Add ACL for mosquitto

hosts/pi/default.nix

@@ -117,6 +117,7 @@
       "radio_browser"
       "scrape"
       "sensor"
+      "system_health"
     ];
     config = {
       default_config = {};
@@ -130,20 +131,8 @@
         time_zone = config.time.timeZone;
         unit_system = "metric";
       };
-      mqtt = {
-        broker = "127.0.0.1";
-        port = 1883;
-        discovery = true;
-        client_id = "home-assistant-1";
-        birth_message = {
-          topic = "homeassistant/status";
-          payload = "online";
-        };
-        will_message = {
-          topic = "homeassistant/status";
-          payload = "offline";
-        };
-      };
+      mqtt = { };
+      system_health = { };
       recorder = {
         purge_keep_days = 365;
       };
@@ -153,6 +142,8 @@
   services.mosquitto = {
     enable = true;
     listeners = [{
+      acl = [ "pattern readwrite #" ];
+      omitPasswordAuth = true;
       port = 1883;
       settings = {
         allow_anonymous = true;