MQTT in docker container SSL

[imzenreally]

so i've been hacking at this forever with no luck

i'm running weewx on a vm on my proxmox server
i'm running my own mqtt broker in a container in another server on my home network

i have weewx happily talking to my mqtt broker over http - but when i connect to my weather website over https it wont' talk to my mqtt broker

any suggestion would be appreciated

[gdt]

DO you really mean weewx is talking http to your broker? That doesn't make sense as brokers speak mqtt not http.

Is your mqtt broker using tls on port 8883? Generally, browsers do not allow use of non-TLS resources from https page loads.

If your mqtt broker is not running over TLS, with a certificate anyone can validate (e.g. letsencrypt), then I think you should fix that.

However, my advice might be generally right but not on point for your problem.

You can also open up the debugging window in your browser, or in firefox and see what the errors are.

(It also seems odd to run mqtt at home and weewx in the cloud, but that is "seems odd" not "wrong".)

[imzenreally]

sooo - i'm new to the world of mqtt
i configured port 1883 to open up and point at my mqtt docker - then i pointed weewx at my public fqdn and when i load my weewx site either over the local ip addr or over http weather.domain.com - the websockets connect to the mqtt broker and i get real time updates on my weather site

but when i hit the weather site using https://weather.domain.com everything works EXCEPT the it just says 'connecting' and never connects to get real time weather updates.

[imzenreally]

as for mqtt at home and weewx in the cloud - i have two servers at home one running proxmox and one running unraid - the proxmox is running various VM's including a weewx VM - and unraid is running the mqtt docker - both are at home

[gdt]

Sorry, I thought proxmox was a cloud provider.

You need to use tcpdump, and look at logs. But if you are using TLS for web, you should do that for mqtt also.

[imzenreally]

groovy - i'm using letsencrypt to create my certs through my reverse proxy (nginx proxy manager) - i can export those to my local containers - i don't htink mqtt plays nicely with nginx so i'll try and get mqtts:// ? set up this weekend

[ThePeePs]

I haven't seen much documentation on doing MQTT with nginx. My solution was to set up a 2nd broker (main MQTT is on my weewx pi) running on my nginx vm (both are in a DMZ) I have it configured to act as a one way bridge from the pi, and then that then relay's the secure websocket to the browser.
I did this for two reasons. 1) I only have to have one copy of the letsencrypt cert on one box (vm in this case). 2) This adds a bit of separation between the internet and my weewx pi, so it doesn't have to track as many connections to MQTT.

If you do the same as me, be mindful of the ownership/groups of the certs and keys so that both mosquitto and nginx are able to read them.

Bridge config is as follows:

persistence false

# mqtt
listener 1883 localhost
protocol mqtt

connection weather-br
address xxxxx.xxxxx:1883
cleansession true
local_cleansession true
topic weather/# in 0 "" ""
start_type automatic
notifications_local_only true

# websockets
listener 9001
certfile /etc/xxx/xxx/xxxxxxxxxx.crt
cafile /etc/xxx/xxx/xxxxxxxxxx.crt
keyfile /etc/xxx/xxx/xxxxxxxxxx.key
protocol websockets
allow_anonymous true

password_file /etc/mosquitto/passwd

acl_file /etc/mosquitto/acl