Settings reference

IndraMQTT settings reference

Every setting has exactly one typed home in the configuration schema. Wrong types and out-of-range values are startup errors naming the setting.

flowchart LR
    G0["node + operate"] -- "set" --> Kernel["kernel"]
    G1["listeners"] -- "set" --> Kernel["kernel"]
    G2["session + quotas"] -- "set" --> Kernel["kernel"]
    G3["rules + delayed"] -- "set" --> Kernel["kernel"]
    G4["auth + user stores"] -- "set" --> Kernel["kernel"]

node

Setting	Type	Default	Range	Description
node.id	string	indra-node-1	string	Unique identifier for this broker node within the cluster.
node.data_dir	string	./data	string	Directory holding kernel persistent state (state.toml). Created on boot when missing.
node.brokerlink_bind	string	127.0.0.1:18883	string	Deprecated. Ignored. The kernel serves clients directly.

listeners

Setting	Type	Default	Range	Description
listeners.tcp.enabled	boolean	true	boolean	Whether the plaintext MQTT listener accepts connections.
listeners.tcp.bind	string	0.0.0.0:1883	string	Bind address for the plaintext MQTT listener.
listeners.tcp.max_connections	integer	1000000	1..=10000000	Maximum concurrent connections on the plaintext MQTT listener.
listeners.tcp.backlog	integer	1024	1..=65536	Listener accept backlog for the plaintext MQTT listener.
listeners.tcp.native	boolean	false	boolean	Deprecated. Ignored. The kernel always serves this listener.
listeners.tls.enabled	boolean	false	boolean	Whether the secure TLS MQTT listener accepts connections.
listeners.tls.bind	string	0.0.0.0:8883	string	Bind address for the secure TLS MQTT listener.
listeners.tls.cert_file	string	“	string	Path to the PEM server certificate for the TLS listener.
listeners.tls.key_file	string	“	string	Path to the PEM private key for the TLS listener.
listeners.tls.native	boolean	false	boolean	Deprecated. Ignored. The kernel always serves this listener.
listeners.tls.psk_enabled	boolean	false	boolean	Whether the kernel TLS listener accepts pre-shared-key handshakes. Off keeps certificate handshakes unchanged. On serves PSK suites from the identity store with no certificate.
listeners.tls.psk_keys_file	string	“	string	Path to the PSK identity file of the kernel TLS listener. Use it only when PSK is on. Empty keeps the store empty, so every handshake fails closed.
listeners.tls.verify_client_cert	boolean	false	boolean	Whether the TLS listener requests and verifies a client certificate.
listeners.tls.verify	string	verify_none	[“verify_none”,“verify_peer”]	Client certificate chain check mode of the TLS listener.
listeners.tls.cacertfile	string	“	string	CA file for client certificate checks of the TLS listener.
listeners.tls.fail_if_no_peer_cert	boolean	false	boolean	Whether the TLS listener refuses a handshake without a certificate.
listeners.tls.peer_cert_as_username	string	disabled	[“disabled”,“cn”,“dn”]	Source for the bind username from the client certificate.
listeners.tls.peer_cert_as_clientid	string	disabled	[“disabled”,“cn”,“dn”]	Source for the bind client identifier from the client certificate.
listeners.ws.enabled	boolean	true	boolean	Whether the MQTT-over-WebSocket listener accepts connections.
listeners.ws.bind	string	0.0.0.0:8083	string	Bind address for the MQTT-over-WebSocket listener.
listeners.ws.path	string	/mqtt	string	HTTP path serving MQTT-over-WebSocket traffic.
listeners.ws.native	boolean	false	boolean	Deprecated. Ignored. The kernel always serves this listener.
listeners.wss.enabled	boolean	false	boolean	Whether the secure WebSocket listener accepts connections.
listeners.wss.bind	string	0.0.0.0:8084	string	Bind address for the secure WebSocket listener.
listeners.wss.path	string	/mqtt	string	HTTP path serving secure WebSocket traffic.
listeners.wss.cert_file	string	“	string	Path to the PEM server certificate for the secure WebSocket listener.
listeners.wss.key_file	string	“	string	Path to the PEM private key for the secure WebSocket listener.
listeners.wss.native	boolean	false	boolean	Deprecated. Ignored. The kernel always serves this listener.
listeners.wss.verify_client_cert	boolean	false	boolean	Whether the secure WebSocket listener requests and verifies a client certificate.
listeners.wss.verify	string	verify_none	[“verify_none”,“verify_peer”]	Client certificate chain check mode of the secure WebSocket listener.
listeners.wss.cacertfile	string	“	string	CA file for client certificate checks of the secure WebSocket listener.
listeners.wss.fail_if_no_peer_cert	boolean	false	boolean	Whether the secure WebSocket listener refuses a handshake without a certificate.
listeners.wss.peer_cert_as_username	string	disabled	[“disabled”,“cn”,“dn”]	Source for the bind username from the client certificate.
listeners.wss.peer_cert_as_clientid	string	disabled	[“disabled”,“cn”,“dn”]	Source for the bind client identifier from the client certificate.
listeners.api.enabled	boolean	true	boolean	Whether the management REST API and dashboard serve requests.
listeners.api.bind	string	0.0.0.0:18083	string	Bind address for the management REST API. Empty disables the API.

quotas

Setting	Type	Default	Range	Description
quotas.default_max_connections	integer	10000	0..=1000000	Default max connections per authenticated username (0 = unlimited).
quotas.default_max_publish_rate	integer	50000	0..=10000000	Default token-bucket publish rate limit in messages per second (0 = unlimited).
quotas.burst_multiplier	number	2.0	1.0..=10.0	Token bucket burst multiplier (allows bursts up to burst times rate).
quotas.max_connections_per_tenant	integer	0	0..=1000000	Default max live connections per tenant (0 = unlimited).
quotas.max_sessions_per_tenant	integer	0	0..=100000	Default max sessions per tenant (0 = unlimited).
quotas.max_retained_per_tenant	integer	0	0..=100000	Default max retained topics per tenant (0 = unlimited).

session

Setting	Type	Default	Range	Description
session.max_session_expiry_secs	integer	86400	0..=2592000	Max session expiry interval in seconds.
session.max_offline_queue	integer	50000	1..=1000000	Maximum queued offline messages per session.
session.max_inflight_messages	integer	65535	1..=65535	Maximum inflight unacknowledged QoS 1 and QoS 2 messages.
session.max_qos0_backlog	integer	1000	1..=100000	Per-subscriber QoS 0 egress backlog bound; past it the oldest queued QoS 0 frame drops.
session.max_qos1_inflight	integer	100	1..=100000	Per-session QoS 1 inflight window bound.
session.max_qos1_spill	integer	1000	1..=100000	Per-session QoS 1 spill bound past the window.
session.topic_alias_maximum	integer	10	0..=65535	Inbound topic-alias maximum advertised in CONNACK.
session.max_packet_size	integer	1048576	1..=268435455	Largest MQTT packet in bytes. Sets the read limit and the WS frame cap. Advertised in CONNACK.
session.keep_alive_grace	number	1.5	1.0..=5.0	Keep-alive grace multiplier before disconnect.

logging

Setting	Type	Default	Range	Description
logging.level	string	info	[“trace”,“debug”,“info”,“warn”,“error”]	Logging verbosity for the kernel (trace, debug, info, warn, error).

rules_engine

Setting	Type	Default	Range	Description
rules_engine.window_channel_depth	integer	65536	1..=1000000	Ingress ring buffer channel depth for stateful window worker tasks.
rules_engine.backpressure_policy	string	DropOldest	[“Block”,“DropNewest”,“DropOldest”,“SpillToDisk”,“RejectPublisher”]	Default memory backpressure policy when the rule buffer is full.
rules_engine.spill_dir	string	“	string	Rule ingress spill directory.

auth

Setting	Type	Default	Range	Description
auth.enabled	boolean	true	boolean	Whether authentication checks apply to client connects.
auth.password_hash	string	sha256	[“sha256”,“bcrypt”]	Password hashing algorithm for stored credentials.
auth.allow_anonymous	boolean	false	boolean	Whether anonymous connections are accepted while no users are configured.
auth.superusers	array	["admin","root"]	array	Superuser usernames bypassing ACL rules.

cluster

Setting	Type	Default	Range	Description
cluster.enabled	boolean	false	boolean	Refused clustering switch. The broker fails boot when true.
cluster.bind	string	127.0.0.1:19883	string	Cluster SWIM UDP bind address for peer discovery and membership.
cluster.gossip_bind	string	0.0.0.0:7946	string	Accepted gossip bind. The broker stores it. It binds clustering from —cluster-bind only.
cluster.quic_bind	string	0.0.0.0:9092	string	Accepted data plane bind. The broker stores it. It binds clustering from —cluster-bind only.
cluster.seed_nodes	array	[]	array	Refused seed list. The broker fails boot when not empty.

licence

Setting	Type	Default	Range	Description
licence.license_file	string	/etc/indramqtt/license.key	string	Path to the enterprise cryptographic license key file.
licence.license_key	string	“	string	Enterprise commercial license key for multi-node clustering.
licence.trusted_keys_path	string	“	string	Trusted licence-signing keys: a JSON file or directory of JSON files.
licence.request_out	string	“	string	Write the installation licence request to this path and exit.
licence.install_file	string	“	string	Install the licence token read from this path and exit.
licence.expiry_warn_days	integer	30	0..=365	Days before expiry that the approaching-expiry alarm and log warning start.

gateway

Setting	Type	Default	Range	Description
gateway.coap_bind	string	“	string	CoAP gateway UDP listen address. Empty disables the gateway.

persistence

Setting	Type	Default	Range	Description
persistence.stream_dir	string	“	string	Durable stream journal directory. Empty disables journaling.

ldap

Setting	Type	Default	Range	Description
ldap.server_url	string	“	string	Directory server URL for LDAP authentication. Empty disables LDAP.
ldap.base_dn	string	“	string	Base DN under which directory users are searched.
ldap.bind_dn	string	“	string	Service account DN used for the initial bind plus search.
ldap.bind_password	string	“	string	Service account password for the initial bind.
ldap.user_filter	string	(uid={username})	string	User search filter with a {username} placeholder, escaped per RFC 4515.
ldap.group_attribute	string	memberOf	string	User-entry attribute listing directory groups.
ldap.required_group	string	“	string	Required group DN: the entry must list this DN to connect.
ldap.ca_cert_path	string	“	string	Path to a PEM CA certificate for private directories.
ldap.pool_size	integer	8	1..=32	Bound on concurrent directory authentications.
ldap.connect_timeout_ms	integer	5000	100..=60000	Timeout covering TCP connect plus TLS handshake.
ldap.read_timeout_ms	integer	5000	100..=60000	Timeout covering each directory bind/search round-trip.

kerberos

Setting	Type	Default	Range	Description
kerberos.keytab_path	string	“	string	Keytab file for Kerberos authentication. Empty disables Kerberos.
kerberos.service_principal	string	“	string	Service principal name held in the keytab.
kerberos.realm	string	“	string	Expected service realm. Empty disables the realm check on the service name.
kerberos.allowed_realms	array	[]	array	Trusted client realms. Empty allows any realm that verifies.
kerberos.clock_skew_secs	integer	300	1..=3600	Clock-skew allowance in seconds for ticket validity and authenticator timestamps.
kerberos.role_map	string	“	string	Comma-separated principal=role mappings for verified client principals.
kerberos.replay_max_entries	integer	1024	16..=8192	Replay-cache bound for Kerberos authenticators.

delayed

Setting	Type	Default	Range	Description
delayed.max_secs	integer	86400	1..=86400	Upper bound for delayed deferrals in seconds.

observability

Setting	Type	Default	Range	Description
observability.monitor_sample_secs	integer	10	0..=3600	Monitor sampling interval in seconds.

mcp

Setting	Type	Default	Range	Description
mcp.enabled	boolean	true	boolean	Whether the MCP endpoint on the management listener serves tool calls.
mcp.read_only	boolean	false	boolean	Whether the MCP endpoint refuses mutating tool calls; only read-only tools stay available.

jwks

Setting	Type	Default	Range	Description
jwks.url	string	“	string	JWKS endpoint URL for JWT authentication.
jwks.issuer	string	“	string	Expected JWT issuer.
jwks.audience	string	“	string	Expected JWT audience.
jwks.refresh_period_secs	integer	300	1..=86400	Seconds between background JWKS refreshes.
jwks.fetch_timeout_ms	integer	5000	100..=60000	Timeout for one JWKS fetch in milliseconds.
jwks.refresh_timeout_ms	integer	5000	100..=60000	Longest a CONNECT waits for a JWKS refresh in milliseconds.
jwks.cache_max_keys	integer	32	1..=256	Most JWKS keys held in the cache.
jwks.cache_ttl_secs	integer	300	1..=86400	Seconds a cached JWKS key stays valid.
jwks.clock_skew_secs	integer	60	0..=3600	Clock skew tolerated when checking token times, in seconds.
jwks.ca_cert	string	“	string	Extra CA certificate trusted for the JWKS endpoint.

dbauth

Setting	Type	Default	Range	Description
dbauth.postgres_url	string	“	string	PostgreSQL URL for database authentication.
dbauth.mysql_url	string	“	string	MySQL URL for database authentication.
dbauth.redis_url	string	“	string	Redis URL for database authentication.
dbauth.mongodb_url	string	“	string	MongoDB URL for database authentication.
dbauth.pool_size	integer	8	1..=32	Connections kept per authentication database.
dbauth.connect_timeout_ms	integer	3000	100..=60000	Timeout for connecting to an authentication database in milliseconds.
dbauth.read_timeout_ms	integer	3000	100..=60000	Timeout for one authentication lookup in milliseconds.
dbauth.cache_size	integer	1024	0..=100000	Cached database verdicts per source; 0 disables the cache.
dbauth.cache_ttl_secs	integer	60	0..=3600	Seconds a cached database verdict stays valid.

webhook

Setting	Type	Default	Range	Description
webhook.url	string	“	string	HTTP webhook verdict endpoint.
webhook.pool_size	integer	8	1..=32	Concurrent requests allowed to the webhook endpoint.
webhook.timeout_ms	integer	2000	100..=60000	Timeout for one webhook request in milliseconds.
webhook.breaker_threshold	integer	5	1..=100	Consecutive webhook failures that open the circuit breaker.
webhook.breaker_reset_ms	integer	30000	1000..=600000	Milliseconds an open circuit breaker waits before retrying the webhook.
webhook.cache_size	integer	1024	0..=100000	Cached webhook verdicts; 0 disables the cache.
webhook.cache_ttl_secs	integer	60	0..=3600	Seconds a cached webhook verdict stays valid.

prometheus

Setting	Type	Default	Range	Description
prometheus.enable_basic_auth	boolean	true	boolean	Require credentials on the scrape endpoints.
prometheus.latency_buckets	string	10ms, 100ms, 1s, 5s, 30s	string	Latency histogram buckets for the exposition.
prometheus.push_gateway.enable	boolean	false	boolean	Stored push intent. The broker runs no push client.
prometheus.push_gateway.url	string	http://127.0.0.1:9091	string	Push target URL for the exposition.
prometheus.push_gateway.interval	string	15s	string	Push interval for the exposition.
prometheus.push_gateway.job_name	string	${name}/instance/${name}~${host}	string	Job name template for each push.
prometheus.push_gateway.method	string	put	[“put”,“post”]	Push method for the exposition.
prometheus.collectors.mnesia	string	disabled	[“enabled”,“disabled”]	Stored collector name. The broker keeps it and shows it. No sampler reads it.
prometheus.collectors.vm_dist	string	disabled	[“enabled”,“disabled”]	Stored collector name. The broker keeps it and shows it. No sampler reads it.
prometheus.collectors.vm_memory	string	disabled	[“enabled”,“disabled”]	Stored collector name. The broker keeps it and shows it. No sampler reads it.
prometheus.collectors.vm_msacc	string	disabled	[“enabled”,“disabled”]	Stored collector name. The broker keeps it and shows it. No sampler reads it.
prometheus.collectors.vm_statistics	string	disabled	[“enabled”,“disabled”]	Stored collector name. The broker keeps it and shows it. No sampler reads it.
prometheus.collectors.vm_system_info	string	disabled	[“enabled”,“disabled”]	Stored collector name. The broker keeps it and shows it. No sampler reads it.