Alerting: Add TLS, QoS and retain options to the MQTT receiver (#92331)

devenv/docker/blocks/mqtt/README.md

@@ -0,0 +1,31 @@
+# NanoMQ MQTT broker
+
+Starts a [NanoMQ MQTT broker](https://nanomq.io/docs/en/latest/).
+
+## Authentication
+
+The broker is configured to use a simple username/password authentication.
+See [./nanomq_pwd.conf](./nanomq_pwd.conf) for the default credentials. 
+
+## TLS Certificates
+
+If you want to configure an MQTT contact point in Grafana Alerting with TLS, you need to provide a certificate and key.
+
+You can find them in `/etc/certs` directory in the container:
+
+``` shell
+docker exec devenv-mqtt-1 ls /etc/certs/
+```
+
+### CA Certificate
+
+``` shell
+docker exec devenv-mqtt-1 cat /etc/certs/ca.pem
+```
+
+### Client certificates
+
+``` shell
+docker exec devenv-mqtt-1 cat /etc/certs/client.pem
+docker exec devenv-mqtt-1 cat /etc/certs/client.key
+```

devenv/docker/blocks/mqtt/build/Dockerfile

@@ -0,0 +1,9 @@
+FROM emqx/nanomq:0.21.11-full
+
+RUN apt-get update && apt-get install -y \
+  openssl \
+  && rm -rf /var/lib/apt/lists/*
+
+COPY ./san.cnf /etc/certs/san.cnf
+COPY ./gen_certs.sh /etc/certs/gen_certs.sh
+RUN /etc/certs/gen_certs.sh

devenv/docker/blocks/mqtt/build/gen_certs.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+
+DAYS_VALID=3650
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+# Create CA certificate
+openssl genpkey -algorithm RSA -out "$SCRIPT_DIR/ca.key"
+openssl req -new -x509 -days $DAYS_VALID -key "$SCRIPT_DIR/ca.key" -out "$SCRIPT_DIR/ca.pem" -subj "/CN=My CA"
+
+# Create server certificate
+openssl genpkey -algorithm RSA -out "$SCRIPT_DIR/server.key"
+openssl req -new -key "$SCRIPT_DIR/server.key" -out "$SCRIPT_DIR/server.csr" -subj "/CN=localhost"
+openssl x509 -req -days $DAYS_VALID -in "$SCRIPT_DIR/server.csr" -CA "$SCRIPT_DIR/ca.pem" -CAkey "$SCRIPT_DIR/ca.key" -CAcreateserial -out "$SCRIPT_DIR/server.pem" -extfile "$SCRIPT_DIR/san.cnf" -extensions v3_req
+
+# Create client key and certificate
+openssl genpkey -algorithm RSA -out "$SCRIPT_DIR/client.key"
+openssl req -new -key "$SCRIPT_DIR/client.key" -out "$SCRIPT_DIR/client.csr" -subj "/CN=Client"
+openssl x509 -req -days $DAYS_VALID -in "$SCRIPT_DIR/client.csr" -CA "$SCRIPT_DIR/ca.pem" -CAkey "$SCRIPT_DIR/ca.key" -CAcreateserial -out "$SCRIPT_DIR/client.pem" -extfile "$SCRIPT_DIR/san.cnf" -extensions v3_req

devenv/docker/blocks/mqtt/build/san.cnf

@@ -0,0 +1,7 @@
+[ v3_req ]
+subjectAltName = @alt_names
+
+[ alt_names ]
+DNS.1 = localhost
+IP.1 = 127.0.0.1
+IP.2 = ::1

devenv/docker/blocks/mqtt/docker-compose.yaml

@@ -0,0 +1,12 @@
+  mqtt:
+    build:
+      context: docker/blocks/mqtt/build
+    ports:
+      - "127.0.0.1:1883:1883" # MQTT
+      - "127.0.0.1:8883:8883" # MQTT over TLS
+      - "127.0.0.1:8083:8083" # MQTT over WS
+      - "127.0.0.1:8443:8443" # MQTT over WSS
+    volumes:
+      - ${PWD}/docker/blocks/mqtt/nanomq.conf:/etc/nanomq.conf
+      - ${PWD}/docker/blocks/mqtt/nanomq_pwd.conf:/etc/nanomq_pwd.conf
+      - ${PWD}/docker/blocks/mqtt/nanomq_acl.conf:/etc/nanomq_acl.conf

devenv/docker/blocks/mqtt/nanomq.conf

@@ -0,0 +1,40 @@
+log {
+    to=console
+    level=info
+}
+
+listeners.tcp {
+  bind = "0.0.0.0:1883"
+}
+
+
+listeners.ssl {
+  bind = "0.0.0.0:8883"
+
+  keyfile = "/etc/certs/server.key"
+  certfile = "/etc/certs/server.pem"
+  cacertfile = "/etc/certs/ca.pem"
+
+  # Change these settings to true if you want to deny
+  # access for clients that don't have a certificate.
+  verify_peer = false
+  fail_if_no_peer_cert = false
+}
+
+listeners.ws {
+  bind = "0.0.0.0:8083"
+}
+
+listeners.wss {
+  bind = "0.0.0.0:8443"
+}
+
+auth {
+  allow_anonymous = false
+  no_match = deny
+  deny_action = disconnect
+  password = {include "/etc/nanomq_pwd.conf"}
+  acl = {
+    include "/etc/nanomq_acl.conf"
+  }
+}

devenv/docker/blocks/mqtt/nanomq_acl.conf

@@ -0,0 +1,7 @@
+rules = [
+  {"permit": "allow", "username": "grafana", "action": "subscribe", "topics": ["#"]}
+  {"permit": "allow", "username": "grafana", "action": "publish", "topics": ["#"]}
+  {"permit": "allow", "username": "admin", "action": "subscribe", "topics": ["#"]}
+  {"permit": "allow", "username": "admin", "action": "publish", "topics": ["#"]}
+  {"permit": "deny"}
+]

devenv/docker/blocks/mqtt/nanomq_pwd.conf

@@ -0,0 +1,2 @@
+admin:admin
+grafana:grafana