[mosquitto-dev] config file questions

[Greg Troxel <gdt@xxxxxxxxxx>]

(I've updated the pkgsrc-wip package to install an rc.d startup file and
worked out using the pid_file for this.  These comments are sort of "new
user comments".)

1. Having put two lines in mosquitto.conf via a patch at package time:
  pid_file @VAR_RUN@/mosquitto/mosquitto.pid
  log_dest syslog
I am now thinking about configuring tls and users.  This is making me
think that I really don't want the vast commented example as my config
file, and thus that mosquitto.conf should be renamed to
mosquitto.conf.example, to indicate that it's fodder to read, understand
and take from, rather than something that should be used.

I would then install a minimal config file with the above two lines, and
a persistence directory (as I think the directory should have a
system-sensible default, from the package user's point of view, even if
persistence should not default to on).  (For pkgsrc this should be
/var/db/mosquitto, and be created/chown'd to mosquitto at startup.)

2. mosquitto does not read ${PREFIX}/etc/mosquitto.conf by default, or
at least that's how I read the man page.  I don't know if that is really
intended, but it seems odd to me - normally a daemon has a config file
location, and when started with no arguments reads it.  I admit that I
am definitely thinking it terms of the normal approach being to set up
to run one system version of the daemon -- is that off base?

3. mosquitto(8) and the default config differ about the default for
persistence directory.

4. The documentation for mosquitto-tls tells you to create your own
cert.  In a letsencrypt world this seems off.  Even without, it blurs
the notion of how to configure the user of a certificate/keypair that
you have, and how you might go about getting one.

The capath option does not seem to default to the system's openssl
configuration.  That seems unexpected.  It seems I need to set capath
separately for the server, for the server to use for validating bridges,
and for mosquitto_sub.  I expect all of these to default to the system's
openssl configuration, so that if e.g. I use letsencrypt, everything
will just work.  (I'm implicitly taking the position that validation of
mqtt and validation of https by wget, etc. should more or less be done
the same way.)

I am somewhat surpised to have to create a dhparams file and point to
it, rather than this working by default.  I don't remember having to do
this for apache, postfix, dovecot, but I could well be wrong.  Dovecot
seems to generate params by default at startup:
  https://wiki2.dovecot.org/SSL/DovecotConfiguration

5. The "per_listener_settings" section in mosquitto.conf(5) is
confusing.  It does not explain what it means for authentication to be
separate per listener, and it isn't quite clear what a listener is, and
why one does or doesn't want to use this.

Thanks for listening, Greg