Re: [mosquitto-dev] config file questions

[Greg Troxel <gdt@xxxxxxxxxx>]

Roger Light <roger@xxxxxxxxxx> writes:

>> 5. The "per_listener_settings" section in mosquitto.conf(5) is
>> confusing.  It does not explain what it means for authentication to be
>> separate per listener, and it isn't quite clear what a listener is, and
>> why one does or doesn't want to use this.
>
> Thanks, that's a good comment, I'll see about improving it.

(Having been on the other side, I realize that it's hard to explain
things to newcomers when you understand them intimately.)

I figured out all of this pretty quickly, but I'm much more experienced
than is typical in both sysadmin and protocol specs/implementations.

My confusions about listeners are:

  the config file description gives a bunch of statements, but it does
  not describe structure.  This gives the impression that the statements
  are unordered and essentially form a set.  But this is not true; there
  is a hierarchy where some statements create listeners and some
  statements affect the listener that is currently being defined, which
  might be implicit.

  The documentation talks about port 1883 vs 8883, which is obviously a
  pair that one does not and does usually use TLS on.  But it doesn't
  say that port number and TLS are or are not linked.  I think they
  aren't linked in code, just by custom.

  I now think that a listener is TLS iff it has a capath statement.  Or
  maybe it's certfile/keyfile.  If capath matters, this doesn't really
  make sense, because if you're going to use TLS on the server, say with
  a LE cert, and use username/password with clients, there is no need
  for the server to validate certificates.  So I think there should be
  an explicit 'do_tls true/false'.  That would also be far easier to
  understand on reading the man page and reading the config file.

  I think even with per_listener true, there should be a way to have
  config that affects all listeners.

  I tried to disable the default listener but because I had capath
  earlier (before I switched to per_listner).  So I think it would be
  far better to say that the default listener only happens if there is
  no listener defined, and once you define one, the default one is gone.
  That lets the no-config option listen w/o TLS on 1883, presumably for
  testing, and means that a config with a definition is much less
  mysterious.


Which is to say I am no longer confused; now I merely think the next
person to try to configure anything non-default will get it wrong :-)