Mosquitto That Asks Who You Are

mosquitto-broker

Mosquitto (MQTT) with accounts, persistence and a packet-size limit. Original role for EL 10, live-tested with podman on Rocky Linux 10.

Mosquitto is in EPEL. AppStream on EL 10 has no MQTT broker; the role enables EPEL first (mosquitto_broker_enable_epel: false if you mirror it).

The package lets anyone in. Its mosquitto.conf is comments only, so Mosquitto 2 starts in "local only mode": port 1883 on loopback, anonymous clients allowed. The live test published and subscribed with no credentials against the package as shipped. Local-only is not a boundary on a host that runs anything else - every process on it may read and publish every topic. This role writes an explicit listener with allow_anonymous false and a password file, and the live test proves anonymous and wrong-password clients are refused before it round-trips a message through an account.

Passwords are written by mosquitto_passwd, not rendered. It salts every hash, so a templated file would change on every run. The role adds an account only when it is missing from the file (or all of them when mosquitto_broker_reset_passwords is true), which is what keeps the second run at changed=0. Removing an account is yours to do.

Nothing survives a restart, and nothing is too big. Persistence is off and its directory does not exist, so retained messages and durable subscriptions are lost on restart; max_packet_size is 0, so a client may send 256 MiB in one message. The role turns persistence on in /var/lib/mosquitto/ and caps packets at 1 MiB; the live test publishes 2 MiB and expects a refusal.

Topic ACLs are one list away. mosquitto_broker_acls renders an acl_file; empty means every account may use every topic.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.