per_listener_settings true

# Plain MQTT — internal services and clients authenticate with username/password on port 1883
listener 1883 0.0.0.0
password_file /mosquitto/config/passwd
acl_file /mosquitto/config/devices.acl
allow_anonymous false

# TLS MQTT — devices authenticate with client certificates (port 8883)
# require_certificate true forces client cert; cert CN becomes the MQTT username.
# ACL restricts each device to devices/<serial_number>/#
# Certs are issued by the backend's certificates module (see backend/src/certificates/)
# into ./mosquitto/certs — requires a broker restart after CA init/provisioning
# since there's no config/cert hot-reload.
listener 8883 0.0.0.0
cafile /mosquitto/certs/ca.crt
certfile /etc/letsencrypt/live/dev.hub.umagul.net/fullchain.pem
keyfile /etc/letsencrypt/live/dev.hub.umagul.net/privkey.pem
require_certificate true
use_identity_as_username true
allow_anonymous false
acl_file /mosquitto/config/devices.acl

# TLS MQTT — app/admin username+password access (port 8884). App usernames are orgIds;
# devices.acl confines them to ul/{orgId}/app/... . No anonymous listener is exposed.
listener 8884 0.0.0.0
certfile /etc/letsencrypt/live/dev.hub.umagul.net/fullchain.pem
keyfile /etc/letsencrypt/live/dev.hub.umagul.net/privkey.pem
require_certificate false
password_file /mosquitto/config/passwd
allow_anonymous false
acl_file /mosquitto/config/devices.acl