per_listener_settings true

# Plain MQTT — internal services and clients authenticate with username/password on port 1883
listener 1883 0.0.0.0
password_file /mosquitto/config/passwd
acl_file /mosquitto/config/devices.acl
allow_anonymous false

# WebSocket — browser clients, no authentication required
listener 9001 0.0.0.0
protocol websockets
allow_anonymous true

# TLS MQTT — devices authenticate with client certificates (port 8883)
# require_certificate true forces client cert; cert CN becomes the MQTT username.
# ACL restricts each device to devices/<serial_number>/#
# listener 8883 0.0.0.0
# cafile /mosquitto/certs/ca.crt
# certfile /mosquitto/certs/server.crt
# keyfile /mosquitto/certs/server.key
# require_certificate true
# use_identity_as_username true
# allow_anonymous false
# acl_file /mosquitto/config/devices.acl

# TLS MQTT — admin access via username/password, no client cert required (port 8884)
# Connect with CA cert for server verification, then username/password.
# listener 8884 0.0.0.0
# cafile /mosquitto/certs/ca.crt
# certfile /mosquitto/certs/server.crt
# keyfile /mosquitto/certs/server.key
# require_certificate false
# password_file /mosquitto/config/passwd
# allow_anonymous false
# acl_file /mosquitto/config/devices.acl