magistrala/docker/fluxmq/node1.yaml

# Copyright (c) Abstract Machines
# SPDX-License-Identifier: Apache-2.0

server:
  tcp:
    v3:
      addr: "0.0.0.0:1883"
      protocol: "v3"
      max_connections: 10000
      read_timeout: 60s
      write_timeout: 60s
    v5:
      addr: "0.0.0.0:1884"
      protocol: "v5"
      max_connections: 10000
      read_timeout: 60s
      write_timeout: 60s
  websocket:
    v3:
      addr: "0.0.0.0:8883"
      path: "/mqtt"
      protocol: "v3"
    v5:
      addr: "0.0.0.0:8884"
      path: "/mqtt"
      protocol: "v5"
  http:
    plain:
      addr: "0.0.0.0:8090"
  coap:
    plain:
      addr: "0.0.0.0:5683"
  amqp:
    plain:
      addr: "0.0.0.0:5672"
      max_connections: 10000
  amqp091:
    plain:
      addr: "0.0.0.0:5682"
    # The local listener is how a first-party service reaches the broker. It
    # requires mTLS: FluxMQ matches the URI SAN of the presented certificate
    # against a principal under auth.local_principals, and only a connection
    # admitted here may exchange "_flux." message metadata. The Rules Engine
    # needs that metadata to carry its rule execution trace, so it connects
    # here rather than on the plain listener.
    local:
      addr: "0.0.0.0:5685"
      max_connections: 32
      cert_file: "/etc/fluxmq/certs/fluxmq-service-server.crt"
      key_file: "/etc/fluxmq/certs/fluxmq-service-server.key"
      ca_file: "/etc/fluxmq/certs/ca.crt"
      client_auth: "require"
      min_version: "TLS1.2"
  health_addr: "0.0.0.0:8081"
  health_enabled: true
  shutdown_timeout: 30s

broker:
  max_message_size: 1048576
  max_retained_messages: 10000
  retry_interval: 20s
  max_retries: 0
  max_qos: 2
  async_fan_out: false
  fan_out_workers: 0

session:
  max_sessions: 10000
  default_expiry_interval: 300
  max_offline_queue_size: 10000
  max_inflight_messages: 1000
  max_send_queue_size: 1000
  offline_queue_policy: "evict"
  inflight_overflow: 1
  pending_queue_size: 1000

log:
  level: "info"
  format: "text"

storage:
  type: "badger"
  badger_dir: "/tmp/fluxmq/data"
  sync_writes: false

cluster:
  enabled: true
  node_id: "node1"
  etcd:
    data_dir: "/tmp/fluxmq/etcd"
    bind_addr: "172.30.0.201:2380"
    client_addr: "172.30.0.201:2379"
    initial_cluster: "node1=http://172.30.0.201:2380,node2=http://172.30.0.202:2380,node3=http://172.30.0.203:2380"
    bootstrap: true
    hybrid_retained_size_threshold: 1024
  transport:
    bind_addr: "0.0.0.0:7948"
    peers:
      node2: "fluxmq-node2:7948"
      node3: "fluxmq-node3:7948"
    route_batch_max_size: 256
    route_batch_max_delay: 50ms
    route_batch_flush_workers: 8
    route_publish_timeout: 15s

queue_manager:
  auto_commit_interval: 5s

queues:
  - name: "mqtt"
    topics:
      - "$queue/#"
    reserved: true
  - name: "events"
    topics:
      - "$queue/events/#"
    type: "stream"
    retention:
      max_age: 168h
      max_length_bytes: 1073741824
  - name: "writers"
    topics:
      - "$queue/writers/#"
    type: "stream"
    retention:
      max_age: 24h
      max_length_bytes: 1073741824
  - name: "alarms"
    topics:
      - "$queue/alarms/#"
    type: "stream"
    retention:
      max_age: 24h
      max_length_bytes: 1073741824
  - name: "m"
    topics:
      - "m/#"
    type: "stream"
    retention:
      max_age: 24h
      max_length_bytes: 1073741824

auth:
  # Principals admitted on the service listener. The certificate_uri_san must
  # match the URI SAN issued by docker/ssl/Makefile (fluxmq_service_certs), and
  # each secret file must hold the value configured by its service.
  local_principals:
    - name: "rules-engine"
      certificate_uri_san: "spiffe://absmach/magistrala/rules-engine"
      # A service may consume and may relay the origin of messages it did not
      # author, both of which the Rules Engine needs when it republishes a
      # device message. The capability is the principal's, not the listener's.
      role: "service"
      current_secret_file: "/etc/fluxmq/secrets/re-current"
      permissions:
        # Rule outputs are republished to m.<domain>.c.<channel>.<subtopic>,
        # whose tenant and channel identifiers cannot be enumerated here, so the
        # grant is the topic namespace rather than a list of exact keys. Being a
        # prefix it is also an ordinary topic publish, which the cluster
        # forwards; an exact target would be durable on one node and could not
        # run alongside cluster.enabled.
        publish:
          - routing_key_prefix: "m."
        # The message stream the Rules Engine consumes.
        subscribe:
          - "m"
    - name: "timescale-writer"
      certificate_uri_san: "spiffe://absmach/magistrala/timescale-writer"
      role: "service"
      current_secret_file: "/etc/fluxmq/secrets/timescale-writer-current"
      permissions:
        # The writer is a passive consumer of the broker-provisioned stream. It
        # neither publishes messages nor manages queues.
        subscribe:
          - "writers"
    - name: "postgres-writer"
      certificate_uri_san: "spiffe://absmach/magistrala/postgres-writer"
      role: "service"
      current_secret_file: "/etc/fluxmq/secrets/postgres-writer-current"
      permissions:
        # The writer is a passive consumer of the broker-provisioned stream. It
        # neither publishes messages nor manages queues.
        subscribe:
          - "writers"
  external:
    url: "http://fluxmq-auth:7016"
    transport: "grpc"
    timeout: 15s
    protocols:
      mqtt: true
      http: true
      coap: true
      amqp: true
      amqp091: false

hooks:
  url: "http://fluxmq-auth:7016"
  transport: "http"
  timeout: 500ms
  fail_mode: "deny"
  protocols:
    mqtt: true
    http: true
    coap: true
    amqp: true
    amqp091: true
  events:
    auth_on_publish: true
    auth_on_subscribe: true
    auth_on_unsubscribe: true