Security

• The internal MQTT broker supports the use of server-side TLS certificates as well as username/password authentication.

  • This will be improved upon to support letsencrypt (or perhaps any ACME CA) certificates. The goal is to enable configuration-free acquisition and installation of a CA-signed certificate. To do this will most likely require Casa to have it's own domain name which can be accomplished with a dynamic-dns provider.

• Casa will not be cloud-based. The more of Casa that can be stuffed behind the user's home firewall the better. I think dynamic-dns is a good solution:

  1. It enables the user to have a memorable domain name to connect to their system from outside their home.
  2. It keeps the majority of Casa behind their firewall, exposing only one or two ports.
  3. It allows outside services to connect to the home system, ie mobile clients.