|
|
|
|
@ -56,7 +56,7 @@ cluster.autoclean = 5m
|
|
|
|
|
## Node list of the cluster.
|
|
|
|
|
##
|
|
|
|
|
## Value: String
|
|
|
|
|
## cluster.static.seeds = emqx1@127.0.0.1,emqx2@127.0.0.1
|
|
|
|
|
## cluster.static.seeds = "emqx1@127.0.0.1,emqx2@127.0.0.1"
|
|
|
|
|
|
|
|
|
|
##--------------------------------------------------------------------
|
|
|
|
|
## Cluster using IP Multicast.
|
|
|
|
|
@ -64,19 +64,19 @@ cluster.autoclean = 5m
|
|
|
|
|
## IP Multicast Address.
|
|
|
|
|
##
|
|
|
|
|
## Value: IP Address
|
|
|
|
|
## cluster.mcast.addr = 239.192.0.1
|
|
|
|
|
## cluster.mcast.addr = "239.192.0.1"
|
|
|
|
|
|
|
|
|
|
## Multicast Ports.
|
|
|
|
|
##
|
|
|
|
|
## Value: Port List
|
|
|
|
|
## cluster.mcast.ports = 4369,4370
|
|
|
|
|
## cluster.mcast.ports = "4369,4370"
|
|
|
|
|
|
|
|
|
|
## Multicast Iface.
|
|
|
|
|
##
|
|
|
|
|
## Value: Iface Address
|
|
|
|
|
##
|
|
|
|
|
## Default: 0.0.0.0
|
|
|
|
|
## cluster.mcast.iface = 0.0.0.0
|
|
|
|
|
## Default: "0.0.0.0"
|
|
|
|
|
## cluster.mcast.iface = "0.0.0.0"
|
|
|
|
|
|
|
|
|
|
## Multicast Ttl.
|
|
|
|
|
##
|
|
|
|
|
@ -107,7 +107,14 @@ cluster.autoclean = 5m
|
|
|
|
|
## Etcd server list, seperated by ','.
|
|
|
|
|
##
|
|
|
|
|
## Value: String
|
|
|
|
|
## cluster.etcd.server = http://127.0.0.1:2379
|
|
|
|
|
## cluster.etcd.server = "http://127.0.0.1:2379"
|
|
|
|
|
|
|
|
|
|
## Etcd api version
|
|
|
|
|
##
|
|
|
|
|
## Value: Enum
|
|
|
|
|
## - v2
|
|
|
|
|
## - v3
|
|
|
|
|
## cluster.etcd.version = v3
|
|
|
|
|
|
|
|
|
|
## The prefix helps build nodes path in etcd. Each node in the cluster
|
|
|
|
|
## will create a path in etcd: v2/keys/<prefix>/<cluster.name>/<node.name>
|
|
|
|
|
@ -125,18 +132,18 @@ cluster.autoclean = 5m
|
|
|
|
|
## Path to a file containing the client's private PEM-encoded key.
|
|
|
|
|
##
|
|
|
|
|
## Value: File
|
|
|
|
|
## cluster.etcd.ssl.keyfile = {{ platform_etc_dir }}/certs/client-key.pem
|
|
|
|
|
## cluster.etcd.ssl.keyfile = "{{ platform_etc_dir }}/certs/client-key.pem"
|
|
|
|
|
|
|
|
|
|
## The path to a file containing the client's certificate.
|
|
|
|
|
##
|
|
|
|
|
## Value: File
|
|
|
|
|
## cluster.etcd.ssl.certfile = {{ platform_etc_dir }}/certs/client.pem
|
|
|
|
|
## cluster.etcd.ssl.certfile = "{{ platform_etc_dir }}/certs/client.pem"
|
|
|
|
|
|
|
|
|
|
## Path to the file containing PEM-encoded CA certificates. The CA certificates
|
|
|
|
|
## are used during server authentication and when building the client certificate chain.
|
|
|
|
|
##
|
|
|
|
|
## Value: File
|
|
|
|
|
## cluster.etcd.ssl.cacertfile = {{ platform_etc_dir }}/certs/ca.pem
|
|
|
|
|
## cluster.etcd.ssl.cacertfile = "{{ platform_etc_dir }}/certs/ca.pem"
|
|
|
|
|
|
|
|
|
|
##--------------------------------------------------------------------
|
|
|
|
|
## Cluster using Kubernetes
|
|
|
|
|
@ -144,7 +151,7 @@ cluster.autoclean = 5m
|
|
|
|
|
## Kubernetes API server list, seperated by ','.
|
|
|
|
|
##
|
|
|
|
|
## Value: String
|
|
|
|
|
## cluster.k8s.apiserver = http://10.110.111.204:8080
|
|
|
|
|
## cluster.k8s.apiserver = "http://10.110.111.204:8080"
|
|
|
|
|
|
|
|
|
|
## The service name helps lookup EMQ nodes in the cluster.
|
|
|
|
|
##
|
|
|
|
|
@ -184,17 +191,17 @@ cluster.autoclean = 5m
|
|
|
|
|
## Value: <name>@<host>
|
|
|
|
|
##
|
|
|
|
|
## Default: emqx@127.0.0.1
|
|
|
|
|
node.name = emqx@127.0.0.1
|
|
|
|
|
node.name = "emqx@127.0.0.1"
|
|
|
|
|
|
|
|
|
|
## Cookie for distributed node communication.
|
|
|
|
|
##
|
|
|
|
|
## Value: String
|
|
|
|
|
node.cookie = emqxsecretcookie
|
|
|
|
|
node.cookie = "emqxsecretcookie"
|
|
|
|
|
|
|
|
|
|
## Data dir for the node
|
|
|
|
|
##
|
|
|
|
|
## Value: Folder
|
|
|
|
|
node.data_dir = {{ platform_data_dir }}
|
|
|
|
|
node.data_dir = "{{ platform_data_dir }}"
|
|
|
|
|
|
|
|
|
|
## Heartbeat monitoring of an Erlang runtime system. Comment the line to disable
|
|
|
|
|
## heartbeat, or set the value as 'on'
|
|
|
|
|
@ -271,14 +278,14 @@ node.global_gc_interval = 15m
|
|
|
|
|
## Crash dump log file.
|
|
|
|
|
##
|
|
|
|
|
## Value: Log file
|
|
|
|
|
node.crash_dump = {{ platform_log_dir }}/crash.dump
|
|
|
|
|
node.crash_dump = "{{ platform_log_dir }}/crash.dump"
|
|
|
|
|
|
|
|
|
|
## Specify SSL Options in the file if using SSL for Erlang Distribution.
|
|
|
|
|
##
|
|
|
|
|
## Value: File
|
|
|
|
|
##
|
|
|
|
|
## vm.args: -ssl_dist_optfile <File>
|
|
|
|
|
## node.ssl_dist_optfile = {{ platform_etc_dir }}/ssl_dist.conf
|
|
|
|
|
## node.ssl_dist_optfile = "{{ platform_etc_dir }}/ssl_dist.conf"
|
|
|
|
|
|
|
|
|
|
## Sets the net_kernel tick time. TickTime is specified in seconds.
|
|
|
|
|
## Notice that all communicating nodes are to have the same TickTime
|
|
|
|
|
@ -419,10 +426,17 @@ log.to = file
|
|
|
|
|
## Default: warning
|
|
|
|
|
log.level = warning
|
|
|
|
|
|
|
|
|
|
## Timezone offset to display in logs
|
|
|
|
|
## Value:
|
|
|
|
|
## - "system" use system zone
|
|
|
|
|
## - "utc" for Universal Coordinated Time (UTC)
|
|
|
|
|
## - "+hh:mm" or "-hh:mm" for a specified offset
|
|
|
|
|
log.time_offset = system
|
|
|
|
|
|
|
|
|
|
## The dir for log files.
|
|
|
|
|
##
|
|
|
|
|
## Value: Folder
|
|
|
|
|
log.dir = {{ platform_log_dir }}
|
|
|
|
|
log.dir = "{{ platform_log_dir }}"
|
|
|
|
|
|
|
|
|
|
## The log filename for logs of level specified in "log.level".
|
|
|
|
|
##
|
|
|
|
|
@ -460,7 +474,7 @@ log.file = emqx.log
|
|
|
|
|
##
|
|
|
|
|
## Value: on | off
|
|
|
|
|
## Default: on
|
|
|
|
|
log.rotation = on
|
|
|
|
|
log.rotation.enable = on
|
|
|
|
|
|
|
|
|
|
## Maximum size of each log file.
|
|
|
|
|
##
|
|
|
|
|
@ -579,7 +593,7 @@ log.rotation.count = 5
|
|
|
|
|
## Value: MaxBurstCount,TimeWindow
|
|
|
|
|
## Default: disabled
|
|
|
|
|
##
|
|
|
|
|
#log.burst_limit = 20000, 1s
|
|
|
|
|
#log.burst_limit = "20000, 1s"
|
|
|
|
|
|
|
|
|
|
## CONFIG_SECTION_END=logger ===================================================
|
|
|
|
|
|
|
|
|
|
@ -591,42 +605,42 @@ log.rotation.count = 5
|
|
|
|
|
## Notice: Disable the option in production deployment!
|
|
|
|
|
##
|
|
|
|
|
## Value: true | false
|
|
|
|
|
allow_anonymous = true
|
|
|
|
|
acl.allow_anonymous = true
|
|
|
|
|
|
|
|
|
|
## Allow or deny if no ACL rules matched.
|
|
|
|
|
##
|
|
|
|
|
## Value: allow | deny
|
|
|
|
|
acl_nomatch = allow
|
|
|
|
|
acl.acl_nomatch = allow
|
|
|
|
|
|
|
|
|
|
## Default ACL File.
|
|
|
|
|
##
|
|
|
|
|
## Value: File Name
|
|
|
|
|
acl_file = {{ platform_etc_dir }}/acl.conf
|
|
|
|
|
acl.acl_file = "{{ platform_etc_dir }}/acl.conf"
|
|
|
|
|
|
|
|
|
|
## Whether to enable ACL cache.
|
|
|
|
|
##
|
|
|
|
|
## If enabled, ACLs roles for each client will be cached in the memory
|
|
|
|
|
##
|
|
|
|
|
## Value: on | off
|
|
|
|
|
enable_acl_cache = on
|
|
|
|
|
acl.enable_acl_cache = on
|
|
|
|
|
|
|
|
|
|
## The maximum count of ACL entries can be cached for a client.
|
|
|
|
|
##
|
|
|
|
|
## Value: Integer greater than 0
|
|
|
|
|
## Default: 32
|
|
|
|
|
acl_cache_max_size = 32
|
|
|
|
|
acl.acl_cache_max_size = 32
|
|
|
|
|
|
|
|
|
|
## The time after which an ACL cache entry will be deleted
|
|
|
|
|
##
|
|
|
|
|
## Value: Duration
|
|
|
|
|
## Default: 1 minute
|
|
|
|
|
acl_cache_ttl = 1m
|
|
|
|
|
acl.acl_cache_ttl = 1m
|
|
|
|
|
|
|
|
|
|
## The action when acl check reject current operation
|
|
|
|
|
##
|
|
|
|
|
## Value: ignore | disconnect
|
|
|
|
|
## Default: ignore
|
|
|
|
|
acl_deny_action = ignore
|
|
|
|
|
acl.acl_deny_action = ignore
|
|
|
|
|
|
|
|
|
|
## Specify the global flapping detect policy.
|
|
|
|
|
## The value is a string composed of flapping threshold, duration and banned interval.
|
|
|
|
|
@ -635,7 +649,7 @@ acl_deny_action = ignore
|
|
|
|
|
## 3. banned interval: the banned interval if a flapping is detected.
|
|
|
|
|
##
|
|
|
|
|
## Value: Integer,Duration,Duration
|
|
|
|
|
flapping_detect_policy = 30, 1m, 5m
|
|
|
|
|
acl.flapping_detect_policy = "30, 1m, 5m"
|
|
|
|
|
|
|
|
|
|
##--------------------------------------------------------------------
|
|
|
|
|
## MQTT Protocol
|
|
|
|
|
@ -732,7 +746,7 @@ zone.external.acl_deny_action = ignore
|
|
|
|
|
## messages | bytes passed through.
|
|
|
|
|
##
|
|
|
|
|
## Numbers delimited by `|'. Zero or negative is to disable.
|
|
|
|
|
zone.external.force_gc_policy = 16000|16MB
|
|
|
|
|
zone.external.force_gc_policy = "16000|16MB"
|
|
|
|
|
|
|
|
|
|
## Max message queue length and total heap size to force shutdown
|
|
|
|
|
## connection/session process.
|
|
|
|
|
@ -742,9 +756,9 @@ zone.external.force_gc_policy = 16000|16MB
|
|
|
|
|
## Numbers delimited by `|'. Zero or negative is to disable.
|
|
|
|
|
##
|
|
|
|
|
## Default:
|
|
|
|
|
## - 10000|64MB on ARCH_64 system
|
|
|
|
|
## - 1000|32MB on ARCH_32 sytem
|
|
|
|
|
#zone.external.force_shutdown_policy = 10000|64MB
|
|
|
|
|
## - "10000|64MB" on ARCH_64 system
|
|
|
|
|
## - "1000|32MB" on ARCH_32 sytem
|
|
|
|
|
#zone.external.force_shutdown_policy = "10000|64MB"
|
|
|
|
|
|
|
|
|
|
## Maximum MQTT packet size allowed.
|
|
|
|
|
##
|
|
|
|
|
@ -850,7 +864,7 @@ zone.external.max_mqueue_len = 1000
|
|
|
|
|
## are treated equal
|
|
|
|
|
##
|
|
|
|
|
## Priority number [1-255]
|
|
|
|
|
## Example: topic/1=10,topic/2=8
|
|
|
|
|
## Example: "topic/1=10,topic/2=8"
|
|
|
|
|
## NOTE: comma and equal signs are not allowed for priority topic names
|
|
|
|
|
## NOTE: messages for topics not in the priority table are treated as
|
|
|
|
|
## either highest or lowest priority depending on the configured
|
|
|
|
|
@ -877,13 +891,13 @@ zone.external.enable_flapping_detect = off
|
|
|
|
|
##
|
|
|
|
|
## Value: Number,Duration
|
|
|
|
|
## Example: 100 messages per 10 seconds.
|
|
|
|
|
#zone.external.rate_limit.conn_messages_in = 100,10s
|
|
|
|
|
#zone.external.rate_limit.conn_messages_in = "100,10s"
|
|
|
|
|
|
|
|
|
|
## Bytes limit for a external MQTT connections.
|
|
|
|
|
##
|
|
|
|
|
## Value: Number,Duration
|
|
|
|
|
## Example: 100KB incoming per 10 seconds.
|
|
|
|
|
#zone.external.rate_limit.conn_bytes_in = 100KB,10s
|
|
|
|
|
#zone.external.rate_limit.conn_bytes_in = "100KB,10s"
|
|
|
|
|
|
|
|
|
|
## Whether to alarm the congested connections.
|
|
|
|
|
##
|
|
|
|
|
@ -914,16 +928,16 @@ zone.external.enable_flapping_detect = off
|
|
|
|
|
##
|
|
|
|
|
## Value: Number, Duration
|
|
|
|
|
##
|
|
|
|
|
## Example: 100 messaegs per 1s
|
|
|
|
|
#zone.external.quota.conn_messages_routing = 100,1s
|
|
|
|
|
## Example: 100 messages per 1s
|
|
|
|
|
#zone.external.quota.conn_messages_routing = "100,1s"
|
|
|
|
|
|
|
|
|
|
## Messages quota for the all of external MQTT connections.
|
|
|
|
|
## This value consumed by the number of recipient on a message.
|
|
|
|
|
##
|
|
|
|
|
## Value: Number, Duration
|
|
|
|
|
##
|
|
|
|
|
## Example: 200000 messaegs per 1s
|
|
|
|
|
#zone.external.quota.overall_messages_routing = 200000,1s
|
|
|
|
|
## Example: 200000 messages per 1s
|
|
|
|
|
#zone.external.quota.overall_messages_routing = "200000,1s"
|
|
|
|
|
|
|
|
|
|
## All the topics will be prefixed with the mountpoint path if this option is enabled.
|
|
|
|
|
##
|
|
|
|
|
@ -932,7 +946,7 @@ zone.external.enable_flapping_detect = off
|
|
|
|
|
## - %u: username
|
|
|
|
|
##
|
|
|
|
|
## Value: String
|
|
|
|
|
## zone.external.mountpoint = devicebound/
|
|
|
|
|
## zone.external.mountpoint = "devicebound/"
|
|
|
|
|
|
|
|
|
|
## Whether use username replace client id
|
|
|
|
|
##
|
|
|
|
|
@ -977,7 +991,7 @@ zone.internal.enable_acl = off
|
|
|
|
|
zone.internal.acl_deny_action = ignore
|
|
|
|
|
|
|
|
|
|
## See zone.$name.force_gc_policy
|
|
|
|
|
## zone.internal.force_gc_policy = 128000|128MB
|
|
|
|
|
## zone.internal.force_gc_policy = "128000|128MB"
|
|
|
|
|
|
|
|
|
|
## See zone.$name.wildcard_subscription.
|
|
|
|
|
##
|
|
|
|
|
@ -1022,8 +1036,8 @@ zone.internal.enable_flapping_detect = off
|
|
|
|
|
## See zone.$name.force_shutdown_policy
|
|
|
|
|
##
|
|
|
|
|
## Default:
|
|
|
|
|
## - 10000|64MB on ARCH_64 system
|
|
|
|
|
## - 1000|32MB on ARCH_32 sytem
|
|
|
|
|
## - "10000|64MB" on ARCH_64 system
|
|
|
|
|
## - "1000|32MB" on ARCH_32 sytem
|
|
|
|
|
#zone.internal.force_shutdown_policy = 10000|64MB
|
|
|
|
|
|
|
|
|
|
## All the topics will be prefixed with the mountpoint path if this option is enabled.
|
|
|
|
|
@ -1033,7 +1047,7 @@ zone.internal.enable_flapping_detect = off
|
|
|
|
|
## - %u: username
|
|
|
|
|
##
|
|
|
|
|
## Value: String
|
|
|
|
|
## zone.internal.mountpoint = cloudbound/
|
|
|
|
|
## zone.internal.mountpoint = "cloudbound/"
|
|
|
|
|
|
|
|
|
|
## Whether to ignore loop delivery of messages.(for mqtt v3.1.1)
|
|
|
|
|
##
|
|
|
|
|
@ -1067,8 +1081,8 @@ zone.internal.bypass_auth_plugins = true
|
|
|
|
|
##
|
|
|
|
|
## Value: IP:Port | Port
|
|
|
|
|
##
|
|
|
|
|
## Examples: 1883, 127.0.0.1:1883, ::1:1883
|
|
|
|
|
listener.tcp.external = 0.0.0.0:1883
|
|
|
|
|
## Examples: 1883, "127.0.0.1:1883", "::1:1883"
|
|
|
|
|
listener.tcp.external.endpoint = "0.0.0.0:1883"
|
|
|
|
|
|
|
|
|
|
## The acceptor pool for external MQTT/TCP listener.
|
|
|
|
|
##
|
|
|
|
|
@ -1103,8 +1117,8 @@ listener.tcp.external.zone = external
|
|
|
|
|
##
|
|
|
|
|
## Value: ACL Rule
|
|
|
|
|
##
|
|
|
|
|
## Example: allow 192.168.0.0/24
|
|
|
|
|
listener.tcp.external.access.1 = allow all
|
|
|
|
|
## Example: "allow 192.168.0.0/24"
|
|
|
|
|
listener.tcp.external.access.1 = "allow all"
|
|
|
|
|
|
|
|
|
|
## Enable the Proxy Protocol V1/2 if the EMQ X cluster is deployed
|
|
|
|
|
## behind HAProxy or Nginx.
|
|
|
|
|
@ -1207,8 +1221,8 @@ listener.tcp.external.reuseaddr = true
|
|
|
|
|
##
|
|
|
|
|
## Value: IP:Port, Port
|
|
|
|
|
##
|
|
|
|
|
## Examples: 11883, 127.0.0.1:11883, ::1:11883
|
|
|
|
|
listener.tcp.internal = 127.0.0.1:11883
|
|
|
|
|
## Examples: 11883, "127.0.0.1:11883", "::1:11883"
|
|
|
|
|
listener.tcp.internal.endpoint = "127.0.0.1:11883"
|
|
|
|
|
|
|
|
|
|
## The acceptor pool for internal MQTT/TCP listener.
|
|
|
|
|
##
|
|
|
|
|
@ -1304,8 +1318,8 @@ listener.tcp.internal.reuseaddr = true
|
|
|
|
|
##
|
|
|
|
|
## Value: IP:Port | Port
|
|
|
|
|
##
|
|
|
|
|
## Examples: 8883, 127.0.0.1:8883, ::1:8883
|
|
|
|
|
listener.ssl.external = 8883
|
|
|
|
|
## Examples: 8883, "127.0.0.1:8883", "::1:8883"
|
|
|
|
|
listener.ssl.external.endpoint = 8883
|
|
|
|
|
|
|
|
|
|
## The acceptor pool for external MQTT/SSL listener.
|
|
|
|
|
##
|
|
|
|
|
@ -1337,7 +1351,7 @@ listener.ssl.external.zone = external
|
|
|
|
|
## See: listener.tcp.$name.access
|
|
|
|
|
##
|
|
|
|
|
## Value: ACL Rule
|
|
|
|
|
listener.ssl.external.access.1 = allow all
|
|
|
|
|
listener.ssl.external.access.1 = "allow all"
|
|
|
|
|
|
|
|
|
|
## Enable the Proxy Protocol V1/2 if the EMQ cluster is deployed behind
|
|
|
|
|
## HAProxy or Nginx.
|
|
|
|
|
@ -1360,7 +1374,7 @@ listener.ssl.external.access.1 = allow all
|
|
|
|
|
##
|
|
|
|
|
## Value: String, seperated by ','
|
|
|
|
|
## NOTE: Do not use tlsv1.3 if emqx is running on OTP-22 or earlier
|
|
|
|
|
## listener.ssl.external.tls_versions = tlsv1.3,tlsv1.2,tlsv1.1,tlsv1
|
|
|
|
|
## listener.ssl.external.tls_versions = "tlsv1.3,tlsv1.2,tlsv1.1,tlsv1"
|
|
|
|
|
|
|
|
|
|
## TLS Handshake timeout.
|
|
|
|
|
##
|
|
|
|
|
@ -1384,20 +1398,20 @@ listener.ssl.external.handshake_timeout = 15s
|
|
|
|
|
## See: http://erlang.org/doc/man/ssl.html
|
|
|
|
|
##
|
|
|
|
|
## Value: File
|
|
|
|
|
listener.ssl.external.keyfile = {{ platform_etc_dir }}/certs/key.pem
|
|
|
|
|
listener.ssl.external.keyfile = "{{ platform_etc_dir }}/certs/key.pem"
|
|
|
|
|
|
|
|
|
|
## Path to a file containing the user certificate.
|
|
|
|
|
##
|
|
|
|
|
## See: http://erlang.org/doc/man/ssl.html
|
|
|
|
|
##
|
|
|
|
|
## Value: File
|
|
|
|
|
listener.ssl.external.certfile = {{ platform_etc_dir }}/certs/cert.pem
|
|
|
|
|
listener.ssl.external.certfile = "{{ platform_etc_dir }}/certs/cert.pem"
|
|
|
|
|
|
|
|
|
|
## Path to the file containing PEM-encoded CA certificates. The CA certificates
|
|
|
|
|
## are used during server authentication and when building the client certificate chain.
|
|
|
|
|
##
|
|
|
|
|
## Value: File
|
|
|
|
|
## listener.ssl.external.cacertfile = {{ platform_etc_dir }}/certs/cacert.pem
|
|
|
|
|
## listener.ssl.external.cacertfile = "{{ platform_etc_dir }}/certs/cacert.pem"
|
|
|
|
|
|
|
|
|
|
## The Ephemeral Diffie-Helman key exchange is a very effective way of
|
|
|
|
|
## ensuring Forward Secrecy by exchanging a set of keys that never hit
|
|
|
|
|
@ -1414,7 +1428,7 @@ listener.ssl.external.certfile = {{ platform_etc_dir }}/certs/cert.pem
|
|
|
|
|
## openssl dhparam -out dh-params.pem 2048
|
|
|
|
|
##
|
|
|
|
|
## Value: File
|
|
|
|
|
## listener.ssl.external.dhfile = {{ platform_etc_dir }}/certs/dh-params.pem
|
|
|
|
|
## listener.ssl.external.dhfile = "{{ platform_etc_dir }}/certs/dh-params.pem"
|
|
|
|
|
|
|
|
|
|
## A server only does x509-path validation in mode verify_peer,
|
|
|
|
|
## as it then sends a certificate request to the client (this
|
|
|
|
|
@ -1449,14 +1463,13 @@ listener.ssl.external.certfile = {{ platform_etc_dir }}/certs/cert.pem
|
|
|
|
|
## Most of it was copied from Mozilla’s Server Side TLS article
|
|
|
|
|
##
|
|
|
|
|
## Value: Ciphers
|
|
|
|
|
listener.ssl.external.ciphers = TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_CHACHA20_POLY1305_SHA256,TLS_AES_128_CCM_SHA256,TLS_AES_128_CCM_8_SHA256,ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-RSA-AES256-GCM-SHA384,ECDHE-ECDSA-AES256-SHA384,ECDHE-RSA-AES256-SHA384,ECDHE-ECDSA-DES-CBC3-SHA,ECDH-ECDSA-AES256-GCM-SHA384,ECDH-RSA-AES256-GCM-SHA384,ECDH-ECDSA-AES256-SHA384,ECDH-RSA-AES256-SHA384,DHE-DSS-AES256-GCM-SHA384,DHE-DSS-AES256-SHA256,AES256-GCM-SHA384,AES256-SHA256,ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-RSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES128-SHA256,ECDHE-RSA-AES128-SHA256,ECDH-ECDSA-AES128-GCM-SHA256,ECDH-RSA-AES128-GCM-SHA256,ECDH-ECDSA-AES128-SHA256,ECDH-RSA-AES128-SHA256,DHE-DSS-AES128-GCM-SHA256,DHE-DSS-AES128-SHA256,AES128-GCM-SHA256,AES128-SHA256,ECDHE-ECDSA-AES256-SHA,ECDHE-RSA-AES256-SHA,DHE-DSS-AES256-SHA,ECDH-ECDSA-AES256-SHA,ECDH-RSA-AES256-SHA,AES256-SHA,ECDHE-ECDSA-AES128-SHA,ECDHE-RSA-AES128-SHA,DHE-DSS-AES128-SHA,ECDH-ECDSA-AES128-SHA,ECDH-RSA-AES128-SHA,AES128-SHA
|
|
|
|
|
|
|
|
|
|
listener.ssl.external.ciphers = "TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_CHACHA20_POLY1305_SHA256,TLS_AES_128_CCM_SHA256,TLS_AES_128_CCM_8_SHA256,ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-RSA-AES256-GCM-SHA384,ECDHE-ECDSA-AES256-SHA384,ECDHE-RSA-AES256-SHA384,ECDHE-ECDSA-DES-CBC3-SHA,ECDH-ECDSA-AES256-GCM-SHA384,ECDH-RSA-AES256-GCM-SHA384,ECDH-ECDSA-AES256-SHA384,ECDH-RSA-AES256-SHA384,DHE-DSS-AES256-GCM-SHA384,DHE-DSS-AES256-SHA256,AES256-GCM-SHA384,AES256-SHA256,ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-RSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES128-SHA256,ECDHE-RSA-AES128-SHA256,ECDH-ECDSA-AES128-GCM-SHA256,ECDH-RSA-AES128-GCM-SHA256,ECDH-ECDSA-AES128-SHA256,ECDH-RSA-AES128-SHA256,DHE-DSS-AES128-GCM-SHA256,DHE-DSS-AES128-SHA256,AES128-GCM-SHA256,AES128-SHA256,ECDHE-ECDSA-AES256-SHA,ECDHE-RSA-AES256-SHA,DHE-DSS-AES256-SHA,ECDH-ECDSA-AES256-SHA,ECDH-RSA-AES256-SHA,AES256-SHA,ECDHE-ECDSA-AES128-SHA,ECDHE-RSA-AES128-SHA,DHE-DSS-AES128-SHA,ECDH-ECDSA-AES128-SHA,ECDH-RSA-AES128-SHA,AES128-SHA"
|
|
|
|
|
|
|
|
|
|
## Ciphers for TLS PSK.
|
|
|
|
|
## Note that 'listener.ssl.external.ciphers' and 'listener.ssl.external.psk_ciphers' cannot
|
|
|
|
|
## be configured at the same time.
|
|
|
|
|
## See 'https://tools.ietf.org/html/rfc4279#section-2'.
|
|
|
|
|
#listener.ssl.external.psk_ciphers = PSK-AES128-CBC-SHA,PSK-AES256-CBC-SHA,PSK-3DES-EDE-CBC-SHA,PSK-RC4-SHA
|
|
|
|
|
#listener.ssl.external.psk_ciphers = "PSK-AES128-CBC-SHA,PSK-AES256-CBC-SHA,PSK-3DES-EDE-CBC-SHA,PSK-RC4-SHA"
|
|
|
|
|
|
|
|
|
|
## SSL parameter renegotiation is a feature that allows a client and a server
|
|
|
|
|
## to renegotiate the parameters of the SSL connection on the fly.
|
|
|
|
|
@ -1566,13 +1579,13 @@ listener.ssl.external.reuseaddr = true
|
|
|
|
|
##
|
|
|
|
|
## Value: IP:Port | Port
|
|
|
|
|
##
|
|
|
|
|
## Examples: 8083, 127.0.0.1:8083, ::1:8083
|
|
|
|
|
listener.ws.external = 8083
|
|
|
|
|
## Examples: 8083, "127.0.0.1:8083", "::1:8083"
|
|
|
|
|
listener.ws.external.endpoint = 8083
|
|
|
|
|
|
|
|
|
|
## The path of WebSocket MQTT endpoint
|
|
|
|
|
##
|
|
|
|
|
## Value: URL Path
|
|
|
|
|
listener.ws.external.mqtt_path = /mqtt
|
|
|
|
|
listener.ws.external.mqtt_path = "/mqtt"
|
|
|
|
|
|
|
|
|
|
## The acceptor pool for external MQTT/WebSocket listener.
|
|
|
|
|
##
|
|
|
|
|
@ -1604,7 +1617,7 @@ listener.ws.external.zone = external
|
|
|
|
|
## See: listener.ws.$name.access
|
|
|
|
|
##
|
|
|
|
|
## Value: ACL Rule
|
|
|
|
|
listener.ws.external.access.1 = allow all
|
|
|
|
|
listener.ws.external.access.1 = "allow all"
|
|
|
|
|
|
|
|
|
|
## If set to true, the server fails if the client does not have a Sec-WebSocket-Protocol to send.
|
|
|
|
|
## Set to false for WeChat MiniApp.
|
|
|
|
|
@ -1615,7 +1628,7 @@ listener.ws.external.access.1 = allow all
|
|
|
|
|
## Supported subprotocols
|
|
|
|
|
##
|
|
|
|
|
## Default: mqtt, mqtt-v3, mqtt-v3.1.1, mqtt-v5
|
|
|
|
|
## listener.ws.external.supported_subprotocols = mqtt, mqtt-v3, mqtt-v3.1.1, mqtt-v5
|
|
|
|
|
## listener.ws.external.supported_subprotocols = "mqtt, mqtt-v3, mqtt-v3.1.1, mqtt-v5"
|
|
|
|
|
|
|
|
|
|
## Specify which HTTP header for real source IP if the EMQ X cluster is
|
|
|
|
|
## deployed behind NGINX or HAProxy.
|
|
|
|
|
@ -1823,7 +1836,7 @@ listener.ws.external.allow_origin_absence = true
|
|
|
|
|
## Comma separated list of allowed origin in header for websocket connection
|
|
|
|
|
##
|
|
|
|
|
## Value: http://url eg. local http dashboard url - http://localhost:18083, http://127.0.0.1:18083
|
|
|
|
|
listener.ws.external.check_origins = http://localhost:18083, http://127.0.0.1:18083
|
|
|
|
|
listener.ws.external.check_origins = "http://localhost:18083, http://127.0.0.1:18083"
|
|
|
|
|
|
|
|
|
|
##--------------------------------------------------------------------
|
|
|
|
|
## External WebSocket/SSL listener for MQTT Protocol
|
|
|
|
|
@ -1833,13 +1846,13 @@ listener.ws.external.check_origins = http://localhost:18083, http://127.0.0.1:18
|
|
|
|
|
##
|
|
|
|
|
## Value: IP:Port | Port
|
|
|
|
|
##
|
|
|
|
|
## Examples: 8084, 127.0.0.1:8084, ::1:8084
|
|
|
|
|
listener.wss.external = 8084
|
|
|
|
|
## Examples: 8084, "127.0.0.1:8084", "::1:8084"
|
|
|
|
|
listener.wss.external.endpoint = 8084
|
|
|
|
|
|
|
|
|
|
## The path of WebSocket MQTT endpoint
|
|
|
|
|
##
|
|
|
|
|
## Value: URL Path
|
|
|
|
|
listener.wss.external.mqtt_path = /mqtt
|
|
|
|
|
listener.wss.external.mqtt_path = "/mqtt"
|
|
|
|
|
|
|
|
|
|
## The acceptor pool for external MQTT/WebSocket/SSL listener.
|
|
|
|
|
##
|
|
|
|
|
@ -1873,7 +1886,7 @@ listener.wss.external.zone = external
|
|
|
|
|
## See: listener.tcp.$name.access.<no>
|
|
|
|
|
##
|
|
|
|
|
## Value: ACL Rule
|
|
|
|
|
listener.wss.external.access.1 = allow all
|
|
|
|
|
listener.wss.external.access.1 = "allow all"
|
|
|
|
|
|
|
|
|
|
## If set to true, the server fails if the client does not have a Sec-WebSocket-Protocol to send.
|
|
|
|
|
## Set to false for WeChat MiniApp.
|
|
|
|
|
@ -1884,7 +1897,7 @@ listener.wss.external.access.1 = allow all
|
|
|
|
|
## Supported subprotocols
|
|
|
|
|
##
|
|
|
|
|
## Default: mqtt, mqtt-v3, mqtt-v3.1.1, mqtt-v5
|
|
|
|
|
## listener.wss.external.supported_subprotocols = mqtt, mqtt-v3, mqtt-v3.1.1, mqtt-v5
|
|
|
|
|
## listener.wss.external.supported_subprotocols = "mqtt, mqtt-v3, mqtt-v3.1.1, mqtt-v5"
|
|
|
|
|
|
|
|
|
|
## Specify which HTTP header for real source IP if the EMQ X cluster is
|
|
|
|
|
## deployed behind NGINX or HAProxy.
|
|
|
|
|
@ -1918,28 +1931,28 @@ listener.wss.external.access.1 = allow all
|
|
|
|
|
##
|
|
|
|
|
## Value: String, seperated by ','
|
|
|
|
|
## NOTE: Do not use tlsv1.3 if emqx is running on OTP-22 or earlier
|
|
|
|
|
## listener.wss.external.tls_versions = tlsv1.3,tlsv1.2,tlsv1.1,tlsv1
|
|
|
|
|
## listener.wss.external.tls_versions = "tlsv1.3,tlsv1.2,tlsv1.1,tlsv1"
|
|
|
|
|
|
|
|
|
|
## Path to the file containing the user's private PEM-encoded key.
|
|
|
|
|
##
|
|
|
|
|
## See: listener.ssl.$name.keyfile
|
|
|
|
|
##
|
|
|
|
|
## Value: File
|
|
|
|
|
listener.wss.external.keyfile = {{ platform_etc_dir }}/certs/key.pem
|
|
|
|
|
listener.wss.external.keyfile = "{{ platform_etc_dir }}/certs/key.pem"
|
|
|
|
|
|
|
|
|
|
## Path to a file containing the user certificate.
|
|
|
|
|
##
|
|
|
|
|
## See: listener.ssl.$name.certfile
|
|
|
|
|
##
|
|
|
|
|
## Value: File
|
|
|
|
|
listener.wss.external.certfile = {{ platform_etc_dir }}/certs/cert.pem
|
|
|
|
|
listener.wss.external.certfile = "{{ platform_etc_dir }}/certs/cert.pem"
|
|
|
|
|
|
|
|
|
|
## Path to the file containing PEM-encoded CA certificates.
|
|
|
|
|
##
|
|
|
|
|
## See: listener.ssl.$name.cacert
|
|
|
|
|
##
|
|
|
|
|
## Value: File
|
|
|
|
|
## listener.wss.external.cacertfile = {{ platform_etc_dir }}/certs/cacert.pem
|
|
|
|
|
## listener.wss.external.cacertfile = "{{ platform_etc_dir }}/certs/cacert.pem"
|
|
|
|
|
|
|
|
|
|
## Maximum number of non-self-issued intermediate certificates that
|
|
|
|
|
## can follow the peer certificate in a valid certification path.
|
|
|
|
|
@ -1960,7 +1973,7 @@ listener.wss.external.certfile = {{ platform_etc_dir }}/certs/cert.pem
|
|
|
|
|
## See: listener.ssl.$name.dhfile
|
|
|
|
|
##
|
|
|
|
|
## Value: File
|
|
|
|
|
## listener.ssl.external.dhfile = {{ platform_etc_dir }}/certs/dh-params.pem
|
|
|
|
|
## listener.ssl.external.dhfile = "{{ platform_etc_dir }}/certs/dh-params.pem"
|
|
|
|
|
|
|
|
|
|
## See: listener.ssl.$name.verify
|
|
|
|
|
##
|
|
|
|
|
@ -1975,13 +1988,13 @@ listener.wss.external.certfile = {{ platform_etc_dir }}/certs/cert.pem
|
|
|
|
|
## See: listener.ssl.$name.ciphers
|
|
|
|
|
##
|
|
|
|
|
## Value: Ciphers
|
|
|
|
|
listener.wss.external.ciphers = TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_CHACHA20_POLY1305_SHA256,TLS_AES_128_CCM_SHA256,TLS_AES_128_CCM_8_SHA256,ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-RSA-AES256-GCM-SHA384,ECDHE-ECDSA-AES256-SHA384,ECDHE-RSA-AES256-SHA384,ECDHE-ECDSA-DES-CBC3-SHA,ECDH-ECDSA-AES256-GCM-SHA384,ECDH-RSA-AES256-GCM-SHA384,ECDH-ECDSA-AES256-SHA384,ECDH-RSA-AES256-SHA384,DHE-DSS-AES256-GCM-SHA384,DHE-DSS-AES256-SHA256,AES256-GCM-SHA384,AES256-SHA256,ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-RSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES128-SHA256,ECDHE-RSA-AES128-SHA256,ECDH-ECDSA-AES128-GCM-SHA256,ECDH-RSA-AES128-GCM-SHA256,ECDH-ECDSA-AES128-SHA256,ECDH-RSA-AES128-SHA256,DHE-DSS-AES128-GCM-SHA256,DHE-DSS-AES128-SHA256,AES128-GCM-SHA256,AES128-SHA256,ECDHE-ECDSA-AES256-SHA,ECDHE-RSA-AES256-SHA,DHE-DSS-AES256-SHA,ECDH-ECDSA-AES256-SHA,ECDH-RSA-AES256-SHA,AES256-SHA,ECDHE-ECDSA-AES128-SHA,ECDHE-RSA-AES128-SHA,DHE-DSS-AES128-SHA,ECDH-ECDSA-AES128-SHA,ECDH-RSA-AES128-SHA,AES128-SHA
|
|
|
|
|
listener.wss.external.ciphers = "TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_CHACHA20_POLY1305_SHA256,TLS_AES_128_CCM_SHA256,TLS_AES_128_CCM_8_SHA256,ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-RSA-AES256-GCM-SHA384,ECDHE-ECDSA-AES256-SHA384,ECDHE-RSA-AES256-SHA384,ECDHE-ECDSA-DES-CBC3-SHA,ECDH-ECDSA-AES256-GCM-SHA384,ECDH-RSA-AES256-GCM-SHA384,ECDH-ECDSA-AES256-SHA384,ECDH-RSA-AES256-SHA384,DHE-DSS-AES256-GCM-SHA384,DHE-DSS-AES256-SHA256,AES256-GCM-SHA384,AES256-SHA256,ECDHE-ECDSA-AES128-GCM-SHA256,ECDHE-RSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES128-SHA256,ECDHE-RSA-AES128-SHA256,ECDH-ECDSA-AES128-GCM-SHA256,ECDH-RSA-AES128-GCM-SHA256,ECDH-ECDSA-AES128-SHA256,ECDH-RSA-AES128-SHA256,DHE-DSS-AES128-GCM-SHA256,DHE-DSS-AES128-SHA256,AES128-GCM-SHA256,AES128-SHA256,ECDHE-ECDSA-AES256-SHA,ECDHE-RSA-AES256-SHA,DHE-DSS-AES256-SHA,ECDH-ECDSA-AES256-SHA,ECDH-RSA-AES256-SHA,AES256-SHA,ECDHE-ECDSA-AES128-SHA,ECDHE-RSA-AES128-SHA,DHE-DSS-AES128-SHA,ECDH-ECDSA-AES128-SHA,ECDH-RSA-AES128-SHA,AES128-SHA"
|
|
|
|
|
|
|
|
|
|
## Ciphers for TLS PSK.
|
|
|
|
|
## Note that 'listener.wss.external.ciphers' and 'listener.wss.external.psk_ciphers' cannot
|
|
|
|
|
## be configured at the same time.
|
|
|
|
|
## See 'https://tools.ietf.org/html/rfc4279#section-2'.
|
|
|
|
|
## listener.wss.external.psk_ciphers = PSK-AES128-CBC-SHA,PSK-AES256-CBC-SHA,PSK-3DES-EDE-CBC-SHA,PSK-RC4-SHA
|
|
|
|
|
## listener.wss.external.psk_ciphers = "PSK-AES128-CBC-SHA,PSK-AES256-CBC-SHA,PSK-3DES-EDE-CBC-SHA,PSK-RC4-SHA"
|
|
|
|
|
|
|
|
|
|
## See: listener.ssl.$name.secure_renegotiate
|
|
|
|
|
##
|
|
|
|
|
@ -2140,7 +2153,7 @@ listener.wss.external.allow_origin_absence = true
|
|
|
|
|
## Comma separated list of allowed origin in header for secure websocket connection
|
|
|
|
|
##
|
|
|
|
|
## Value: http://url eg. https://localhost:8084, https://127.0.0.1:8084
|
|
|
|
|
listener.wss.external.check_origins = https://localhost:8084, https://127.0.0.1:8084
|
|
|
|
|
listener.wss.external.check_origins = "https://localhost:8084, https://127.0.0.1:8084"
|
|
|
|
|
|
|
|
|
|
## CONFIG_SECTION_END=listeners ================================================
|
|
|
|
|
|
|
|
|
|
@ -2149,7 +2162,7 @@ listener.wss.external.check_origins = https://localhost:8084, https://127.0.0.1:
|
|
|
|
|
## The file to store loaded module names.
|
|
|
|
|
##
|
|
|
|
|
## Value: File
|
|
|
|
|
modules.loaded_file = {{ platform_data_dir }}/loaded_modules
|
|
|
|
|
module.loaded_file = "{{ platform_data_dir }}/loaded_modules"
|
|
|
|
|
|
|
|
|
|
##--------------------------------------------------------------------
|
|
|
|
|
## Presence Module
|
|
|
|
|
@ -2165,7 +2178,7 @@ module.presence.qos = 1
|
|
|
|
|
## Subscribe the Topics automatically when client connected.
|
|
|
|
|
##
|
|
|
|
|
## Value: String
|
|
|
|
|
## module.subscription.1.topic = connected/%c/%u
|
|
|
|
|
## module.subscription.1.topic = "connected/%c/%u"
|
|
|
|
|
|
|
|
|
|
## Qos of the proxy subscription.
|
|
|
|
|
##
|
|
|
|
|
@ -2198,8 +2211,8 @@ module.presence.qos = 1
|
|
|
|
|
## Rewrite Module
|
|
|
|
|
|
|
|
|
|
## {rewrite, Topic, Re, Dest}
|
|
|
|
|
## module.rewrite.pub.rule.1 = x/# ^x/y/(.+)$ z/y/$1
|
|
|
|
|
## module.rewrite.sub.rule.1 = y/+/z/# ^y/(.+)/z/(.+)$ y/z/$2
|
|
|
|
|
## module.rewrite.pub_rule.1 = "x/# ^x/y/(.+)$ z/y/$1"
|
|
|
|
|
## module.rewrite.sub_rule.1 = "y/+/z/# ^y/(.+)/z/(.+)$ y/z/$2"
|
|
|
|
|
|
|
|
|
|
## CONFIG_SECTION_END=modules ==================================================
|
|
|
|
|
|
|
|
|
|
@ -2210,17 +2223,17 @@ module.presence.qos = 1
|
|
|
|
|
## The etc dir for plugins' config.
|
|
|
|
|
##
|
|
|
|
|
## Value: Folder
|
|
|
|
|
plugins.etc_dir = {{ platform_etc_dir }}/plugins/
|
|
|
|
|
plugins.etc_dir = "{{ platform_etc_dir }}/plugins/"
|
|
|
|
|
|
|
|
|
|
## The file to store loaded plugin names.
|
|
|
|
|
##
|
|
|
|
|
## Value: File
|
|
|
|
|
plugins.loaded_file = {{ platform_data_dir }}/loaded_plugins
|
|
|
|
|
plugins.loaded_file = "{{ platform_data_dir }}/loaded_plugins"
|
|
|
|
|
|
|
|
|
|
## The directory of extension plugins.
|
|
|
|
|
##
|
|
|
|
|
## Value: File
|
|
|
|
|
plugins.expand_plugins_dir = {{ platform_plugins_dir }}/
|
|
|
|
|
plugins.expand_plugins_dir = "{{ platform_plugins_dir }}/"
|
|
|
|
|
|
|
|
|
|
##--------------------------------------------------------------------
|
|
|
|
|
## Broker
|
|
|
|
|
@ -2334,7 +2347,6 @@ sysmon.long_gc = 0
|
|
|
|
|
## Examples:
|
|
|
|
|
## - 2h: 2 hours
|
|
|
|
|
## - 30m: 30 minutes
|
|
|
|
|
## - 0.1s: 0.1 seconds
|
|
|
|
|
## - 100ms: 100 milliseconds
|
|
|
|
|
##
|
|
|
|
|
## Default: 0ms
|
|
|
|
|
@ -2426,8 +2438,8 @@ vm_mon.process_low_watermark = 60%
|
|
|
|
|
## - log
|
|
|
|
|
## - publish
|
|
|
|
|
##
|
|
|
|
|
## Default: log,publish
|
|
|
|
|
alarm.actions = log,publish
|
|
|
|
|
## Default: "log,publish"
|
|
|
|
|
alarm.actions = "log,publish"
|
|
|
|
|
|
|
|
|
|
## The maximum number of deactivated alarms
|
|
|
|
|
##
|
zhanghongtong