# Mosquitto broker configuration (packaged, treated as read-only).
#
# This file ships with the cookbook. Site-specific configuration and fragments
# contributed by dependent cookbooks go into the conf.d directory referenced by
# the include_dir directive at the end of this file.

# Send every log line to stdout so journalctl is the single place to look.
# Do NOT configure log_dest file / do not mount /mosquitto/log.
log_dest stdout

# Persist retained messages and client sessions to the precious data directory,
# which is virtiofs-backed and picked up by the host's ZFS snapshots and backups.
persistence true
persistence_location /var/lib/virtiofs/data/mosquitto/

# Default listener: plain MQTT, bound to loopback only. Nothing listens on the LAN.
# TLS is terminated by Traefik on :443 and demultiplexed by SNI (see the README and
# other/traefik/mosquitto.yaml); the broker itself never speaks TLS.
listener 1883 127.0.0.1

# Authentication: anonymous access is refused. The password file is provided by the
# operator (Ansible, from a vault) at the path below; a working example ships under
# config/examples/ for development only.
allow_anonymous false
password_file /etc/quadlets/mosquitto/passwd

# Topic authorization, also operator-provided (example under config/examples/).
acl_file /etc/quadlets/mosquitto/acl

# Site configuration and dependent-cookbook fragments are dropped here.
# Caveats of mosquitto's include_dir (verified against 2.1.2): it is NOT recursive,
# it only reads files matching *.conf, and it FAILS if the directory is missing.
# The directory is therefore created unconditionally (packaged as an empty directory).
include_dir /etc/quadlets/mosquitto/conf.d