🚧 WIP

backend/app/configgen.py

@@ -17,6 +17,13 @@ from app.models import BrokerSettings, Certificate, ListenerConfig
 
 _BOOL = {True: "true", False: "false"}
 
+# BrokerSettings keys that are INTERNAL platform state, not broker
+# options — they must never be emitted into the generated mosquitto.conf
+# (a leaked key makes `mosquitto --test-config` fail with "Unknown
+# configuration variable").
+RESTART_REQUIRED_KEY = "restart_required"
+RESERVED_SETTINGS_KEYS = frozenset({RESTART_REQUIRED_KEY})
+
 
 @dataclass
 class GenerationResult:
@@ -31,6 +38,10 @@ def _global_section(db: Session, warnings: list[str]) -> list[str]:
         value = setting.value.strip()
         if not key or key.startswith("#"):
             continue
+        if key in RESERVED_SETTINGS_KEYS:
+            # Internal platform state, not a broker option — emitting it
+            # would fail validation (see RESERVED_SETTINGS_KEYS above).
+            continue
         lines.append(f"{key} {value}")
     return lines