##===================================================================
## EMQ Configuration R2.3
##===================================================================

##--------------------------------------------------------------------
## Cluster
##--------------------------------------------------------------------

## Cluster name
cluster.name = emqcl

## Cluster discovery strategy: manual | static | mcast | dns | etcd | k8s
cluster.discovery = manual

## Cluster Autoheal: on | off
cluster.autoheal = on

## Clean down node of the cluster
cluster.autoclean = 5m

##--------------------------------------------------------------------
## Cluster with static node list

## cluster.static.seeds = emq1@127.0.0.1,emq2@127.0.0.1

##--------------------------------------------------------------------
## Cluster with multicast

## cluster.mcast.addr = 239.192.0.1

## cluster.mcast.ports = 4369,4370

## cluster.mcast.iface = 0.0.0.0

## cluster.mcast.ttl = 255

## cluster.mcast.loop = on

##--------------------------------------------------------------------
## Cluster with DNS

## cluster.dns.name = localhost

## cluster.dns.app = emq

##--------------------------------------------------------------------
## Cluster with Etcd

## cluster.etcd.server = http://127.0.0.1:2379

## cluster.etcd.prefix = emqcl

## cluster.etcd.node_ttl = 1m

##--------------------------------------------------------------------
## Cluster with k8s

## cluster.k8s.apiserver = http://10.110.111.204:8080

## cluster.k8s.service_name = emq

## Address Type: ip | dns
## cluster.k8s.address_type = ip

## The Erlang application name 
## cluster.k8s.app_name = emq

##--------------------------------------------------------------------
## Node Args
##--------------------------------------------------------------------

## Node name
node.name = emq@127.0.0.1

## Cookie for distributed node
node.cookie = emqsecretcookie

## SMP support: enable, auto, disable
node.smp = auto

## vm.args: -heart
## Heartbeat monitoring of an Erlang runtime system
## Value should be 'on' or comment the line
## node.heartbeat = on

## Enable kernel poll
node.kernel_poll = on

## async thread pool
node.async_threads = 32

## Erlang Process Limit
node.process_limit = 256000

## Sets the maximum number of simultaneously existing ports for this system
node.max_ports = 65536

## Set the distribution buffer busy limit (dist_buf_busy_limit)
node.dist_buffer_size = 32MB

## Max ETS Tables.
## Note that mnesia and SSL will create temporary ets tables.
node.max_ets_tables = 256000

## Tweak GC to run more often
node.fullsweep_after = 1000

## Crash dump
node.crash_dump = log/crash.dump

## Distributed node ticktime
node.dist_net_ticktime = 60

## Distributed node port range
node.dist_listen_min = 6369
node.dist_listen_max = 6379

##--------------------------------------------------------------------
## Log
##--------------------------------------------------------------------

## Set the log dir
log.dir = log

## Console log. Enum: off, file, console, both
log.console = console

## Console log level. Enum: debug, info, notice, warning, error, critical, alert, emergency
log.console.level = error

## Syslog. Enum: on, off
log.syslog = on

##  syslog level. Enum: debug, info, notice, warning, error, critical, alert, emergency
log.syslog.level = error

## Console log file
## log.console.file = log/console.log

## Info log file
## log.info.file = log/info.log

## Error log file
log.error.file = log/error.log

## Enable the crash log. Enum: on, off
log.crash = on

log.crash.file = log/crash.log

##--------------------------------------------------------------------
## Allow Anonymous and Default ACL
##--------------------------------------------------------------------

## Allow Anonymous authentication
mqtt.allow_anonymous = true

## ACL nomatch
mqtt.acl_nomatch = allow

## Default ACL File
mqtt.acl_file = etc/acl.conf

## Cache ACL for PUBLISH
mqtt.cache_acl = true

##--------------------------------------------------------------------
## MQTT Protocol
##--------------------------------------------------------------------

## Max ClientId Length Allowed.
mqtt.max_clientid_len = 1024

## Max Packet Size Allowed, 64K by default.
mqtt.max_packet_size = 64KB

## Check Websocket Protocol Header. Enum: on, off
mqtt.websocket_protocol_header = on

## The Keepalive timeout: Keepalive * backoff * 2
mqtt.keepalive_backoff = 1.25

##--------------------------------------------------------------------
## MQTT Connection
##--------------------------------------------------------------------

## Force GC: integer. Value 0 disabled the Force GC.
mqtt.conn.force_gc_count = 100

##--------------------------------------------------------------------
## MQTT Client
##--------------------------------------------------------------------

## Client Idle Timeout (Second)
mqtt.client.idle_timeout = 30s

## Max publish rate of Messages
## mqtt.client.max_publish_rate = 5

## Enable client Stats: on | off
mqtt.client.enable_stats = off

##--------------------------------------------------------------------
## MQTT Session
##--------------------------------------------------------------------

## Max Number of Subscriptions, 0 means no limit.
mqtt.session.max_subscriptions = 0

## Upgrade QoS?
mqtt.session.upgrade_qos = off

## Max Size of the Inflight Window for QoS1 and QoS2 messages
## 0 means no limit
mqtt.session.max_inflight = 32

## Retry Interval for redelivering QoS1/2 messages.
mqtt.session.retry_interval = 20s

## Client -> Broker: Max Packets Awaiting PUBREL, 0 means no limit
mqtt.session.max_awaiting_rel = 100

## Awaiting PUBREL Timeout
mqtt.session.await_rel_timeout = 20s

## Enable Statistics: on | off
mqtt.session.enable_stats = off

## Expired after 1 day:
## w - week
## d - day
## h - hour
## m - minute
## s - second
mqtt.session.expiry_interval = 2h

## Ignore message from self publish
mqtt.session.ignore_loop_deliver = false

##--------------------------------------------------------------------
## MQTT Message Queue
##--------------------------------------------------------------------

## Type: simple | priority
mqtt.mqueue.type = simple

## Topic Priority: 0~255, Default is 0
## mqtt.mqueue.priority = topic/1=10,topic/2=8

## Max queue length. Enqueued messages when persistent client disconnected,
## or inflight window is full. 0 means no limit.
mqtt.mqueue.max_length = 1000

## Low-water mark of queued messages
mqtt.mqueue.low_watermark = 20%

## High-water mark of queued messages
mqtt.mqueue.high_watermark = 60%

## Queue Qos0 messages?
mqtt.mqueue.store_qos0 = true

##--------------------------------------------------------------------
## MQTT Broker and PubSub
##--------------------------------------------------------------------

## System Interval of publishing broker $SYS Messages
mqtt.broker.sys_interval = 60

## PubSub Pool Size. Default should be scheduler numbers.
mqtt.pubsub.pool_size = 8

mqtt.pubsub.by_clientid = true

## Subscribe Asynchronously
mqtt.pubsub.async = true

##--------------------------------------------------------------------
## MQTT Bridge
##--------------------------------------------------------------------

## Bridge Queue Size
mqtt.bridge.max_queue_len = 10000

## Ping Interval of bridge node. Unit: Second
mqtt.bridge.ping_down_interval = 1

##-------------------------------------------------------------------
## MQTT Plugins
##-------------------------------------------------------------------

## Dir of plugins' config
mqtt.plugins.etc_dir =etc/plugins/

## File to store loaded plugin names.
mqtt.plugins.loaded_file = data/loaded_plugins

##--------------------------------------------------------------------
## MQTT Listeners
##--------------------------------------------------------------------

##--------------------------------------------------------------------
## External TCP Listener

## External TCP Listener: 1883, 127.0.0.1:1883, ::1:1883
listener.tcp.external = 0.0.0.0:1883

## Size of acceptor pool
listener.tcp.external.acceptors = 16

## Maximum number of concurrent clients
listener.tcp.external.max_clients = 102400

#listener.tcp.external.mountpoint = external/

## Rate Limit. Format is 'burst,rate', Unit is KB/Sec
#listener.tcp.external.rate_limit = 100,10

#listener.tcp.external.access.1 = allow 192.168.0.0/24

listener.tcp.external.access.2 = allow all

## Proxy Protocol V1/2
## listener.tcp.external.proxy_protocol = on
## listener.tcp.external.proxy_protocol_timeout = 3s

## TCP Socket Options
listener.tcp.external.backlog = 1024

#listener.tcp.external.recbuf = 4KB

#listener.tcp.external.sndbuf = 4KB

listener.tcp.external.buffer = 4KB

listener.tcp.external.nodelay = true

##--------------------------------------------------------------------
## Internal TCP Listener

## Internal TCP Listener: 11883, 127.0.0.1:11883, ::1:11883
listener.tcp.internal = 127.0.0.1:11883

## Size of acceptor pool
listener.tcp.internal.acceptors = 16

## Maximum number of concurrent clients
listener.tcp.internal.max_clients = 102400

#listener.tcp.external.mountpoint = internal/

## Rate Limit. Format is 'burst,rate', Unit is KB/Sec
## listener.tcp.internal.rate_limit = 1000,100

## TCP Socket Options
listener.tcp.internal.backlog = 512

listener.tcp.internal.tune_buffer = on

listener.tcp.internal.buffer = 1MB

listener.tcp.internal.recbuf = 4KB

listener.tcp.internal.sndbuf = 1MB

listener.tcp.internal.nodelay = true

##--------------------------------------------------------------------
## External SSL Listener

## SSL Listener: 8883, 127.0.0.1:8883, ::1:8883
listener.ssl.external = 8883

## Size of acceptor pool
listener.ssl.external.acceptors = 16

## Maximum number of concurrent clients
listener.ssl.external.max_clients = 1024

## listener.ssl.external.mountpoint = inbound/

## Rate Limit. Format is 'burst,rate', Unit is KB/Sec
## listener.ssl.external.rate_limit = 100,10

## Proxy Protocol V1/2
## listener.ssl.external.proxy_protocol = on
## listener.ssl.external.proxy_protocol_timeout = 3s

listener.ssl.external.access.1 = allow all

### SSL Options. See http://erlang.org/doc/man/ssl.html

## Configuring SSL Options. See http://erlang.org/doc/man/ssl.html
### TLS only for POODLE attack
## listener.ssl.external.tls_versions = tlsv1.2,tlsv1.1,tlsv1

### The Ephemeral Diffie-Helman key exchange is a very effective way of
### ensuring Forward Secrecy by exchanging a set of keys that never hit
### the wire. Since the DH key is effectively signed by the private key,
### it needs to be at least as strong as the private key. In addition, 
### the default DH groups that most of the OpenSSL installations have 
### are only a handful (since they are distributed with the OpenSSL
### package that has been built for the operating system it’s running on)
### and hence predictable (not to mention, 1024 bits only).

### In order to escape this situation, first we need to generate a fresh,
### strong DH group, store it in a file and then use the option above,
### to force our SSL application to use the new DH group. Fortunately,
### OpenSSL provides us with a tool to do that. Simply run:
### openssl dhparam -out dh-params.pem 2048

listener.ssl.external.handshake_timeout = 15s

listener.ssl.external.keyfile = etc/certs/key.pem

listener.ssl.external.certfile = etc/certs/cert.pem

## listener.ssl.external.cacertfile = etc/certs/cacert.pem

## listener.ssl.external.dhfile = etc/certs/dh-params.pem

## listener.ssl.external.verify = verify_peer

## listener.ssl.external.fail_if_no_peer_cert = true

### This is the single most important configuration option of an Erlang SSL application.
### Ciphers (and their ordering) define the way the client and server encrypt information
### over the wire, from the initial Diffie-Helman key exchange, the session key encryption
### algorithm and the message digest algorithm. Selecting a good cipher suite is critical
### for the application’s data security, confidentiality and performance.
### The cipher list above offers:
### 
### A good balance between compatibility with older browsers. It can get stricter for Machine-To-Machine scenarios.
### Perfect Forward Secrecy.
### No old/insecure encryption and HMAC algorithms
###
### Most of it was copied from Mozilla’s Server Side TLS article
## listener.ssl.external.ciphers = ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-RSA-AES256-GCM-SHA384,ECDHE-ECDSA-AES256-SHA384,ECDHE-RSA-AES256-SHA384,ECDHE-ECDSA-DES-CBC3-SHA,ECDH-ECDSA-AES256-GCM-SHA384,ECDH-RSA-AES256-GCM-SHA384,ECDH-ECDSA-AES256-SHA384,ECDH-RSA-AES256-SHA384,DHE-DSS-AES256-GCM-SHA384,DHE-DSS-AES256-SHA256,AES256-GCM-SHA384,AES256-SHA256,ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-RSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES128-SHA256,ECDHE-RSA-AES128-SHA256,ECDH-ECDSA-AES128-GCM-SHA256,ECDH-RSA-AES128-GCM-SHA256,ECDH-ECDSA-AES128-SHA256,ECDH-RSA-AES128-SHA256,DHE-DSS-AES128-GCM-SHA256,DHE-DSS-AES128-SHA256,AES128-GCM-SHA256,AES128-SHA256,ECDHE-ECDSA-AES256-SHA,ECDHE-RSA-AES256-SHA,DHE-DSS-AES256-SHA,ECDH-ECDSA-AES256-SHA,ECDH-RSA-AES256-SHA,AES256-SHA,ECDHE-ECDSA-AES128-SHA,ECDHE-RSA-AES128-SHA,DHE-DSS-AES128-SHA,ECDH-ECDSA-AES128-SHA,ECDH-RSA-AES128-SHA,AES128-SHA

### SSL parameter renegotiation is a feature that allows a client and 
### a server to renegotiate the parameters of the SSL connection on the fly.
### RFC 5746 defines a more secure way of doing this. By enabling secure renegotiation,
### you drop support for the insecure renegotiation, prone to MitM attacks. 
## listener.ssl.external.secure_renegotiate = off

### A performance optimization setting, it allows clients to reuse 
### pre-existing sessions, instead of initializing new ones.
### Read more about it here.
## listener.ssl.external.reuse_sessions = on

### An important security setting, it forces the cipher to be set based on
### the server-specified order instead of the client-specified order,
### hence enforcing the (usually more properly configured) security
### ordering of the server administrator.
## listener.ssl.external.honor_cipher_order = on

### Use the CN or DN value from the client certificate as a username.
### Notice: 'verify' should be configured as 'verify_peer'
## listener.ssl.external.peer_cert_as_username = cn

## SSL Socket Options
## listener.ssl.external.backlog = 1024

## listener.ssl.external.recbuf = 4KB

## listener.ssl.external.sndbuf = 4KB

## listener.ssl.external.buffer = 4KB

## listener.ssl.external.nodelay = true

##--------------------------------------------------------------------
## External MQTT/WebSocket Listener

listener.ws.external = 8083

listener.ws.external.acceptors = 4

listener.ws.external.max_clients = 64

listener.ws.external.access.1 = allow all

## TCP Options
listener.ws.external.backlog = 1024

listener.ws.external.recbuf = 4KB

listener.ws.external.sndbuf = 4KB

listener.ws.external.buffer = 4KB

listener.ws.external.nodelay = true

##--------------------------------------------------------------------
## External MQTT/WebSocket/SSL Listener

listener.wss.external = 8084

listener.wss.external.acceptors = 4

listener.wss.external.max_clients = 64

listener.wss.external.access.1 = allow all

## SSL Options
listener.wss.external.handshake_timeout = 15s

listener.wss.external.keyfile = etc/certs/key.pem

listener.wss.external.certfile = etc/certs/cert.pem

## listener.wss.external.cacertfile = etc/certs/cacert.pem

## listener.wss.external.verify = verify_peer

## listener.wss.external.fail_if_no_peer_cert = true

##--------------------------------------------------------------------
## HTTP Management API Listener

listener.api.mgmt = 127.0.0.1:8080

listener.api.mgmt.acceptors = 4

listener.api.mgmt.max_clients = 64

listener.api.mgmt.access.1 = allow all

##-------------------------------------------------------------------
## System Monitor
##-------------------------------------------------------------------

## Long GC, don't monitor in production mode for:
## https://github.com/erlang/otp/blob/feb45017da36be78d4c5784d758ede619fa7bfd3/erts/emulator/beam/erl_gc.c#L421
sysmon.long_gc = false

## Long Schedule(ms)
sysmon.long_schedule = 240

## 8M words. 32MB on 32-bit VM, 64MB on 64-bit VM.
sysmon.large_heap = 8MB

## Busy Port
sysmon.busy_port = false

## Busy Dist Port
sysmon.busy_dist_port = true

##--------------------------------------------------------------------
## ClientId Authentication Plugin
##--------------------------------------------------------------------

## Examples
##auth.client.1.clientid = id
##auth.client.1.password = passwd
##auth.client.2.clientid = dev:devid
##auth.client.2.password = passwd2
##auth.client.3.clientid = app:appid
##auth.client.3.password = passwd3
##auth.client.4.clientid = client~!@#$%^&*()_+
##auth.client.4.password = passwd~!@#$%^&*()_+

##--------------------------------------------------------------------
## HTTP Auth/ACL Plugin
##--------------------------------------------------------------------

## Variables: %u = username, %c = clientid, %a = ipaddress, %P = password, %t = topic

auth.http.auth_req = http://127.0.0.1:8080/mqtt/auth
auth.http.auth_req.method = post
auth.http.auth_req.params = clientid=%c,username=%u,password=%P

auth.http.super_req = http://127.0.0.1:8080/mqtt/superuser
auth.http.super_req.method = post
auth.http.super_req.params = clientid=%c,username=%u

## 'access' parameter: sub = 1, pub = 2
auth.http.acl_req = http://127.0.0.1:8080/mqtt/acl
auth.http.acl_req.method = get
auth.http.acl_req.params = access=%A,username=%u,clientid=%c,ipaddr=%a,topic=%t

##--------------------------------------------------------------------
##  Jwt Auth Plugin
##--------------------------------------------------------------------
auth.jwt.secret = emqsecret
##--------------------------------------------------------------------
## LDAP Auth Plugin
##--------------------------------------------------------------------

auth.ldap.servers = 127.0.0.1

auth.ldap.port = 389

auth.ldap.bind_dn = cn=root,dc=emqtt,dc=com

auth.ldap.bind_password = public

auth.ldap.timeout = 30

auth.ldap.ssl = false

## TODO: SSL Support

#auth.ldap.ssl.certfile = etc/certs/cert.pem

#auth.ldap.ssl.keyfile = etc/certs/key.pem

#auth.ldap.ssl.cacertfile = etc/certs/cacert.pem

#auth.ldap.ssl.verify = verify_peer

#auth.ldap.ssl.fail_if_no_peer_cert = true


## Variables: %u = username, %c = clientid
auth.ldap.auth_dn = cn=%u,ou=auth,dc=emqtt,dc=com

## Password hash: plain, md5, sha, sha256
auth.ldap.password_hash = sha256
##--------------------------------------------------------------------
## MongoDB Auth/ACL Plugin
##--------------------------------------------------------------------

## Mongo Topology Type single|unknown|sharded|rs
auth.mongo.type = single

## If type rs, need config setname
## auth.mongo.rs_set_name = 

## Mongo Server 127.0.0.1:27017,127.0.0.2:27017...
auth.mongo.server = 127.0.0.1:27017,127.0.0.2:27017

## Mongo Pool Size
auth.mongo.pool = 8

## Mongo User
## auth.mongo.login = 

## Mongo Password
## auth.mongo.password = 

## Mongo Database
auth.mongo.database = mqtt

## Mongo Write Mode unsafe|safe
## auth.mongo.w_mode = 

## Mongo Read Mode master|slave_ok
## auth.mongo.r_mode = 

## Mongo Topology Options
auth.mongo.topology.pool_size = 1
auth.mongo.topology.max_overflow = 0
## auth.mongo.topology.overflow_ttl = 1000
## auth.mongo.topology.overflow_check_period = 1000
## auth.mongo.topology.local_threshold_ms = 1000
## auth.mongo.topology.connect_timeout_ms = 20000
## auth.mongo.topology.socket_timeout_ms = 100
## auth.mongo.topology.server_selection_timeout_ms = 30000
## auth.mongo.topology.wait_queue_timeout_ms = 1000
## auth.mongo.topology.heartbeat_frequency_ms = 10000
## auth.mongo.topology.min_heartbeat_frequency_ms = 1000

## auth_query
auth.mongo.auth_query.collection = mqtt_user

auth.mongo.auth_query.password_field = password

## Password hash: plain, md5, sha, sha256, bcrypt
auth.mongo.auth_query.password_hash = sha256

## sha256 with salt suffix
## auth.mongo.auth_query.password_hash = sha256,salt

## sha256 with salt prefix
## auth.mongo.auth_query.password_hash = salt,sha256

## bcrypt with salt prefix
## auth.mongo.auth_query.password_hash = salt,bcrypt

## pbkdf2 with macfun iterations dklen
## macfun: md4, md5, ripemd160, sha, sha224, sha256, sha384, sha512
## auth.mongo.auth_query.password_hash = pbkdf2,sha256,1000,20

auth.mongo.auth_query.selector = username=%u

## super_query
auth.mongo.super_query = on

auth.mongo.super_query.collection = mqtt_user

auth.mongo.super_query.super_field = is_superuser

auth.mongo.super_query.selector = username=%u

## acl_query
auth.mongo.acl_query = on

auth.mongo.acl_query.collection = mqtt_acl

auth.mongo.acl_query.selector = username=%u
##--------------------------------------------------------------------
## MySQL Auth/ACL Plugin
##--------------------------------------------------------------------

## MySQL Server 3306, 127.0.0.1:3306, localhost:3306
auth.mysql.server = 127.0.0.1:3306

## Mysql Pool Size
auth.mysql.pool = 8

## Mysql Username
## auth.mysql.username =

## Mysql Password
## auth.mysql.password =

## Mysql Database
auth.mysql.database = mqtt

## Variables: %u = username, %c = clientid

## Authentication Query: select password or password, salt
auth.mysql.auth_query = select password from mqtt_user where username = '%u' limit 1

## Note: column names should be "password" and "salt" (if used). In case column
## names differ in your DB - please use aliases, e.g. "my_column_name as password".
## auth.mysql.auth_query = select password_hash as password from mqtt_user where username = '%u' limit 1

## Password hash: plain, md5, sha, sha256, bcrypt
auth.mysql.password_hash = sha256

## sha256 with salt prefix
## auth.mysql.password_hash = salt,sha256

## bcrypt with salt only prefix
## auth.mysql.password_hash = salt,bcrypt

## sha256 with salt suffix
## auth.mysql.password_hash = sha256,salt

## pbkdf2 with macfun iterations dklen
## macfun: md4, md5, ripemd160, sha, sha224, sha256, sha384, sha512
## auth.mysql.password_hash = pbkdf2,sha256,1000,20

## %% Superuser Query
auth.mysql.super_query = select is_superuser from mqtt_user where username = '%u' limit 1

## ACL Query Command
auth.mysql.acl_query = select allow, ipaddr, username, clientid, access, topic from mqtt_acl where ipaddr = '%a' or username = '%u' or username = '$all' or clientid = '%c'

##--------------------------------------------------------------------
## PostgreSQL Auth/ACL Plugin
##--------------------------------------------------------------------

## Postgre Server: 5432, 127.0.0.1:5432, localhost:5432
auth.pgsql.server = 127.0.0.1:5432

auth.pgsql.pool = 8

auth.pgsql.username = root

#auth.pgsql.password = 

auth.pgsql.database = mqtt

auth.pgsql.encoding = utf8

auth.pgsql.ssl = false

##auth.pgsql.ssl_opts.keyfile = 

##auth.pgsql.ssl_opts.certfile = 

##auth.pgsql.ssl_opts.cacertfile = 

## Variables: %u = username, %c = clientid, %a = ipaddress

## Authentication Query: select password or password, salt
auth.pgsql.auth_query = select password from mqtt_user where username = '%u' limit 1

## Password hash: plain, md5, sha, sha256, bcrypt
auth.pgsql.password_hash = sha256

## sha256 with salt prefix
## auth.pgsql.password_hash = salt,sha256

## sha256 with salt suffix
## auth.pgsql.password_hash = sha256,salt

## bcrypt with salt prefix
## auth.pgsql.password_hash = salt,bcrypt

## pbkdf2 with macfun iterations dklen
## macfun: md4, md5, ripemd160, sha, sha224, sha256, sha384, sha512
## auth.pgsql.password_hash = pbkdf2,sha256,1000,20

## Superuser Query
auth.pgsql.super_query = select is_superuser from mqtt_user where username = '%u' limit 1

## ACL Query. Comment this query, the acl will be disabled.
auth.pgsql.acl_query = select allow, ipaddr, username, clientid, access, topic from mqtt_acl where ipaddr = '%a' or username = '%u' or username = '$all' or clientid = '%c'
##--------------------------------------------------------------------
## Redis Auth/ACL Plugin
##--------------------------------------------------------------------

## Redis Server: 6379, 127.0.0.1:6379, localhost:6379
auth.redis.server = 127.0.0.1:6379

## Redis Pool Size
auth.redis.pool = 8

## Redis Database
auth.redis.database = 0

## Redis Password
## auth.redis.password =

## Variables: %u = username, %c = clientid

## Authentication Query Command
## HMGET mqtt_user:%u password or HMGET mqtt_user:%u password salt or HGET mqtt_user:%u password
auth.redis.auth_cmd = HMGET mqtt_user:%u password

## Password hash: plain, md5, sha, sha256, bcrypt
auth.redis.password_hash = plain

## sha256 with salt prefix
## auth.redis.password_hash = salt,sha256

## sha256 with salt suffix
## auth.redis.password_hash = sha256,salt

## bcrypt with salt prefix
## auth.redis.password_hash = salt,bcrypt

## pbkdf2 with macfun iterations dklen
## macfun: md4, md5, ripemd160, sha, sha224, sha256, sha384, sha512
## auth.redis.password_hash = pbkdf2,sha256,1000,20

## Superuser Query Command
auth.redis.super_cmd = HGET mqtt_user:%u is_superuser

## ACL Query Command
auth.redis.acl_cmd = HGETALL mqtt_acl:%u
##--------------------------------------------------------------------
## Username Authentication Plugin
##--------------------------------------------------------------------

## Examples:
##auth.user.1.username = admin
##auth.user.1.password = public
##auth.user.2.username = feng@emqtt.io
##auth.user.2.password = public
##auth.user.3.username = name~!@#$%^&*()_+
##auth.user.3.password = pwsswd~!@#$%^&*()_+
##--------------------------------------------------------------------
## CoAP Gateway
##--------------------------------------------------------------------

coap.port = 5683

# Keepalive duration, unit could be:
#   s - seconds (default)
#   m - minutes
#   h - hours
coap.keepalive = 120s

coap.enable_stats = off

coap.certfile = etc/certs/cert.pem
coap.keyfile = etc/certs/key.pem


##--------------------------------------------------------------------
## Dashboard
##--------------------------------------------------------------------

## HTTP Listener
dashboard.listener.http = 18083
dashboard.listener.http.acceptors = 2
dashboard.listener.http.max_clients = 512

## HTTPS Listener
## dashboard.listener.https = 18084
## dashboard.listener.https.acceptors = 2
## dashboard.listener.https.max_clients = 512
## dashboard.listener.https.handshake_timeout = 15
## dashboard.listener.https.certfile = etc/certs/cert.pem
## dashboard.listener.https.keyfile = etc/certs/key.pem
## dashboard.listener.https.cacertfile = etc/certs/cacert.pem
## dashboard.listener.https.verify = verify_peer
## dashboard.listener.https.fail_if_no_peer_cert = true
##--------------------------------------------------------------------
## EMQ Lua Hook
##--------------------------------------------------------------------





##--------------------------------------------------------------------
## LWM2M Gateway
##--------------------------------------------------------------------

lwm2m.port = 5783


lwm2m.certfile = etc/certs/cert.pem
lwm2m.keyfile = etc/certs/key.pem

lwm2m.xml_dir =  etc/lwm2m_xml

##--------------------------------------------------------------------
## Presence Module
##--------------------------------------------------------------------

## Enable Presence, Values: on | off
module.presence = on

module.presence.qos = 1

##--------------------------------------------------------------------
## Subscription Module
##--------------------------------------------------------------------

## Enable Subscription, Values: on | off
module.subscription = on

## Subscribe the Topics automatically when client connected
module.subscription.1.topic = $client/%c
## Qos of the subscription: 0 | 1 | 2
module.subscription.1.qos = 1

## module.subscription.2.topic = $user/%u
## module.subscription.2.qos = 1

##--------------------------------------------------------------------
## Rewrite Module
##--------------------------------------------------------------------

## Enable Rewrite, Values: on | off
module.rewrite = off

## {rewrite, Topic, Re, Dest}
## module.rewrite.rule.1 = "x/# ^x/y/(.+)$ z/y/$1"
## module.rewrite.rule.2 = "y/+/z/# ^y/(.+)/z/(.+)$ y/z/$2"

##--------------------------------------------------------------------
## Recon Plugin
##--------------------------------------------------------------------

## Global GC Interval
## h - hour
## m - minute
## s - second
recon.gc_interval = 5m

##--------------------------------------------------------------------
## Reloader Plugin
##--------------------------------------------------------------------

reloader.interval = 60s

reloader.logfile = reloader.log

##--------------------------------------------------------------------
## Retainer Module
##--------------------------------------------------------------------

## ram: ram_copies, disc: disc_copies, disc_only: disc_only_copies
## Notice: retainer's storage_type on each node in a cluster should be same.
retainer.storage_type = ram

## Max number of retained messages
retainer.max_message_num = 1000000

## Max Payload Size of retained message
retainer.max_payload_size = 64KB

## Expiry interval. Never expired if 0
## h - hour
## m - minute
## s - second
retainer.expiry_interval = 0

##--------------------------------------------------------------------
## MQTT-SN
##--------------------------------------------------------------------

mqtt.sn.port = 1884
mqtt.sn.advertise_duration = 900
mqtt.sn.gateway_id = 1
mqtt.sn.enable_stats = off
mqtt.sn.enable_qos3 = off

## topicid 0x0000 and 0xFFFF is reserved
mqtt.sn.predefined.topic.0 = reserved
mqtt.sn.predefined.topic.1 = /predefined/topic/name/hello
mqtt.sn.predefined.topic.2 = /predefined/topic/name/nice

mqtt.sn.username = mqtt_sn_user
mqtt.sn.password = abc
##--------------------------------------------------------------------
## Stomp Plugin
##--------------------------------------------------------------------

stomp.default_user.login = guest

stomp.default_user.passcode = guest

stomp.allow_anonymous = true

stomp.frame.max_headers = 10

stomp.frame.max_header_length = 1024

stomp.frame.max_body_length = 8192

stomp.listener = 61613

stomp.listener.acceptors = 4

stomp.listener.max_clients = 512


web.hook.api.url = http://127.0.0.1

web.hook.rule.client.connected.1     = {"action": "on_client_connected"}
web.hook.rule.client.disconnected.1  = {"action": "on_client_disconnected"}
web.hook.rule.client.subscribe.1     = {"action": "on_client_subscribe"}
web.hook.rule.client.unsubscribe.1   = {"action": "on_client_unsubscribe"}
web.hook.rule.session.created.1      = {"action": "on_session_created"}
web.hook.rule.session.subscribed.1   = {"action": "on_session_subscribed"}
web.hook.rule.session.unsubscribed.1 = {"action": "on_session_unsubscribed"}
web.hook.rule.session.terminated.1   = {"action": "on_session_terminated"}
web.hook.rule.message.publish.1      = {"action": "on_message_publish"}
web.hook.rule.message.delivered.1    = {"action": "on_message_delivered"}
web.hook.rule.message.acked.1        = {"action": "on_message_acked"}
