# mosquitto.conf — initial bootstrap configuration (Release 1)
#
# This file ships with the stack and starts the broker on the internal
# backend network only. It is the ONE file that is legitimately part of
# the deployment; from here on, all configuration changes go through the
# platform's revision pipeline (spec §25, §61).
#
# The generated platform configuration will replace this file through
# mosquitto-control, never by direct editing.
#
# NOTE (2.1 deprecations, spec §3.1): we use `plugin`/`global_plugin`,
# NOT the deprecated password_file/acl_file/per_listener_settings options.
# Default auth behaviour in 2.x is already global (per_listener_settings
# is unset), so nothing is lost by omitting it here.

# --- Internal management listener (backend-net only) ---
# Plaintext is acceptable here because the network is isolated and the
# listener is not published to the host. Production TLS listeners are
# added via the platform (spec §60).
# NOTE: the platform generator always emits explicit bind addresses for
# listeners — Mosquitto's reload compares listeners textually and refuses
# to add/remove listeners on reload (spec §28). This line matches that
# form so the first platform deploy is a pure reload, not a restart.
listener 1883 0.0.0.0
allow_anonymous false

# --- Dynamic Security plugin ---
plugin /usr/lib/mosquitto_dynamic_security.so
plugin_opt_config_file /mosquitto/config/dynamic-security.json
# Admin client password is seeded from MOSQUITTO_DYNSEC_PASSWORD on first
# start (2.1 feature); the .pw file fallback is not used because the env
# var is always provided by compose.

# --- Persistence (plugin-based, recommended over built-in in 2.1) ---
persistence true
persistence_location /mosquitto/data/
autosave_interval 900

# --- Telemetry for the future dashboard (Release 3) ---
sys_interval 10

# --- Logging ---
log_dest stdout
log_type error
log_type warning
log_type notice
log_type information
log_timestamp true
log_timestamp_format %Y-%m-%dT%H:%M:%S