Trying my hand at mqtt bridging and failing, any help out there?

[ovizii]

geopulse fully working, using OwnTracks on my Android phone. traefik terminates TLS on port 8883.

Now I was trying to get mosquitto running on my HA instance to bridge to geopulse's mosquitto and subscribe to my phone's topic.

# Bridge to Geopulse broker
connection homeassistant
address mqtt.dom.tld:8883
topic owntracks/geopulse_source_user/DeviceID in 0
remote_username geopulse_source_user
remote_password geopulse_source_password
remote_clientid HA-bridge-owntracks  # unique ID for this bridge
try_private false
start_type automatic
notifications true
cleansession true
log_type information  # debug, error, warning, notice, information, subscribe, unsubscribe, websockets, none, all
bridge_protocol_version mqttv311
bridge_insecure true # tried this true/false, no such luck

remote_username and remote_password are set to the same OwnTracks on my phone uses. I don't see why the connection doesn't work or is this user only allowed to publish, but not to subscribe?

DeviceID is the DeviceID I chose in my the OwnTracks configuration.

I also tried subscribing to all devices of my user but that also failed:

topic owntracks/geopulse_source_user/ in 0

The example OwnTrack gives for bridges, looks just like mine: https://owntracks.org/booklet/guide/bridge/

[tess1o]

Geopulse has the following MQTT settings (default values):

GEOPULSE_MQTT_ENABLED=false
GEOPULSE_MQTT_BROKER_HOST=geopulse-mosquitto
GEOPULSE_MQTT_BROKER_PORT=1883
GEOPULSE_MQTT_USERNAME=geopulse_mqtt_admin
GEOPULSE_MQTT_PASSWORD=change-this-mqtt-admin-password

GEOPULSE_MQTT_USERNAME user here is used by geopulse-backend to connect to mosquitto and consume all topics. When geopulse-mosquitto container is created we add this user to list of admins:

https://github.com/tess1o/geopulse/blob/main/mosquitto_entrypoint.sh#L106

    # Create the admin user file in format user:password_hash
    echo "$GEOPULSE_MQTT_USERNAME:$ADMIN_PASSWORD_HASH" > "$ADMIN_USER_FILE"

    # --- Generate Admin ACL File ---
    echo "3. Generating admin ACL file at $ADMIN_ACL_FILE..."
    
    # Grant full permissions to admin user (# means all topics)
    cat > "$ADMIN_ACL_FILE" << EOF
user $GEOPULSE_MQTT_USERNAME
topic readwrite #

This is a superuser who can read any topic and it's used by geopulse-backend only. Regular users should use different user and configure it in OwnTracks + GeoPulse UI.

On the other hand each user can create their Location Source configuration (/app/location-sources) and use that username/password in OwnTrack app on their mobile phones. Such users have access only to their topic. ACL (access control list) is configured via geopulse-postgres database (that's why the changes are applied immediately when you create new config, edit password, etc).
Such users (which you configure in OwnTracks app) have access only to topic owntracks/YOUR_USER/+.

See configuration: https://github.com/tess1o/geopulse/blob/main/mosquitto_entrypoint.sh#L69

I hope it clear things out and helps you to figure out how to do the configuration.

Thanks.

[ovizii]

Thanks for all that help. I had obviously taken a look at all local config files and was trying to avoid using the geopulse_mqtt_admin since as you also explained, we can use the user we created for a Location Source to subscribe to its own topic.

The missing point for me was that I did not supply this option top my bridge: bridge_capath /etc/ssl/certs

I had successful connected with MQTT explorer, but the same settings didn't work for this bridge. I do not need to supply any TLS certificate BUT it turns out, you need to point mosquitto to the certs of the server.

Here is a summary in case anyone googles the same problem:

geopulse fully working, using OwnTracks on Android phone as location source.
traefik (reverse proxy) terminates TLS on port 8883 and forwards to geopulse-mosquitto:1883

On the HA side, mosquitto needs to be configured as follows:

1. HA ⇒ settings ⇒ add-ons ⇒ mosquitto ⇒ Configuration
2. expand the “Customize” section
3. type “mosquitto” into the field named folder
4. enable the checkbox named “active”
5. created a file inside \share\mosquitto\ on HA (I named it geopulse.conf)
6. Paste the following content into that file and replace the placeholders with your values.
7. Restart the mosquitto broker on HA's side.
8. HA's mosquitto will now get all location data that flows into geopulse too
9. install the OwnTracks integration which will automatically see the location data and create a device_tracker for you.
10. assign this device_tracker to the right person (Settings ⇒ People click on your Name, assign device_tracker)

geopulse.conf

connection ha2geopulse
address mqtt.dom.tld:8883
topic owntracks/OwnTracks/+ in 0
remote_username chosenusername
remote_password supersecretpassword
remote_clientid ha2geopulse
try_private false
start_type automatic
notifications true
cleansession false
log_type information
bridge_capath /etc/ssl/certs
bridge_protocol_version mqttv311

keep in mind, some of these variables are pasted here with their defaults, as this took me quite some time to figure out.