stacks/rabbitmq/config/rabbitmq.conf

# RabbitMQ — minimal config for the cloud hub.
# Listeners:
#   amqp on 5672    (internal app traffic)
#   mgmt UI on 15672 (proxied by nginx as mq.wbd-rd.nl)
#   mqtt on 1883    (cloud-external traffic comes in via nginx stream proxy on tcp/8883 → here)
#
# Authentication: default RABBITMQ_DEFAULT_USER/PASS from env (set in cloud/.env).
# Anonymous MQTT is disabled so the broker rejects unauthenticated clients.

listeners.tcp.default      = 5672
management.tcp.port        = 15672

mqtt.listeners.tcp.default = 1883
mqtt.allow_anonymous       = false
mqtt.vhost                 = /
mqtt.exchange              = amq.topic

# Don't refuse connections while the broker is still starting (helps first-boot ordering)
cluster_partition_handling = ignore
feat(cloud): single-shot deploy.sh + FROST stack + healthchecks Stage 5 — make the cloud composition spin up in one command and add the SensorThings (FROST) stack as a fully segregated tenant. cloud/deploy.sh — idempotent, 7-step bring-up: preflight → validate → up + wait → cert state → issue/renew → service status → endpoint smoke test. Reissues LE cert only when current issuer no longer matches ACME_CA_URI. Move-aside-then- restore-on-failure so the bootstrap cert survives a failed certbot. stacks/frost — new stack, segregated from shared sql/rabbitmq: - dedicated postgis container (frost-db) - dedicated internal mosquitto bus (frost-mosquitto) - frost-http + frost-mqtt on a private frost-internal network, joined to cloud-app only for nginx ingress at frost.wbd-rd.nl - shared mosquitto stack deleted; rabbitmq remains the only public MQTT broker (mqtt.wbd-rd.nl:8883 via stream proxy) stacks/sql — pg_isready healthcheck so keycloak/gitea/mlflow can gate on service_healthy via cloud-level depends_on overrides. stacks/nginx-proxy: - nginx-init service generates a self-signed bootstrap cert on fresh deploy so nginx starts before certbot has issued a real one - frost.wbd-rd.nl vhost (/FROST-Server → frost-http:8080, /mqtt → frost-mqtt:9876 WebSocket) stacks/mlflow — custom Dockerfile (upstream + psycopg2-binary) so the official image can speak to the shared sql backend. stacks/jupyterhub — DummyAuthenticator stub gated by JUPYTERHUB_ADMIN_PASSWORD; TODO comments point at OIDC + DockerSpawner. stacks/rabbitmq — config/{enabled_plugins,rabbitmq.conf} stubs (management + mqtt plugins, MQTT auth required). stacks/portainer — ports unpublished; nginx now the only ingress. stacks/node-red — pin to 4.1 (the floating "4" tag does not exist). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> 2026-05-21 16:37:58 +02:00			`# RabbitMQ — minimal config for the cloud hub.`
			`# Listeners:`
			`# amqp on 5672 (internal app traffic)`
			`# mgmt UI on 15672 (proxied by nginx as mq.wbd-rd.nl)`
			`# mqtt on 1883 (cloud-external traffic comes in via nginx stream proxy on tcp/8883 → here)`
			`#`
			`# Authentication: default RABBITMQ_DEFAULT_USER/PASS from env (set in cloud/.env).`
			`# Anonymous MQTT is disabled so the broker rejects unauthenticated clients.`

			`listeners.tcp.default = 5672`
			`management.tcp.port = 15672`

			`mqtt.listeners.tcp.default = 1883`
			`mqtt.allow_anonymous = false`
			`mqtt.vhost = /`
			`mqtt.exchange = amq.topic`

			`# Don't refuse connections while the broker is still starting (helps first-boot ordering)`
			`cluster_partition_handling = ignore`