/certs/ |
||||
``` |
||||
|
||||
### CA Certificate |
||||
|
||||
``` shell |
||||
docker exec devenv-mqtt-1 cat /etc/certs/ca.pem |
||||
``` |
||||
|
||||
### Client certificates |
||||
|
||||
``` shell |
||||
docker exec devenv-mqtt-1 cat /etc/certs/client.pem |
||||
docker exec devenv-mqtt-1 cat /etc/certs/client.key |
||||
``` |
||||
@ -0,0 +1,9 @@ |
||||
FROM emqx/nanomq:0.21.11-full |
||||
|
||||
RUN apt-get update && apt-get install -y \ |
||||
openssl \ |
||||
&& rm -rf /var/lib/apt/lists/* |
||||
|
||||
COPY ./san.cnf /etc/certs/san.cnf |
||||
COPY ./gen_certs.sh /etc/certs/gen_certs.sh |
||||
RUN /etc/certs/gen_certs.sh |
||||
@ -0,0 +1,18 @@ |
||||
#!/bin/bash |
||||
|
||||
DAYS_VALID=3650 |
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" |
||||
|
||||
# Create CA certificate |
||||
openssl genpkey -algorithm RSA -out "$SCRIPT_DIR/ca.key" |
||||
openssl req -new -x509 -days $DAYS_VALID -key "$SCRIPT_DIR/ca.key" -out "$SCRIPT_DIR/ca.pem" -subj "/CN=My CA" |
||||
|
||||
# Create server certificate |
||||
openssl genpkey -algorithm RSA -out "$SCRIPT_DIR/server.key" |
||||
openssl req -new -key "$SCRIPT_DIR/server.key" -out "$SCRIPT_DIR/server.csr" -subj "/CN=localhost" |
||||
openssl x509 -req -days $DAYS_VALID -in "$SCRIPT_DIR/server.csr" -CA "$SCRIPT_DIR/ca.pem" -CAkey "$SCRIPT_DIR/ca.key" -CAcreateserial -out "$SCRIPT_DIR/server.pem" -extfile "$SCRIPT_DIR/san.cnf" -extensions v3_req |
||||
|
||||
# Create client key and certificate |
||||
openssl genpkey -algorithm RSA -out "$SCRIPT_DIR/client.key" |
||||
openssl req -new -key "$SCRIPT_DIR/client.key" -out "$SCRIPT_DIR/client.csr" -subj "/CN=Client" |
||||
openssl x509 -req -days $DAYS_VALID -in "$SCRIPT_DIR/client.csr" -CA "$SCRIPT_DIR/ca.pem" -CAkey "$SCRIPT_DIR/ca.key" -CAcreateserial -out "$SCRIPT_DIR/client.pem" -extfile "$SCRIPT_DIR/san.cnf" -extensions v3_req |
||||
@ -0,0 +1,7 @@ |
||||
[ v3_req ] |
||||
subjectAltName = @alt_names |
||||
|
||||
[ alt_names ] |
||||
DNS.1 = localhost |
||||
IP.1 = 127.0.0.1 |
||||
IP.2 = ::1 |
||||
@ -0,0 +1,12 @@ |
||||
mqtt: |
||||
build: |
||||
context: docker/blocks/mqtt/build |
||||
ports: |
||||
- "127.0.0.1:1883:1883" # MQTT |
||||
- "127.0.0.1:8883:8883" # MQTT over TLS |
||||
- "127.0.0.1:8083:8083" # MQTT over WS |
||||
- "127.0.0.1:8443:8443" # MQTT over WSS |
||||
volumes: |
||||
- ${PWD}/docker/blocks/mqtt/nanomq.conf:/etc/nanomq.conf |
||||
- ${PWD}/docker/blocks/mqtt/nanomq_pwd.conf:/etc/nanomq_pwd.conf |
||||
- ${PWD}/docker/blocks/mqtt/nanomq_acl.conf:/etc/nanomq_acl.conf |
||||
@ -0,0 +1,40 @@ |
||||
log { |
||||
to=console |
||||
level=info |
||||
} |
||||
|
||||
listeners.tcp { |
||||
bind = "0.0.0.0:1883" |
||||
} |
||||
|
||||
|
||||
listeners.ssl { |
||||
bind = "0.0.0.0:8883" |
||||
|
||||
keyfile = "/etc/certs/server.key" |
||||
certfile = "/etc/certs/server.pem" |
||||
cacertfile = "/etc/certs/ca.pem" |
||||
|
||||
# Change these settings to true if you want to deny |
||||
# access for clients that don't have a certificate. |
||||
verify_peer = false |
||||
fail_if_no_peer_cert = false |
||||
} |
||||
|
||||
listeners.ws { |
||||
bind = "0.0.0.0:8083" |
||||
} |
||||
|
||||
listeners.wss { |
||||
bind = "0.0.0.0:8443" |
||||
} |
||||
|
||||
auth { |
||||
allow_anonymous = false |
||||
no_match = deny |
||||
deny_action = disconnect |
||||
password = {include "/etc/nanomq_pwd.conf"} |
||||
acl = { |
||||
include "/etc/nanomq_acl.conf" |
||||
} |
||||
} |
||||
@ -0,0 +1,7 @@ |
||||
rules = [ |
||||
{"permit": "allow", "username": "grafana", "action": "subscribe", "topics": ["#"]} |
||||
{"permit": "allow", "username": "grafana", "action": "publish", "topics": ["#"]} |
||||
{"permit": "allow", "username": "admin", "action": "subscribe", "topics": ["#"]} |
||||
{"permit": "allow", "username": "admin", "action": "publish", "topics": ["#"]} |
||||
{"permit": "deny"} |
||||
] |
||||
@ -0,0 +1,2 @@ |
||||
admin:admin |
||||
grafana:grafana |
||||
Loading…
Reference in new issue