Turnkey eBus MQTT broker bundle for new developers.
Three paths to a running eBus broker on your network:
- Laptop (macOS, real mDNS) — host-native Mosquitto plus a python-zeroconf advertiser, brought up with one command, no Docker and no root. Exercises real mDNS discovery on a single Mac, where Docker Desktop's LinuxKit VM cannot. A one-command bench (
scripts/laptop-bench.sh) runs the whole loop: the broker plus a real eBus publisher that discovers it over mDNS and connects over mTLS. Seedocs/laptop-quickstart.md. - Raspberry Pi (real LAN) — Ansible playbook against stock Raspberry Pi OS. Claims
ebus-broker-<mac4>.local, advertises via mDNS, generates a TLS CA + server cert, exposes a per-device registration API. Seedocs/pi-quickstart.md. - Docker (any machine) —
docker compose upbrings a broker plus example device and controller containers. No mDNS; containers reach each other by service name. Seedocs/docker-quickstart.md.
The Docker and Pi paths bundle the same components: Mosquitto, a small FastAPI register service, and reused tls-certificate-manager + mdns-publisher modules. Example device + controller containers are built from python-sdk/examples/ and pulled from ghcr.io/electrification-bus/.
The broker ships with three profiles, switchable via a single config setting plus a restart:
| Profile | Anon read | Anon write | Device auth | Use case |
|---|---|---|---|---|
open (default) |
all topics | all topics | off (plaintext) | First-10-minutes hello-world |
discovery |
$state + $description only |
none | mTLS client cert | Most installs; matches eBus intent |
strict |
none | none | mTLS client cert | Production / multi-tenant LAN |
Authentication is by client certificate (the cert CN is the MQTT username), authorized by a shared ACL. discovery runs an mTLS listener for devices plus a plaintext, read-only anonymous listener so a consumer can browse $state / $description without a cert; strict drops that anonymous window. open is the default to make the first demo trivial. Do not expose an open-mode broker to an untrusted network. See docs/security-profiles.md for the full definition.
Scaffolding in progress. See CHANGELOG.md for what's done and what's planned for v0.1.
MIT — see LICENSE.