🚧 WIP

mosquitto/bootstrap/mosquitto.conf

@@ -0,0 +1,45 @@
+# mosquitto.conf — initial bootstrap configuration (Release 1)
+#
+# This file ships with the stack and starts the broker on the internal
+# backend network only. It is the ONE file that is legitimately part of
+# the deployment; from here on, all configuration changes go through the
+# platform's revision pipeline (spec §25, §61).
+#
+# The generated platform configuration will replace this file through
+# mosquitto-control, never by direct editing.
+#
+# NOTE (2.1 deprecations, spec §3.1): we use `plugin`/`global_plugin`,
+# NOT the deprecated password_file/acl_file/per_listener_settings options.
+
+per_listener_settings false
+
+# --- Internal management listener (backend-net only) ---
+# Plaintext is acceptable here because the network is isolated and the
+# listener is not published to the host. Production TLS listeners are
+# added via the platform (spec §60).
+listener 1883 0.0.0.0
+allow_anonymous false
+
+# --- Dynamic Security plugin ---
+plugin /usr/lib/mosquitto_dynamic_security.so
+plugin_opt_config_file /mosquitto/config/dynamic-security.json
+# Admin client password is seeded from MOSQUITTO_DYNSEC_PASSWORD on first
+# start (2.1 feature); the .pw file fallback is not used because the env
+# var is always provided by compose.
+
+# --- Persistence (plugin-based, recommended over built-in in 2.1) ---
+persistence true
+persistence_location /mosquitto/data/
+autosave_interval 900
+
+# --- Telemetry for the future dashboard (Release 3) ---
+sys_interval 10
+
+# --- Logging ---
+log_dest stdout
+log_type error
+log_type warning
+log_type notice
+log_type information
+log_timestamp true
+log_timestamp_format %Y-%m-%dT%H:%M:%S