%name%@FQDN or
+%name%@IPv4 format.
+
+
+**node.cookie**
+
+ *Type*: `string`
+
+ Secret cookie is a random string that should be the same on all nodes in
+the given EMQX cluster, but unique per EMQX cluster. It is used to prevent EMQX nodes that
+belong to different clusters from accidentally connecting to each other.
+
+
+**node.max_ports**
+
+ *Type*: `integer`
+
+ *Default*: `1048576`
+
+ *Optional*: `1024-134217727`
+
+ Maximum number of simultaneously open files and sockets for this Erlang system.
+For more information, see: https://www.erlang.org/doc/man/erl.html
+
+
+**node.dist_buffer_size**
+
+ *Type*: `integer`
+
+ *Default*: `8192`
+
+ *Optional*: `1-2097151`
+
+ Erlang's distribution buffer busy limit in kilobytes.
+
+
+**node.data_dir**
+
+ *Type*: `string`
+
+ Path to the persistent data directory.disabled to have it disabled.
+
+
+**node.role**
+
+ *Type*: `enum`
+
+ *Default*: `core`
+
+ *Optional*: `core | replicant`
+
+ Select a node role.core nodes provide durability of the data, and take care of writes.
+It is recommended to place core nodes in different racks or different availability zones.replicant nodes are ephemeral worker nodes. Removing them from the cluster
+doesn't affect database redundancybackend is set
+to rlog.
+
+
+
+## RPC
+
+
+EMQX uses a library called gen_rpc for inter-broker communication.sync mode the sending side waits for the ack from the receiving side.
+
+
+**rpc.protocol**
+
+ *Type*: `enum`
+
+ *Default*: `tcp`
+
+ *Optional*: `tcp | ssl`
+
+ Transport protocol used for inter-broker communication
+
+
+**rpc.async_batch_size**
+
+ *Type*: `integer`
+
+ *Default*: `256`
+
+ The maximum number of batch messages sent in asynchronous mode.
+ Note that this configuration does not work in synchronous mode.
+
+
+**rpc.port_discovery**
+
+ *Type*: `enum`
+
+ *Default*: `stateless`
+
+ *Optional*: `manual | stateless`
+
+ manual: discover ports by tcp_server_port.stateless: discover ports in a stateless manner, using the following algorithm.
+If node name is emqxN@127.0.0.1, where the N is an integer,
+then the listening port will be 5370 + N.
+
+
+**rpc.tcp_server_port**
+
+ *Type*: `integer`
+
+ *Default*: `5369`
+
+ Listening port used by RPC local service.driver is set to ssl.
+
+
+**rpc.tcp_client_num**
+
+ *Type*: `integer`
+
+ *Default*: `10`
+
+ *Optional*: `1-256`
+
+ Set the maximum number of RPC communication channels initiated by this node to each remote node.
+
+
+**rpc.connect_timeout**
+
+ *Type*: `duration`
+
+ *Default*: `5s`
+
+ Timeout for establishing an RPC connection.
+
+
+**rpc.certfile**
+
+ *Type*: `file`
+
+ Path to TLS certificate file used to validate identity of the cluster nodes.
+Note that this config only takes effect when rpc.driver is set to ssl.
+
+
+**rpc.keyfile**
+
+ *Type*: `file`
+
+ Path to the private key file for the rpc.certfile.rpc.certfile."TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256" or
+["TLS_AES_256_GCM_SHA384","TLS_AES_128_GCM_SHA256"].
+versions ('tlsv1.1', 'tlsv1.2' or 'tlsv1.3')
+incompatible cipher suites will be silently dropped.
+For instance, if only 'tlsv1.3' is given in the versions,
+configuring cipher suites for other versions will have no effect.
+versions."RSA-PSK-AES256-GCM-SHA384,RSA-PSK-AES256-CBC-SHA384,
+RSA-PSK-AES128-GCM-SHA256,RSA-PSK-AES128-CBC-SHA256,
+RSA-PSK-AES256-CBC-SHA,RSA-PSK-AES128-CBC-SHA,
+RSA-PSK-DES-CBC3-SHA,RSA-PSK-RC4-SHA"
+
+
+**rpc.tls_versions**
+
+ *Type*: `array`
+
+ *Default*: `["tlsv1.3","tlsv1.2"]`
+
+ All TLS/DTLS versions to be supported.['tlsv1.2', 'tlsv1.1'] here.
+
+
+**rpc.listen_address**
+
+ *Type*: `string`
+
+ *Default*: `0.0.0.0`
+
+ Indicates the IP address for the RPC server to listen on. For example, use "0.0.0.0" for IPv4 or "::" for IPv6.
+
+
+**rpc.ipv6_only**
+
+ *Type*: `boolean`
+
+ *Default*: `false`
+
+ This setting is effective only when rpc.listen_address is assigned an IPv6 address.
+If set to true, the RPC client will exclusively use IPv6 for connections.
+Otherwise, the client might opt for IPv4, even if the server is on IPv6.
+
+
+
+## Cluster Setup
+
+
+EMQX nodes can form a cluster to scale up the total capacity.emqx ctl cluster command to manage cluster.seeds in config file.true, the node will try to heal network partitions automatically.
+
+
+**cluster.proto_dist**
+
+ *Type*: `enum`
+
+ *Default*: `inet_tcp`
+
+ *Optional*: `inet_tcp | inet6_tcp | inet_tls | inet6_tls`
+
+ The Erlang distribution protocol for the cluster.etc/ssl_dist.conf etc/ssl_dist.conf
+
+
+**cluster.static**
+
+ *Type*: `cluster_static`
+
+
+**cluster.dns**
+
+ *Type*: `cluster_dns`
+
+
+**cluster.etcd**
+
+ *Type*: `cluster_etcd`
+
+
+**cluster.k8s**
+
+ *Type*: `cluster_k8s`
+
+
+
+## Cluster Autodiscovery
+
+EMQX supports node discovery and autocluster with various strategies:
+see [Create and manage clusters](../deploy/cluster/create-cluster.md)。
+
+| Strategy | Description |
+| -------- | ------------------------------- |
+| manual | Create cluster manually |
+| static | Autocluster by static node list |
+| dns | Autocluster by DNS A Record |
+| etcd | Autocluster using etcd |
+| k8s | Autocluster on Kubernetes |
+
+### Create cluster manually
+
+This is the default configuration of clustering, nodes join a cluster by executing ./bin/emqx_ctl join \node.name.
+
+
+
+### Autocluster by DNS Record
+
+
+Service discovery via DNS SRV records.
+
+**cluster.dns.name**
+
+ *Type*: `string`
+
+ *Default*: `localhost`
+
+ The domain name from which to discover peer EMQX nodes' IP addresses.
+Applicable when cluster.discovery_strategy = dns
+
+
+**cluster.dns.record_type**
+
+ *Type*: `enum`
+
+ *Default*: `a`
+
+ *Optional*: `a | srv`
+
+ DNS record type.
+
+
+
+### Autocluster using etcd
+
+
+Service discovery using 'etcd' service.
+
+**cluster.etcd.server**
+
+ *Type*: `comma_separated_list`
+
+ List of endpoint URLs of the etcd cluster
+
+
+**cluster.etcd.prefix**
+
+ *Type*: `string`
+
+ *Default*: `emqxcl`
+
+ Key prefix used for EMQX service discovery.
+
+
+**cluster.etcd.node_ttl**
+
+ *Type*: `duration`
+
+ *Default*: `1m`
+
+ Expiration time of the etcd key associated with the node.
+It is refreshed automatically, as long as the node is alive.
+
+
+**cluster.etcd.ssl_options**
+
+ *Type*: [ssl_client_opts](#ssl-tls-configuration-for-clients)
+
+ Options for the TLS connection to the etcd cluster.
+
+
+
+### Autocluster on Kubernetes
+
+
+Service discovery via Kubernetes API server.
+
+**cluster.k8s.apiserver**
+
+ *Type*: `string`
+
+ *Default*: `https://kubernetes.default.svc:443`
+
+ Kubernetes API endpoint URL.
+
+
+**cluster.k8s.service_name**
+
+ *Type*: `string`
+
+ *Default*: `emqx`
+
+ EMQX broker service name.
+
+
+**cluster.k8s.address_type**
+
+ *Type*: `enum`
+
+ *Default*: `ip`
+
+ *Optional*: `ip | dns | hostname`
+
+ Address type used for connecting to the discovered nodes.
+Setting cluster.k8s.address_type to ip will
+make EMQX to discover IP addresses of peer nodes from Kubernetes API.
+
+
+**cluster.k8s.namespace**
+
+ *Type*: `string`
+
+ *Default*: `default`
+
+ Kubernetes namespace.
+
+
+**cluster.k8s.suffix**
+
+ *Type*: `string`
+
+ *Default*: `pod.local`
+
+ Node name suffix.address_type is dns
+or hostname.
+
+
+
+## Log
+
+Configure the log output location, log level, log file storage path, and parameters such as log rotation and overload protection.
+
+### File Output Log
+
+
+Log handler that prints log events to files.
+
+**log_file_handler.path**
+
+ *Type*: `file`
+
+ *Default*: `${EMQX_LOG_DIR}/emqx.log`
+
+ Name the log file.
+
+
+**log_file_handler.rotation_count**
+
+ *Type*: `integer`
+
+ *Default*: `10`
+
+ *Optional*: `1-128`
+
+ Maximum number of log files.
+
+
+**log_file_handler.rotation_size**
+
+ *Type*: `infinity | bytesize`
+
+ *Default*: `50MB`
+
+ This parameter controls log file rotation. The value `infinity` means the log file will grow indefinitely, otherwise the log file will be rotated once it reaches `rotation_size` in bytes.
+
+
+**log_file_handler.level**
+
+ *Type*: `log_level`
+
+ *Default*: `warning`
+
+ The log level for the current log handler.
+Defaults to warning.
+
+
+**log_file_handler.enable**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ Enable this log handler.
+
+
+**log_file_handler.formatter**
+
+ *Type*: `enum`
+
+ *Default*: `text`
+
+ *Optional*: `text | json`
+
+ Choose log formatter. text for free text, and json for structured logging.
+
+
+**log_file_handler.time_offset**
+
+ *Type*: `string`
+
+ *Default*: `system`
+
+ The time offset to be used when formatting the timestamp.
+Can be one of:
+ - system: the time offset used by the local system
+ - utc: the UTC time offset
+ - +-[hh]:[mm]: user specified time offset, such as "-02:00" or "+00:00"
+Defaults to: system.
+This config has no effect for when formatter is json as the timestamp in JSON is milliseconds since epoch.
+
+
+
+### Console Output Log
+
+
+Log handler that prints log events to the EMQX console.
+
+**log.console.level**
+
+ *Type*: `log_level`
+
+ *Default*: `warning`
+
+ The log level for the current log handler.
+Defaults to warning.
+
+
+**log.console.enable**
+
+ *Type*: `boolean`
+
+ *Default*: `false`
+
+ Enable this log handler.
+
+
+**log.console.formatter**
+
+ *Type*: `enum`
+
+ *Default*: `text`
+
+ *Optional*: `text | json`
+
+ Choose log formatter. text for free text, and json for structured logging.
+
+
+**log.console.time_offset**
+
+ *Type*: `string`
+
+ *Default*: `system`
+
+ The time offset to be used when formatting the timestamp.
+Can be one of:
+ - system: the time offset used by the local system
+ - utc: the UTC time offset
+ - +-[hh]:[mm]: user specified time offset, such as "-02:00" or "+00:00"
+Defaults to: system.
+This config has no effect for when formatter is json as the timestamp in JSON is milliseconds since epoch.
+
+
+
+### Audit Log
+
+
+
+
+
+
+
+
+
+{% emqxee %}
+
+## License
+
+
+
+{% endemqxee %}
+
+## MQTT/TCP Listener - 1883
+
+EMQX supports the creation of multiple listeners, and the default MQTT/TCP listener port is `1883`.
+
+**listeners.tcp.$name.enable**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ Enable listener.
+
+
+**listeners.tcp.$name.bind**
+
+ *Type*: `ip_port`
+
+ *Default*: `1883`
+
+ IP address and port for the listening socket.
+
+
+**listeners.tcp.$name.acceptors**
+
+ *Type*: `pos_integer`
+
+ *Default*: `16`
+
+ The size of the listener's receiving pool.
+
+
+**listeners.tcp.$name.max_connections**
+
+ *Type*: `infinity | pos_integer`
+
+ *Default*: `infinity`
+
+ The maximum number of concurrent connections allowed by the listener.
+
+
+**listeners.tcp.$name.mountpoint**
+
+ *Type*: `string`
+
+ *Default*: `""`
+
+ When publishing or subscribing, prefix all topics with a mountpoint string.
+The prefixed string will be removed from the topic name when the message
+is delivered to the subscriber. The mountpoint is a way that users can use
+to implement isolation of message routing between different listeners.
+For example if a client A subscribes to `t` with `listeners.tcp.\${clientid}: clientid
+ - ${username}: username
+
+
+**listeners.tcp.$name.enable_authn**
+
+ *Type*: `enum`
+
+ *Default*: `true`
+
+ *Optional*: `true | false | quick_deny_anonymous`
+
+ Set true (default) to enable client authentication on this listener, the authentication
+process goes through the configured authentication chain.
+When set to false to allow any clients with or without authentication information such as username or password to log in.
+When set to quick_deny_anonymous, it behaves like when set to true, but clients will be
+denied immediately without going through any authenticators if username is not provided. This is useful to fence off
+anonymous clients early.
+
+
+**listeners.tcp.$name.max_conn_rate**
+
+ *Type*: `rate`
+
+ Maximum connection rate.${clientid}: clientid
+ - ${username}: username
+
+
+**listeners.ssl.$name.enable_authn**
+
+ *Type*: `enum`
+
+ *Default*: `true`
+
+ *Optional*: `true | false | quick_deny_anonymous`
+
+ Set true (default) to enable client authentication on this listener, the authentication
+process goes through the configured authentication chain.
+When set to false to allow any clients with or without authentication information such as username or password to log in.
+When set to quick_deny_anonymous, it behaves like when set to true, but clients will be
+denied immediately without going through any authenticators if username is not provided. This is useful to fence off
+anonymous clients early.
+
+
+**listeners.ssl.$name.max_conn_rate**
+
+ *Type*: `rate`
+
+ Maximum connection rate."TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256" or
+["TLS_AES_256_GCM_SHA384","TLS_AES_128_GCM_SHA256"].
+versions ('tlsv1.1', 'tlsv1.2' or 'tlsv1.3')
+incompatible cipher suites will be silently dropped.
+For instance, if only 'tlsv1.3' is given in the versions,
+configuring cipher suites for other versions will have no effect.
+versions."RSA-PSK-AES256-GCM-SHA384,RSA-PSK-AES256-CBC-SHA384,
+RSA-PSK-AES128-GCM-SHA256,RSA-PSK-AES128-CBC-SHA256,
+RSA-PSK-AES256-CBC-SHA,RSA-PSK-AES128-CBC-SHA,
+RSA-PSK-DES-CBC3-SHA,RSA-PSK-RC4-SHA"${clientid}: clientid
+ - ${username}: username
+
+
+**listeners.quic.$name.enable_authn**
+
+ *Type*: `enum`
+
+ *Default*: `true`
+
+ *Optional*: `true | false | quick_deny_anonymous`
+
+ Set true (default) to enable client authentication on this listener, the authentication
+process goes through the configured authentication chain.
+When set to false to allow any clients with or without authentication information such as username or password to log in.
+When set to quick_deny_anonymous, it behaves like when set to true, but clients will be
+denied immediately without going through any authenticators if username is not provided. This is useful to fence off
+anonymous clients early.
+
+
+**listeners.quic.$name.max_conn_rate**
+
+ *Type*: `rate`
+
+ Maximum connection rate.${clientid}: clientid
+ - ${username}: username
+
+
+**listeners.ws.$name.enable_authn**
+
+ *Type*: `enum`
+
+ *Default*: `true`
+
+ *Optional*: `true | false | quick_deny_anonymous`
+
+ Set true (default) to enable client authentication on this listener, the authentication
+process goes through the configured authentication chain.
+When set to false to allow any clients with or without authentication information such as username or password to log in.
+When set to quick_deny_anonymous, it behaves like when set to true, but clients will be
+denied immediately without going through any authenticators if username is not provided. This is useful to fence off
+anonymous clients early.
+
+
+**listeners.ws.$name.max_conn_rate**
+
+ *Type*: `rate`
+
+ Maximum connection rate.${clientid}: clientid
+ - ${username}: username
+
+
+**listeners.wss.$name.enable_authn**
+
+ *Type*: `enum`
+
+ *Default*: `true`
+
+ *Optional*: `true | false | quick_deny_anonymous`
+
+ Set true (default) to enable client authentication on this listener, the authentication
+process goes through the configured authentication chain.
+When set to false to allow any clients with or without authentication information such as username or password to log in.
+When set to quick_deny_anonymous, it behaves like when set to true, but clients will be
+denied immediately without going through any authenticators if username is not provided. This is useful to fence off
+anonymous clients early.
+
+
+**listeners.wss.$name.max_conn_rate**
+
+ *Type*: `rate`
+
+ Maximum connection rate.No Local in MQTT 5.0.
+
+
+**mqtt.strict_mode**
+
+ *Type*: `boolean`
+
+ *Default*: `false`
+
+ Whether to parse MQTT messages in strict mode.
+In strict mode, invalid utf8 strings in for example client ID, topic name, etc. will cause the client to be disconnected.
+
+
+**mqtt.response_information**
+
+ *Type*: `string`
+
+ *Default*: `""`
+
+ UTF-8 string, for creating the response topic, for example, if set to reqrsp/, the publisher/subscriber will communicate using the topic prefix reqrsp/.
+To disable this feature, input "" in the text box below. Only applicable to MQTT 5.0 clients.
+
+
+**mqtt.server_keepalive**
+
+ *Type*: `pos_integer | disabled`
+
+ *Default*: `disabled`
+
+ The keep alive duration required by EMQX. To use the setting from the client side, choose disabled from the drop-down list. Only applicable to MQTT 5.0 clients.
+
+
+**mqtt.keepalive_multiplier**
+
+ *Type*: `number`
+
+ *Default*: `1.5`
+
+ Keep-Alive Timeout = Keep-Alive interval × Keep-Alive Multiplier.
+The default value 1.5 is following the MQTT 5.0 specification. This multiplier is adjustable, providing system administrators flexibility for tailoring to their specific needs. For instance, if a client's 10-second Keep-Alive interval PINGREQ gets delayed by an extra 10 seconds, changing the multiplier to 2 lets EMQX tolerate this delay.
+
+
+**mqtt.retry_interval**
+
+ *Type*: `duration`
+
+ *Default*: `30s`
+
+ Retry interval for QoS 1/2 message delivering.
+
+
+**mqtt.use_username_as_clientid**
+
+ *Type*: `boolean`
+
+ *Default*: `false`
+
+ Whether to use Username as Client ID.
+This setting takes effect later than Use Peer Certificate as Username and Use peer certificate as Client ID.
+
+
+**mqtt.peer_cert_as_username**
+
+ *Type*: `enum`
+
+ *Default*: `disabled`
+
+ *Optional*: `disabled | cn | dn | crt | pem | md5`
+
+ Use the CN, DN field in the peer certificate or the entire certificate content as Username. Only works for the TLS connection.
+Supported configurations are the following:
+- cn: CN field of the certificate
+- dn: DN field of the certificate
+- crt: Content of the DER or PEM certificate
+- pem: Convert DER certificate content to PEM format and use as Username
+- md5: MD5 value of the DER or PEM certificate
+
+
+**mqtt.peer_cert_as_clientid**
+
+ *Type*: `enum`
+
+ *Default*: `disabled`
+
+ *Optional*: `disabled | cn | dn | crt | pem | md5`
+
+ Use the CN, DN field in the peer certificate or the entire certificate content as Client ID. Only works for the TLS connection.
+Supported configurations are the following:
+- cn: CN field of the certificate
+- dn: DN field of the certificate
+- crt: DER or PEM certificate
+- pem: Convert DER certificate content to PEM format and use as Client ID
+- md5: MD5 value of the DER or PEM certificate
+
+
+**mqtt.session_expiry_interval**
+
+ *Type*: `duration`
+
+ *Default*: `2h`
+
+ Specifies how long the session will expire after the connection is disconnected, only for non-MQTT 5.0 connections.
+
+
+**mqtt.max_awaiting_rel**
+
+ *Type*: `non_neg_integer | infinity`
+
+ *Default*: `100`
+
+ For each publisher session, the maximum number of outstanding QoS 2 messages pending on the client to send PUBREL. After reaching this limit, new QoS 2 PUBLISH requests will be rejected with `147(0x93)` until either PUBREL is received or timed out.
+
+
+**mqtt.max_qos_allowed**
+
+ *Type*: `qos`
+
+ *Default*: `2`
+
+ Maximum QoS allowed.
+
+
+**mqtt.mqueue_priorities**
+
+ *Type*: `disabled | map`
+
+ *Default*: `disabled`
+
+ Topic priorities. Priority number [1-255]
+There's no priority table by default, hence all messages are treated equal.
+
+**NOTE**: Comma and equal signs are not allowed for priority topic names.
+**NOTE**: Messages for topics not in the priority table are treated as either highest or lowest priority depending on the configured value for mqtt.mqueue_default_priority.
+
+**Examples**:
+To configure "topic/1" > "topic/2":
+mqueue_priorities: {"topic/1": 10, "topic/2": 8}
+
+
+**mqtt.mqueue_default_priority**
+
+ *Type*: `enum`
+
+ *Default*: `lowest`
+
+ *Optional*: `highest | lowest`
+
+ Default topic priority, which will be used by topics not in Topic Priorities (mqueue_priorities).
+
+
+**mqtt.mqueue_store_qos0**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ Specifies whether to store QoS 0 messages in the message queue while the connection is down but the session remains.
+
+
+**mqtt.max_mqueue_len**
+
+ *Type*: `non_neg_integer | infinity`
+
+ *Default*: `1000`
+
+ Maximum queue length. Enqueued messages when persistent client disconnected, or inflight window is full.
+
+
+**mqtt.max_inflight**
+
+ *Type*: `integer`
+
+ *Default*: `32`
+
+ *Optional*: `1-65535`
+
+ Maximum number of QoS 1 and QoS 2 messages that are allowed to be delivered simultaneously before completing the acknowledgment.
+
+
+**mqtt.max_subscriptions**
+
+ *Type*: `1..inf | infinity`
+
+ *Default*: `infinity`
+
+ Maximum number of subscriptions allowed per client.
+
+
+**mqtt.upgrade_qos**
+
+ *Type*: `boolean`
+
+ *Default*: `false`
+
+ Force upgrade of QoS level according to subscription.
+
+
+**mqtt.await_rel_timeout**
+
+ *Type*: `duration`
+
+ *Default*: `300s`
+
+ For client to broker QoS 2 message, the time limit for the broker to wait before the `PUBREL` message is received. The wait is aborted after timed out, meaning the packet ID is freed for new `PUBLISH` requests. Receiving a stale `PUBREL` causes a warning level log. Note, the message is delivered to subscribers before entering the wait for PUBREL.
+
+
+
+
+
+
+
+### Retainer
+
+
+Configuration related to handling `PUBLISH` packets with a `retain` flag set to 1.
+
+**retainer.enable**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ Enable retainer feature
+
+
+**retainer.msg_expiry_interval**
+
+ *Type*: `duration_ms`
+
+ *Default*: `0s`
+
+ Message retention time. This config is only applicable for messages without the Message Expiry Interval message property.
+0 means message will never expire.
+
+
+**retainer.msg_clear_interval**
+
+ *Type*: `timeout_duration_ms`
+
+ *Default*: `0s`
+
+ Interval for EMQX to scan expired messages and delete them. Never scan if the value is 0.
+
+
+**retainer.max_payload_size**
+
+ *Type*: `bytesize`
+
+ *Default*: `1MB`
+
+ Maximum retained message size.
+
+
+**retainer.stop_publish_clear_msg**
+
+ *Type*: `boolean`
+
+ *Default*: `false`
+
+ When the retained flag of the `PUBLISH` message is set and Payload is empty,
+whether to continue to publish the message.
+See:
+http://docs.oasis-open.org/mqtt/mqtt/v3.1.1/os/mqtt-v3.1.1-os.html#_Toc398718038
+
+
+**retainer.delivery_rate**
+
+ *Type*: `rate`
+
+ The maximum rate of delivering retained messages
+
+
+**retainer.backend**
+
+ *Type*: `retainer:mnesia_config`
+
+ Settings for the database storing the retained messages.
+
+
+
+
+
+
+Configuration of the internal database storing retained messages.
+
+**retainer.backend.type**
+
+ *Type*: `built_in_database`
+
+ *Default*: `built_in_database`
+
+ Backend type.
+
+
+**retainer.backend.storage_type**
+
+ *Type*: `enum`
+
+ *Default*: `ram`
+
+ *Optional*: `ram | disc`
+
+ Specifies whether the messages are stored in RAM or persisted on disc.
+
+
+**retainer.backend.max_retained_messages**
+
+ *Type*: `non_neg_integer`
+
+ *Default*: `0`
+
+ Maximum number of retained messages. 0 means no limit.
+
+
+**retainer.backend.index_specs**
+
+ *Type*: `[[integer]]`
+
+ *Default*: `[[1,2,3],[1,3],[2,3],[3]]`
+
+ Retainer index specifications: list of arrays of positive ascending integers. Each array specifies an index. Numbers in an index specification are 1-based word positions in topics. Words from specified positions will be used for indexing.[2, 4] index to optimize +/X/+/Y/... topic wildcard subscriptions.
+
+
+
+### Shared subscription
+
+You can set to enable or disable shared subscription configuration via `mqtt.shared_subscription` or `zone.$name.shared_subscription` item.
+
+
+
+### System topics
+
+
+The EMQX Broker periodically publishes its own status, message statistics,
+client online and offline events to the system topic starting with `$SYS/`.
+
+The following options control the behavior of `$SYS` topics.
+
+**sys_topics.sys_msg_interval**
+
+ *Type*: `disabled | duration`
+
+ *Default*: `1m`
+
+ Time interval for publishing following system messages:
+ - `$SYS/brokers`
+ - `$SYS/brokers/ { Authorization = "some-authz-tokens"}
+
+
+**prometheus.job_name**
+
+ *Type*: `string`
+
+ *Default*: `${name}/instance/${name}~${host}`
+
+ Job Name that is pushed to the Push Gateway. Available variables:emqx@127.0.0.1 then the name variable takes value emqx and the host variable takes value 127.0.0.1.${name}/instance/${name}~${host}
+
+
+**prometheus.enable**
+
+ *Type*: `boolean`
+
+ *Default*: `false`
+
+ Turn Prometheus data pushing on or off
+
+
+**prometheus.vm_dist_collector**
+
+ *Type*: `enum`
+
+ *Default*: `disabled`
+
+ *Optional*: `disabled | enabled`
+
+ Enable or disable VM distribution collector, collects information about the sockets and processes involved in the Erlang distribution mechanism.
+
+
+**prometheus.mnesia_collector**
+
+ *Type*: `enum`
+
+ *Default*: `disabled`
+
+ *Optional*: `enabled | disabled`
+
+ Enable or disable Mnesia metrics collector
+
+
+**prometheus.vm_statistics_collector**
+
+ *Type*: `enum`
+
+ *Default*: `disabled`
+
+ *Optional*: `enabled | disabled`
+
+ Enable or disable VM statistics collector.
+
+
+**prometheus.vm_system_info_collector**
+
+ *Type*: `enum`
+
+ *Default*: `disabled`
+
+ *Optional*: `enabled | disabled`
+
+ Enable or disable VM system info collector.
+
+
+**prometheus.vm_memory_collector**
+
+ *Type*: `enum`
+
+ *Default*: `disabled`
+
+ *Optional*: `enabled | disabled`
+
+ Enable or disable VM memory metrics collector.
+
+
+**prometheus.vm_msacc_collector**
+
+ *Type*: `enum`
+
+ *Default*: `disabled`
+
+ *Optional*: `enabled | disabled`
+
+ Enable or disable VM microstate accounting metrics collector.
+
+
+
+## Integration With OpenTelemetry
+
+
+Open Telemetry Toolkit configuration
+
+**opentelemetry.exporter**
+
+ *Type*: `opentelemetry:exporter`
+
+ Open Telemetry Exporter
+
+
+**opentelemetry.enable**
+
+ *Type*: `boolean`
+
+ *Default*: `false`
+
+ Enable or disable open telemetry metrics
+
+
+
+
+Open Telemetry Exporter
+
+**opentelemetry.exporter.endpoint**
+
+ *Type*: `url`
+
+ *Default*: `http://localhost:4317`
+
+ Open Telemetry Exporter Endpoint
+
+
+**opentelemetry.exporter.interval**
+
+ *Type*: `timeout_duration_ms`
+
+ *Default*: `10s`
+
+ The interval of sending metrics to Open Telemetry Endpoint
+
+
+
+
+
+
+## Slow subscriptions
+
+Slow subscription message latency threshold and statistics policy configuration.
+
+**slow_subs.enable**
+
+ *Type*: `boolean`
+
+ *Default*: `false`
+
+ Enable this feature
+
+
+**slow_subs.threshold**
+
+ *Type*: `duration_ms`
+
+ *Default*: `500ms`
+
+ The latency threshold for statistics
+
+
+**slow_subs.expire_interval**
+
+ *Type*: `duration_ms`
+
+ *Default*: `300s`
+
+ The eviction time of the record, which in the statistics record table
+
+
+**slow_subs.top_k_num**
+
+ *Type*: `pos_integer`
+
+ *Default*: `10`
+
+ The maximum number of records in the slow subscription statistics record table
+
+
+**slow_subs.stats_type**
+
+ *Type*: `enum`
+
+ *Default*: `whole`
+
+ *Optional*: `whole | internal | response`
+
+ The method to calculate the latency
+
+
+
+
+
+## Alarms and Monitoring
+
+
+Settings for the alarms.
+
+**alarm.actions**
+
+ *Type*: `array`
+
+ *Default*: `["log","publish"]`
+
+ The actions triggered when the alarm is activated.log and publish.
+log is to write the alarm to log (console or file).
+publish is to publish the alarm as an MQTT message to the system topics:
+$SYS/brokers/emqx@xx.xx.xx.x/alarms/activate and
+$SYS/brokers/emqx@xx.xx.xx.x/alarms/deactivate
+
+
+**alarm.size_limit**
+
+ *Type*: `integer`
+
+ *Default*: `1000`
+
+ *Optional*: `1-3000`
+
+ The maximum total number of deactivated alarms to keep as history.long_gc log is emitted,
+and an MQTT message is published to the system topic $SYS/sysmon/long_gc.
+
+
+**sysmon.vm.long_schedule**
+
+ *Type*: `disabled | duration`
+
+ *Default*: `240ms`
+
+ When the Erlang VM detect a task scheduled for too long, a warning level 'long_schedule' log is emitted,
+and an MQTT message is published to the system topic $SYS/sysmon/long_schedule.
+
+
+**sysmon.vm.large_heap**
+
+ *Type*: `disabled | bytesize`
+
+ *Default*: `32MB`
+
+ When an Erlang process consumed a large amount of memory for its heap space,
+the system will write a warning level large_heap log, and an MQTT message is published to
+the system topic $SYS/sysmon/large_heap.
+
+
+**sysmon.vm.busy_dist_port**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ When the RPC connection used to communicate with other nodes in the cluster is overloaded,
+there will be a busy_dist_port warning log,
+and an MQTT message is published to system topic $SYS/sysmon/busy_dist_port.
+
+
+**sysmon.vm.busy_port**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ When a port (e.g. TCP socket) is overloaded, there will be a busy_port warning log,
+and an MQTT message is published to the system topic $SYS/sysmon/busy_port.
+
+
+
+## Rate Limit
+
+For an introduction to rate limiting and its use, please refer to [rate limiting](../rate-limit/rate-limit.md).
+
+
+
+## Performance optimization
+
+
+
+### force_gc
+
+
+Force garbage collection in MQTT connection process after
+ they process certain number of messages or bytes of data.
+
+**force_gc.enable**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ Enable forced garbage collection.
+
+
+**force_gc.count**
+
+ *Type*: `integer`
+
+ *Default*: `16000`
+
+ *Optional*: `0-inf`
+
+ GC the process after this many received messages.
+
+
+**force_gc.bytes**
+
+ *Type*: `bytesize`
+
+ *Default*: `16MB`
+
+ GC the process after specified number of bytes have passed through.
+
+
+
+### force_shutdown
+
+
+When the process message queue length, or the memory bytes
+reaches a certain value, the process is forced to close.
+
+Note: "message queue" here refers to the "message mailbox"
+of the Erlang process, not the `mqueue` of QoS 1 and QoS 2.
+
+**force_shutdown.enable**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ Enable `force_shutdown` feature.
+
+
+**force_shutdown.max_mailbox_size**
+
+ *Type*: `integer`
+
+ *Default*: `1000`
+
+ *Optional*: `0-inf`
+
+ In EMQX, each online client corresponds to an individual Erlang process. The configuration value establishes a mailbox size limit for these processes. If the mailbox size surpasses this limit, the client will be automatically terminated.
+
+
+**force_shutdown.max_heap_size**
+
+ *Type*: `wordsize`
+
+ *Default*: `32MB`
+
+ Total heap size
+
+
+
+
+
+### flapping_detect
+
+
+This config controls the allowed maximum number of `CONNECT` packets received
+from the same clientid in a time frame defined by `window_time`.
+After the limit is reached, successive `CONNECT` requests are forbidden
+(banned) until the end of the time period defined by `ban_time`.
+
+**flapping_detect.enable**
+
+ *Type*: `boolean`
+
+ *Default*: `false`
+
+ Enable flapping connection detection feature.
+
+
+**flapping_detect.window_time**
+
+ *Type*: `duration`
+
+ *Default*: `1m`
+
+ The time window for flapping detection.
+
+
+**flapping_detect.max_count**
+
+ *Type*: `non_neg_integer`
+
+ *Default*: `15`
+
+ The maximum number of disconnects allowed for a MQTT Client in `window_time`
+
+
+**flapping_detect.ban_time**
+
+ *Type*: `duration`
+
+ *Default*: `5m`
+
+ How long the flapping clientid will be banned.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+## Dashboard
+
+
+Configuration for EMQX dashboard.
+
+**dashboard.listeners**
+
+ *Type*: `dashboard:listeners`
+
+ HTTP(s) listeners are identified by their protocol type and are
+used to serve dashboard UI and restful HTTP API.
+Listeners must have a unique combination of port number and IP address.
+For example, an HTTP listener can listen on all configured IP addresses
+on a given port for a machine by specifying the IP address 0.0.0.0.
+Alternatively, the HTTP listener can specify a unique IP address for each listener,
+but use the same port.
+
+
+**dashboard.token_expired_time**
+
+ *Type*: `duration`
+
+ *Default*: `60m`
+
+ JWT token expiration time. Default is 60 minutes
+
+
+**dashboard.cors**
+
+ *Type*: `boolean`
+
+ *Default*: `false`
+
+ Support Cross-Origin Resource Sharing (CORS).
+Allows a server to indicate any origins (domain, scheme, or port) other than
+its own from which a browser should permit loading resources.
+
+
+
+
+Configuration for the dashboard listener (plaintext).
+
+**dashboard.listeners.http.bind**
+
+ *Type*: `ip_port`
+
+ *Default*: `0`
+
+ Port without IP(18083) or port with specified IP(127.0.0.1:18083).
+Disabled when setting bind to `0`.
+
+
+**dashboard.listeners.http.num_acceptors**
+
+ *Type*: `integer`
+
+ *Default*: `8`
+
+ Socket acceptor pool size for TCP protocols. Default is the number of schedulers online
+
+
+**dashboard.listeners.http.max_connections**
+
+ *Type*: `integer`
+
+ *Default*: `512`
+
+ Maximum number of simultaneous connections.
+
+
+**dashboard.listeners.http.backlog**
+
+ *Type*: `integer`
+
+ *Default*: `1024`
+
+ Defines the maximum length that the queue of pending connections can grow to.
+
+
+**dashboard.listeners.http.send_timeout**
+
+ *Type*: `duration`
+
+ *Default*: `10s`
+
+ Send timeout for the socket.
+
+
+**dashboard.listeners.http.inet6**
+
+ *Type*: `boolean`
+
+ *Default*: `false`
+
+ Enable IPv6 support, default is false, which means IPv4 only.
+
+
+**dashboard.listeners.http.ipv6_v6only**
+
+ *Type*: `boolean`
+
+ *Default*: `false`
+
+ Disable IPv4-to-IPv6 mapping for the listener.
+The configuration is only valid when the inet6 is true.
+
+
+**dashboard.listeners.http.proxy_header**
+
+ *Type*: `boolean`
+
+ *Default*: `false`
+
+ Enable support for `HAProxy` header. Be aware once enabled regular HTTP requests can't be handled anymore.
+
+
+
+
+Configuration for the dashboard listener (TLS).
+
+**dashboard.listeners.https.bind**
+
+ *Type*: `ip_port`
+
+ *Default*: `0`
+
+ Port without IP(18083) or port with specified IP(127.0.0.1:18083).
+Disabled when setting bind to `0`.
+
+
+**dashboard.listeners.https.ssl_options**
+
+ *Type*: `dashboard:ssl_options`
+
+ SSL/TLS options for the dashboard listener.
+
+
+**dashboard.listeners.https.num_acceptors**
+
+ *Type*: `integer`
+
+ *Default*: `8`
+
+ Socket acceptor pool size for TCP protocols. Default is the number of schedulers online
+
+
+**dashboard.listeners.https.max_connections**
+
+ *Type*: `integer`
+
+ *Default*: `512`
+
+ Maximum number of simultaneous connections.
+
+
+**dashboard.listeners.https.backlog**
+
+ *Type*: `integer`
+
+ *Default*: `1024`
+
+ Defines the maximum length that the queue of pending connections can grow to.
+
+
+**dashboard.listeners.https.send_timeout**
+
+ *Type*: `duration`
+
+ *Default*: `10s`
+
+ Send timeout for the socket.
+
+
+**dashboard.listeners.https.inet6**
+
+ *Type*: `boolean`
+
+ *Default*: `false`
+
+ Enable IPv6 support, default is false, which means IPv4 only.
+
+
+**dashboard.listeners.https.ipv6_v6only**
+
+ *Type*: `boolean`
+
+ *Default*: `false`
+
+ Disable IPv4-to-IPv6 mapping for the listener.
+The configuration is only valid when the inet6 is true.
+
+
+**dashboard.listeners.https.proxy_header**
+
+ *Type*: `boolean`
+
+ *Default*: `false`
+
+ Enable support for `HAProxy` header. Be aware once enabled regular HTTP requests can't be handled anymore.
+
+
+
+
+Configuration for the dashboard listener.
+
+**dashboard.listeners.http**
+
+ *Type*: `dashboard:http`
+
+ TCP listeners
+
+
+**dashboard.listeners.https**
+
+ *Type*: `dashboard:https`
+
+ SSL listeners
+
+
+
+
+SSL/TLS options for the dashboard listener.
+
+**dashboard.listeners.https.ssl_options.cacertfile**
+
+ *Type*: `string`
+
+ *Default*: `${EMQX_ETC_DIR}/certs/cacert.pem`
+
+ Trusted PEM format CA certificates bundle file.['tlsv1.2', 'tlsv1.1'] here.
+
+
+**dashboard.listeners.https.ssl_options.ciphers**
+
+ *Type*: `array`
+
+ *Default*: `[]`
+
+ This config holds TLS cipher suite names separated by comma,
+or as an array of strings. e.g.
+"TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256" or
+["TLS_AES_256_GCM_SHA384","TLS_AES_128_GCM_SHA256"].
+versions ('tlsv1.1', 'tlsv1.2' or 'tlsv1.3')
+incompatible cipher suites will be silently dropped.
+For instance, if only 'tlsv1.3' is given in the versions,
+configuring cipher suites for other versions will have no effect.
+versions."RSA-PSK-AES256-GCM-SHA384,RSA-PSK-AES256-CBC-SHA384,
+RSA-PSK-AES128-GCM-SHA256,RSA-PSK-AES128-CBC-SHA256,
+RSA-PSK-AES256-CBC-SHA,RSA-PSK-AES128-CBC-SHA,
+RSA-PSK-DES-CBC3-SHA,RSA-PSK-RC4-SHA"
+
+
+**dashboard.listeners.https.ssl_options.secure_renegotiate**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ SSL parameter renegotiation is a feature that allows a client and a server
+to renegotiate the parameters of the SSL connection on the fly.
+RFC 5746 defines a more secure way of doing this. By enabling secure renegotiation,
+you drop support for the insecure renegotiation, prone to MitM attacks.dhfile option is not supported by TLS 1.3.
+
+
+**dashboard.listeners.https.ssl_options.honor_cipher_order**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ An important security setting, it forces the cipher to be set based
+ on the server-specified order instead of the client-specified order,
+ hence enforcing the (usually more properly configured) security
+ ordering of the server administrator.
+
+
+**dashboard.listeners.https.ssl_options.client_renegotiation**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ In protocols that support client-initiated renegotiation,
+the cost of resources of such an operation is higher for the server than the client.
+This can act as a vector for denial of service attacks.
+The SSL application already takes measures to counter-act such attempts,
+but client-initiated renegotiation can be strictly disabled by setting this option to false.
+The default value is true. Note that disabling renegotiation can result in
+long-lived connections becoming unusable due to limits on
+the number of messages the underlying cipher suite can encipher.tlsv1.2 enabled, and also PSK cipher suites
+configured, such as RSA-PSK-AES256-GCM-SHA384.
+
+See listener SSL options config for more details.
+
+The IDs and secrets can be provided from a file which is configurable by the init_file field.
+
+**psk_authentication.enable**
+
+ *Type*: `boolean`
+
+ *Default*: `false`
+
+ Whether to enable TLS PSK support
+
+
+**psk_authentication.init_file**
+
+ *Type*: `string`
+
+ If init_file is specified, EMQX will import PSKs from the file into the built-in database at startup for use by the runtime.
+The file has to be structured line-by-line, each line must be in the format of PSKIdentity:SharedSecret.
+For example: mydevice1:c2VjcmV0
+
+
+**psk_authentication.separator**
+
+ *Type*: `string`
+
+ *Default*: `:`
+
+ The separator between PSKIdentity and SharedSecret in the PSK file
+
+
+**psk_authentication.chunk_size**
+
+ *Type*: `integer`
+
+ *Default*: `50`
+
+ The size of each chunk used to import to the built-in database from PSK file
+
+
+
+## Authorization
+
+### Authorization Settings
+
+
+Settings that control client authorization.
+
+**authorization.no_match**
+
+ *Type*: `enum`
+
+ *Default*: `allow`
+
+ *Optional*: `allow | deny`
+
+ Default access control action if the user or client matches no ACL rules,
+or if no such user or client is found by the configurable authorization
+sources such as built_in_database, an HTTP API, or a query against PostgreSQL.
+Find more details in 'authorization.sources' config.
+
+
+**authorization.deny_action**
+
+ *Type*: `enum`
+
+ *Default*: `ignore`
+
+ *Optional*: `ignore | disconnect`
+
+ The action when the authorization check rejects an operation.
+
+
+**authorization.cache**
+
+ *Type*: `broker:authz_cache`
+
+
+**authorization.sources**
+
+ *Type*: `array`
+
+ *Default*: `[{"type":"file","path":"${EMQX_ETC_DIR}/acl.conf","enable":true}]`
+
+ Authorization data sources. http://localhost:9901/${topic} is allowed, but
+ http://${host}:9901/message or http://localhost:${port}/message
+is not allowed.
+
+
+**bridges.webhook.$name.direction**
+
+ *Type*: `egress`
+
+ Deprecated since 5.0.12.
+
+
+**bridges.webhook.$name.local_topic**
+
+ *Type*: `string`
+
+ The MQTT topic filter to be forwarded to the HTTP server. All MQTT 'PUBLISH' messages with the topic
+matching the local_topic will be forwarded.install_dir config keyemqx_foo_bar-0.1.0.
+emqx (or any user which runs EMQX).
+
+
+**plugins.check_interval**
+
+ *Type*: `duration`
+
+ Deprecated since 5.0.24.
+
+
+
+
+A per-plugin config to describe the desired state of the plugin.
+
+**plugins.states.$INDEX.name_vsn**
+
+ *Type*: `string`
+
+ The {name}-{version} of the plugin.['tlsv1.2', 'tlsv1.1'] here.
+
+
+**exhook.servers.$INDEX.ssl.ciphers**
+
+ *Type*: `array`
+
+ *Default*: `[]`
+
+ This config holds TLS cipher suite names separated by comma,
+or as an array of strings. e.g.
+"TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256" or
+["TLS_AES_256_GCM_SHA384","TLS_AES_128_GCM_SHA256"].
+versions ('tlsv1.1', 'tlsv1.2' or 'tlsv1.3')
+incompatible cipher suites will be silently dropped.
+For instance, if only 'tlsv1.3' is given in the versions,
+configuring cipher suites for other versions will have no effect.
+versions."RSA-PSK-AES256-GCM-SHA384,RSA-PSK-AES256-CBC-SHA384,
+RSA-PSK-AES128-GCM-SHA256,RSA-PSK-AES128-CBC-SHA256,
+RSA-PSK-AES256-CBC-SHA,RSA-PSK-AES128-CBC-SHA,
+RSA-PSK-DES-CBC3-SHA,RSA-PSK-RC4-SHA"
+
+
+**exhook.servers.$INDEX.ssl.secure_renegotiate**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ SSL parameter renegotiation is a feature that allows a client and a server
+to renegotiate the parameters of the SSL connection on the fly.
+RFC 5746 defines a more secure way of doing this. By enabling secure renegotiation,
+you drop support for the insecure renegotiation, prone to MitM attacks.${clientid}: clientid${username}: username
+
+
+**gateway.coap.listeners**
+
+ *Type*: `gateway:udp_listeners`
+
+
+**gateway.coap.enable**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ Whether to enable this gateway
+
+
+**gateway.coap.enable_stats**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ Whether to enable client process statistic
+
+
+**gateway.coap.idle_timeout**
+
+ *Type*: `emqx_gateway_schema:duration`
+
+ *Default*: `30s`
+
+ The idle time of the client connection process. It has two purposes:
+ 1. A newly created client process that does not receive any client requests after that time will be closed directly.
+ 2. A running client process that does not receive any client requests after this time will go into hibernation to save resources.
+
+
+**gateway.coap.clientinfo_override**
+
+ *Type*: `gateway:clientinfo_override`
+
+ ClientInfo override.
+
+
+
+### LwM2M
+
+
+The LwM2M protocol gateway.
+
+**gateway.lwm2m.xml_dir**
+
+ *Type*: `string`
+
+ The Directory for LwM2M Resource definition.
+
+
+**gateway.lwm2m.lifetime_min**
+
+ *Type*: `emqx_lwm2m_schema:duration`
+
+ *Default*: `15s`
+
+ Minimum value of lifetime allowed to be set by the LwM2M client.
+
+
+**gateway.lwm2m.lifetime_max**
+
+ *Type*: `emqx_lwm2m_schema:duration`
+
+ *Default*: `86400s`
+
+ Maximum value of lifetime allowed to be set by the LwM2M client.
+
+
+**gateway.lwm2m.qmode_time_window**
+
+ *Type*: `emqx_lwm2m_schema:duration_s`
+
+ *Default*: `22s`
+
+ The value of the time window during which the network link is considered valid by the LwM2M Gateway in QMode mode.
+For example, after receiving an update message from a client, any messages within this time window are sent directly to the LwM2M client, and all messages beyond this time window are temporarily stored in memory.
+
+
+**gateway.lwm2m.auto_observe**
+
+ *Type*: `boolean`
+
+ *Default*: `false`
+
+ Automatically observe the object list of REGISTER packet.
+
+
+**gateway.lwm2m.update_msg_publish_condition**
+
+ *Type*: `enum`
+
+ *Default*: `contains_object_list`
+
+ *Optional*: `always | contains_object_list`
+
+ Policy for publishing UPDATE event message.${clientid}: clientid${username}: username
+
+
+**gateway.lwm2m.listeners**
+
+ *Type*: `gateway:udp_listeners`
+
+
+**gateway.lwm2m.enable**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ Whether to enable this gateway
+
+
+**gateway.lwm2m.enable_stats**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ Whether to enable client process statistic
+
+
+**gateway.lwm2m.idle_timeout**
+
+ *Type*: `emqx_gateway_schema:duration`
+
+ *Default*: `30s`
+
+ The idle time of the client connection process. It has two purposes:
+ 1. A newly created client process that does not receive any client requests after that time will be closed directly.
+ 2. A running client process that does not receive any client requests after this time will go into hibernation to save resources.
+
+
+**gateway.lwm2m.clientinfo_override**
+
+ *Type*: `gateway:clientinfo_override`
+
+ ClientInfo override.
+
+
+
+
+MQTT topics that correspond to LwM2M events.
+
+**gateway.lwm2m.translators.command**
+
+ *Type*: `translator`
+
+ The topic for receiving downstream commands.
+For each new LwM2M client that succeeds in going online, the gateway creates a subscription relationship to receive downstream commands and send it to the LwM2M client
+
+
+**gateway.lwm2m.translators.response**
+
+ *Type*: `translator`
+
+ The topic for gateway to publish the acknowledge events from LwM2M client
+
+
+**gateway.lwm2m.translators.notify**
+
+ *Type*: `translator`
+
+ The topic for gateway to publish the notify events from LwM2M client.
+After succeed observe a resource of LwM2M client, Gateway will send the notify events via this topic, if the client reports any resource changes
+
+
+**gateway.lwm2m.translators.register**
+
+ *Type*: `translator`
+
+ The topic for gateway to publish the register events from LwM2M client.
+
+
+**gateway.lwm2m.translators.update**
+
+ *Type*: `translator`
+
+ The topic for gateway to publish the update events from LwM2M client
+
+
+
+
+MQTT topic that corresponds to a particular type of event.
+
+**translator.topic**
+
+ *Type*: `string`
+
+ Topic Name
+
+
+**translator.qos**
+
+ *Type*: `qos`
+
+ *Default*: `0`
+
+ QoS Level
+
+
+
+
+Topology of MongoDB.
+
+**topology.max_overflow**
+
+ *Type*: `non_neg_integer`
+
+ *Default*: `0`
+
+ The maximum number of additional workers that can be created when all workers in the pool are busy. This helps to manage temporary spikes in workload by allowing more concurrent connections to the MongoDB server.
+
+
+**topology.overflow_ttl**
+
+ *Type*: `timeout_duration_ms`
+
+ Period of time before workers that exceed the configured pool size ("overflow") to be terminated.
+
+
+**topology.overflow_check_period**
+
+ *Type*: `timeout_duration_ms`
+
+ Period for checking if there are more workers than configured ("overflow").
+
+
+**topology.local_threshold_ms**
+
+ *Type*: `timeout_duration_ms`
+
+ The size of the latency window for selecting among multiple suitable MongoDB instances.
+
+
+**topology.connect_timeout_ms**
+
+ *Type*: `timeout_duration_ms`
+
+ The duration to attempt a connection before timing out.
+
+
+**topology.socket_timeout_ms**
+
+ *Type*: `timeout_duration_ms`
+
+ The duration to attempt to send or to receive on a socket before the attempt times out.
+
+
+**topology.server_selection_timeout_ms**
+
+ *Type*: `timeout_duration_ms`
+
+ Specifies how long to block for server selection before throwing an exception.
+
+
+**topology.wait_queue_timeout_ms**
+
+ *Type*: `timeout_duration_ms`
+
+ The maximum duration that a worker can wait for a connection to become available.
+
+
+**topology.heartbeat_frequency_ms**
+
+ *Type*: `timeout_duration_ms`
+
+ *Default*: `200s`
+
+ Controls when the driver checks the state of the MongoDB deployment. Specify the interval between checks, counted from the end of the previous check until the beginning of the next one. If the number of connections is increased (which will happen, for example, if you increase the pool size), you may need to increase this period as well to avoid creating too many log entries in the MongoDB log file.
+
+
+**topology.min_heartbeat_frequency_ms**
+
+ *Type*: `timeout_duration_ms`
+
+ Controls the minimum amount of time to wait between heartbeats.
+
+
+
+### MQTT-SN
+
+
+The MQTT-SN (MQTT for Sensor Networks) protocol gateway.
+
+**gateway.mqttsn.gateway_id**
+
+ *Type*: `integer`
+
+ *Default*: `1`
+
+ MQTT-SN Gateway ID.
+When the broadcast option is enabled, the gateway will broadcast ADVERTISE message with this value
+
+
+**gateway.mqttsn.broadcast**
+
+ *Type*: `boolean`
+
+ *Default*: `false`
+
+ Whether to periodically broadcast ADVERTISE messages
+
+
+**gateway.mqttsn.enable_qos3**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ Allows connectionless clients to publish messages with a Qos of -1.
+This feature is defined for very simple client implementations which do not support any other features except this one. There is no connection setup nor tear down, no registration nor subscription. The client just sends its 'PUBLISH' messages to a GW
+
+
+**gateway.mqttsn.subs_resume**
+
+ *Type*: `boolean`
+
+ *Default*: `false`
+
+ Whether to initiate all subscribed topic name registration messages to the client after the Session has been taken over by a new channel
+
+
+**gateway.mqttsn.predefined**
+
+ *Type*: `array`
+
+ *Default*: `[]`
+
+ The pre-defined topic IDs and topic names.
+A 'pre-defined' topic ID is a topic ID whose mapping to a topic name is known in advance by both the client's application and the gateway
+
+
+**gateway.mqttsn.mountpoint**
+
+ *Type*: `string`
+
+ *Default*: `""`
+
+ When publishing or subscribing, prefix all topics with a mountpoint string.
+The prefixed string will be removed from the topic name when the message is delivered to the subscriber.
+The mountpoint is a way that users can use to implement isolation of message routing between different listeners.
+For example if a client A subscribes to `t` with `listeners.tcp.\${clientid}: clientid${username}: username
+
+
+**gateway.mqttsn.listeners**
+
+ *Type*: `gateway:udp_listeners`
+
+
+**gateway.mqttsn.enable**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ Whether to enable this gateway
+
+
+**gateway.mqttsn.enable_stats**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ Whether to enable client process statistic
+
+
+**gateway.mqttsn.idle_timeout**
+
+ *Type*: `emqx_gateway_schema:duration`
+
+ *Default*: `30s`
+
+ The idle time of the client connection process. It has two purposes:
+ 1. A newly created client process that does not receive any client requests after that time will be closed directly.
+ 2. A running client process that does not receive any client requests after this time will go into hibernation to save resources.
+
+
+**gateway.mqttsn.clientinfo_override**
+
+ *Type*: `gateway:clientinfo_override`
+
+ ClientInfo override.
+
+
+
+
+The pre-defined topic name corresponding to the pre-defined topic
+ID of N.
+
+Note: the pre-defined topic ID of 0 is reserved.
+
+**gateway.mqttsn.predefined.$INDEX.id**
+
+ *Type*: `integer`
+
+ *Optional*: `1-1024`
+
+ Topic ID. Range: 1-65535
+
+
+**gateway.mqttsn.predefined.$INDEX.topic**
+
+ *Type*: `string`
+
+ Topic Name
+
+
+
+### STOMP
+
+
+The STOMP protocol gateway provides EMQX with the ability to access STOMP
+(Simple (or Streaming) Text Orientated Messaging Protocol) protocol.
+
+**gateway.stomp.frame**
+
+ *Type*: `stomp_frame`
+
+
+**gateway.stomp.mountpoint**
+
+ *Type*: `string`
+
+ *Default*: `""`
+
+ When publishing or subscribing, prefix all topics with a mountpoint string.
+The prefixed string will be removed from the topic name when the message is delivered to the subscriber.
+The mountpoint is a way that users can use to implement isolation of message routing between different listeners.
+For example if a client A subscribes to `t` with `listeners.tcp.\${clientid}: clientid${username}: username
+
+
+**gateway.stomp.listeners**
+
+ *Type*: `gateway:tcp_listeners`
+
+
+**gateway.stomp.enable**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ Whether to enable this gateway
+
+
+**gateway.stomp.enable_stats**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ Whether to enable client process statistic
+
+
+**gateway.stomp.idle_timeout**
+
+ *Type*: `emqx_gateway_schema:duration`
+
+ *Default*: `30s`
+
+ The idle time of the client connection process. It has two purposes:
+ 1. A newly created client process that does not receive any client requests after that time will be closed directly.
+ 2. A running client process that does not receive any client requests after this time will go into hibernation to save resources.
+
+
+**gateway.stomp.clientinfo_override**
+
+ *Type*: `gateway:clientinfo_override`
+
+ ClientInfo override.
+
+
+
+
+Size limits for the STOMP frames.
+
+**gateway.stomp.frame.max_headers**
+
+ *Type*: `non_neg_integer`
+
+ *Default*: `10`
+
+ The maximum number of Header
+
+
+**gateway.stomp.frame.max_headers_length**
+
+ *Type*: `non_neg_integer`
+
+ *Default*: `1024`
+
+ The maximum string length of the Header Value
+
+
+**gateway.stomp.frame.max_body_length**
+
+ *Type*: `integer`
+
+ *Default*: `65536`
+
+ Maximum number of bytes of Body allowed per Stomp packet
+
+
+
+### ExProto
+
+
+Settings for EMQX extension protocol (exproto).
+
+**gateway.exproto.server**
+
+ *Type*: `exproto_grpc_server`
+
+ Configurations for starting the ConnectionAdapter service
+
+
+**gateway.exproto.handler**
+
+ *Type*: `exproto_grpc_handler`
+
+ Configurations for request to ConnectionHandler service
+
+
+**gateway.exproto.mountpoint**
+
+ *Type*: `string`
+
+ *Default*: `""`
+
+ When publishing or subscribing, prefix all topics with a mountpoint string.
+The prefixed string will be removed from the topic name when the message is delivered to the subscriber.
+The mountpoint is a way that users can use to implement isolation of message routing between different listeners.
+For example if a client A subscribes to `t` with `listeners.tcp.\${clientid}: clientid${username}: username
+
+
+**gateway.exproto.listeners**
+
+ *Type*: `gateway:tcp_udp_listeners`
+
+
+**gateway.exproto.enable**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ Whether to enable this gateway
+
+
+**gateway.exproto.enable_stats**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ Whether to enable client process statistic
+
+
+**gateway.exproto.idle_timeout**
+
+ *Type*: `emqx_gateway_schema:duration`
+
+ *Default*: `30s`
+
+ The idle time of the client connection process. It has two purposes:
+ 1. A newly created client process that does not receive any client requests after that time will be closed directly.
+ 2. A running client process that does not receive any client requests after this time will go into hibernation to save resources.
+
+
+**gateway.exproto.clientinfo_override**
+
+ *Type*: `gateway:clientinfo_override`
+
+ ClientInfo override.
+
+
+
+
+Settings for the exproto gRPC connection handler.
+
+**gateway.exproto.handler.address**
+
+ *Type*: `string`
+
+ gRPC server address.
+
+
+**gateway.exproto.handler.service_name**
+
+ *Type*: `ConnectionHandler | ConnectionUnaryHandler`
+
+ *Default*: `ConnectionUnaryHandler`
+
+ The service name to handle the connection events.
+In the initial version, we expected to use streams to improve the efficiency
+of requests in `ConnectionHandler`. But unfortunately, events between different
+streams are out of order. It causes the `OnSocketCreated` event to may arrive
+later than `OnReceivedBytes`.
+So we added the `ConnectionUnaryHandler` service since v5.0.25 and forced
+the use of Unary in it to avoid ordering problems.
+
+
+**gateway.exproto.handler.ssl_options**
+
+ *Type*: [ssl_client_opts](#ssl-tls-configuration-for-clients)
+
+ SSL configuration for the gRPC client.
+
+
+
+
+Settings for the exproto gRPC server.
+
+**gateway.exproto.server.bind**
+
+ *Type*: `emqx_exproto_schema:ip_port`
+
+ Listening address and port for the gRPC server.
+
+
+**gateway.exproto.server.ssl_options**
+
+ *Type*: `ssl_server_opts`
+
+ SSL configuration for the gRPC server.
+
+
+
+
+SSL configuration for the server.
+
+**gateway.exproto.server.ssl_options.cacertfile**
+
+ *Type*: `string`
+
+ *Default*: `${EMQX_ETC_DIR}/certs/cacert.pem`
+
+ Trusted PEM format CA certificates bundle file.['tlsv1.2', 'tlsv1.1'] here.
+
+
+**gateway.exproto.server.ssl_options.ciphers**
+
+ *Type*: `array`
+
+ *Default*: `[]`
+
+ This config holds TLS cipher suite names separated by comma,
+or as an array of strings. e.g.
+"TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256" or
+["TLS_AES_256_GCM_SHA384","TLS_AES_128_GCM_SHA256"].
+versions ('tlsv1.1', 'tlsv1.2' or 'tlsv1.3')
+incompatible cipher suites will be silently dropped.
+For instance, if only 'tlsv1.3' is given in the versions,
+configuring cipher suites for other versions will have no effect.
+versions."RSA-PSK-AES256-GCM-SHA384,RSA-PSK-AES256-CBC-SHA384,
+RSA-PSK-AES128-GCM-SHA256,RSA-PSK-AES128-CBC-SHA256,
+RSA-PSK-AES256-CBC-SHA,RSA-PSK-AES128-CBC-SHA,
+RSA-PSK-DES-CBC3-SHA,RSA-PSK-RC4-SHA"
+
+
+**gateway.exproto.server.ssl_options.secure_renegotiate**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ SSL parameter renegotiation is a feature that allows a client and a server
+to renegotiate the parameters of the SSL connection on the fly.
+RFC 5746 defines a more secure way of doing this. By enabling secure renegotiation,
+you drop support for the insecure renegotiation, prone to MitM attacks.dhfile option is not supported by TLS 1.3.
+
+
+**gateway.exproto.server.ssl_options.fail_if_no_peer_cert**
+
+ *Type*: `boolean`
+
+ *Default*: `false`
+
+ Used together with {verify, verify_peer} by an TLS/DTLS server.
+If set to true, the server fails if the client does not have a
+certificate to send, that is, sends an empty certificate.
+If set to false, it fails only if the client sends an invalid
+certificate (an empty certificate is considered valid).
+
+
+**gateway.exproto.server.ssl_options.honor_cipher_order**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ An important security setting, it forces the cipher to be set based
+ on the server-specified order instead of the client-specified order,
+ hence enforcing the (usually more properly configured) security
+ ordering of the server administrator.
+
+
+**gateway.exproto.server.ssl_options.client_renegotiation**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ In protocols that support client-initiated renegotiation,
+the cost of resources of such an operation is higher for the server than the client.
+This can act as a vector for denial of service attacks.
+The SSL application already takes measures to counter-act such attempts,
+but client-initiated renegotiation can be strictly disabled by setting this option to false.
+The default value is true. Note that disabling renegotiation can result in
+long-lived connections becoming unusable due to limits on
+the number of messages the underlying cipher suite can encipher.true (default) to enable client authentication on this listener.
+When set to false clients will be allowed to connect without authentication.
+
+
+**gateway:tcp_listener.mountpoint**
+
+ *Type*: `string`
+
+ When publishing or subscribing, prefix all topics with a mountpoint string.
+The prefixed string will be removed from the topic name when the message is delivered to the subscriber.
+The mountpoint is a way that users can use to implement isolation of message routing between different listeners.
+For example if a client A subscribes to `t` with `listeners.tcp.\${clientid}: clientid${username}: username
+
+
+**gateway:tcp_listener.access_rules**
+
+ *Type*: `array`
+
+ *Default*: `[]`
+
+ The access control rules for this listener.
+See: https://github.com/emqtt/esockd#allowdeny
+
+
+
+
+Settings for the TCP listeners.
+
+**gateway.stomp.listeners.tcp**
+
+ *Type*: `name`
+
+ A map from listener names to listener settings.
+
+
+**gateway.stomp.listeners.ssl**
+
+ *Type*: `name`
+
+ A map from listener names to listener settings.
+
+
+
+
+Settings for TCP and UDP listeners.
+
+**gateway.exproto.listeners.tcp**
+
+ *Type*: `name`
+
+ A map from listener names to listener settings.
+
+
+**gateway.exproto.listeners.ssl**
+
+ *Type*: `name`
+
+ A map from listener names to listener settings.
+
+
+**gateway.exproto.listeners.udp**
+
+ *Type*: `name`
+
+ A map from listener names to listener settings.
+
+
+**gateway.exproto.listeners.dtls**
+
+ *Type*: `name`
+
+ A map from listener names to listener settings.
+
+
+
+### Gateway Listeners - SSL
+
+
+Settings for SSL listener.
+
+**gateway:ssl_listener.acceptors**
+
+ *Type*: `integer`
+
+ *Default*: `16`
+
+ Size of the acceptor pool.
+
+
+**gateway:ssl_listener.tcp_options**
+
+ *Type*: [broker:tcp_opts](#tcp_opts)
+
+ Setting the TCP socket options.
+
+
+**gateway:ssl_listener.proxy_protocol**
+
+ *Type*: `boolean`
+
+ *Default*: `false`
+
+ Enable the Proxy Protocol V1/2 if the EMQX cluster is deployed behind HAProxy or Nginx.
+See: https://www.haproxy.com/blog/haproxy/proxy-protocol/
+
+
+**gateway:ssl_listener.proxy_protocol_timeout**
+
+ *Type*: `emqx_gateway_schema:duration`
+
+ *Default*: `15s`
+
+ Timeout for proxy protocol.
+EMQX will close the TCP connection if proxy protocol packet is not received within the timeout.
+
+
+**gateway:ssl_listener.enable**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ Enable the listener.
+
+
+**gateway:ssl_listener.bind**
+
+ *Type*: `emqx_gateway_schema:ip_port`
+
+ The IP address and port that the listener will bind.
+
+
+**gateway:ssl_listener.max_connections**
+
+ *Type*: `pos_integer | infinity`
+
+ *Default*: `1024`
+
+ Maximum number of concurrent connections.
+
+
+**gateway:ssl_listener.max_conn_rate**
+
+ *Type*: `integer`
+
+ *Default*: `1000`
+
+ Maximum connections per second.
+
+
+**gateway:ssl_listener.enable_authn**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ Set true (default) to enable client authentication on this listener.
+When set to false clients will be allowed to connect without authentication.
+
+
+**gateway:ssl_listener.mountpoint**
+
+ *Type*: `string`
+
+ When publishing or subscribing, prefix all topics with a mountpoint string.
+The prefixed string will be removed from the topic name when the message is delivered to the subscriber.
+The mountpoint is a way that users can use to implement isolation of message routing between different listeners.
+For example if a client A subscribes to `t` with `listeners.tcp.\${clientid}: clientid${username}: username
+
+
+**gateway:ssl_listener.access_rules**
+
+ *Type*: `array`
+
+ *Default*: `[]`
+
+ The access control rules for this listener.
+See: https://github.com/emqtt/esockd#allowdeny
+
+
+**gateway:ssl_listener.ssl_options**
+
+ *Type*: [listener_ssl_opts](#ssl-tls-configuration-for-the-listener)
+
+ SSL Socket options.
+
+
+
+### Gateway Listeners - UDP
+
+
+Settings for UDP listener.
+
+**gateway:udp_listener.udp_options**
+
+ *Type*: `gateway:udp_opts`
+
+
+**gateway:udp_listener.enable**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ Enable the listener.
+
+
+**gateway:udp_listener.bind**
+
+ *Type*: `emqx_gateway_schema:ip_port`
+
+ The IP address and port that the listener will bind.
+
+
+**gateway:udp_listener.max_connections**
+
+ *Type*: `pos_integer | infinity`
+
+ *Default*: `1024`
+
+ Maximum number of concurrent connections.
+
+
+**gateway:udp_listener.max_conn_rate**
+
+ *Type*: `integer`
+
+ *Default*: `1000`
+
+ Maximum connections per second.
+
+
+**gateway:udp_listener.enable_authn**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ Set true (default) to enable client authentication on this listener.
+When set to false clients will be allowed to connect without authentication.
+
+
+**gateway:udp_listener.mountpoint**
+
+ *Type*: `string`
+
+ When publishing or subscribing, prefix all topics with a mountpoint string.
+The prefixed string will be removed from the topic name when the message is delivered to the subscriber.
+The mountpoint is a way that users can use to implement isolation of message routing between different listeners.
+For example if a client A subscribes to `t` with `listeners.tcp.\${clientid}: clientid${username}: username
+
+
+**gateway:udp_listener.access_rules**
+
+ *Type*: `array`
+
+ *Default*: `[]`
+
+ The access control rules for this listener.
+See: https://github.com/emqtt/esockd#allowdeny
+
+
+
+
+Settings for the UDP listeners.
+
+**gateway:udp_listeners.udp**
+
+ *Type*: `name`
+
+ A map from listener names to listener settings.
+
+
+**gateway:udp_listeners.dtls**
+
+ *Type*: `name`
+
+ A map from listener names to listener settings.
+
+
+
+
+Settings for UDP sockets.
+
+**gateway:udp_opts.active_n**
+
+ *Type*: `integer`
+
+ *Default*: `100`
+
+ Specify the {active, N} option for the socket.
+See: https://erlang.org/doc/man/inet.html#setopts-2
+
+
+**gateway:udp_opts.recbuf**
+
+ *Type*: `emqx_gateway_schema:bytesize`
+
+ Size of the kernel-space receive buffer for the socket.
+
+
+**gateway:udp_opts.sndbuf**
+
+ *Type*: `emqx_gateway_schema:bytesize`
+
+ Size of the kernel-space send buffer for the socket.
+
+
+**gateway:udp_opts.buffer**
+
+ *Type*: `emqx_gateway_schema:bytesize`
+
+ Size of the user-space buffer for the socket.
+
+
+**gateway:udp_opts.reuseaddr**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ Allow local reuse of port numbers.
+
+
+
+### Gateway Listeners - DTLS
+
+
+Settings for DTLS listener.
+
+**gateway:dtls_listener.acceptors**
+
+ *Type*: `integer`
+
+ *Default*: `16`
+
+ Size of the acceptor pool.
+
+
+**gateway:dtls_listener.udp_options**
+
+ *Type*: `gateway:udp_opts`
+
+
+**gateway:dtls_listener.enable**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ Enable the listener.
+
+
+**gateway:dtls_listener.bind**
+
+ *Type*: `emqx_gateway_schema:ip_port`
+
+ The IP address and port that the listener will bind.
+
+
+**gateway:dtls_listener.max_connections**
+
+ *Type*: `pos_integer | infinity`
+
+ *Default*: `1024`
+
+ Maximum number of concurrent connections.
+
+
+**gateway:dtls_listener.max_conn_rate**
+
+ *Type*: `integer`
+
+ *Default*: `1000`
+
+ Maximum connections per second.
+
+
+**gateway:dtls_listener.enable_authn**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ Set true (default) to enable client authentication on this listener.
+When set to false clients will be allowed to connect without authentication.
+
+
+**gateway:dtls_listener.mountpoint**
+
+ *Type*: `string`
+
+ When publishing or subscribing, prefix all topics with a mountpoint string.
+The prefixed string will be removed from the topic name when the message is delivered to the subscriber.
+The mountpoint is a way that users can use to implement isolation of message routing between different listeners.
+For example if a client A subscribes to `t` with `listeners.tcp.\${clientid}: clientid${username}: username
+
+
+**gateway:dtls_listener.access_rules**
+
+ *Type*: `array`
+
+ *Default*: `[]`
+
+ The access control rules for this listener.
+See: https://github.com/emqtt/esockd#allowdeny
+
+
+**gateway:dtls_listener.dtls_options**
+
+ *Type*: `gateway:dtls_opts`
+
+ DTLS socket options
+
+
+
+
+Settings for DTLS protocol.
+
+**gateway:dtls_opts.cacertfile**
+
+ *Type*: `string`
+
+ *Default*: `${EMQX_ETC_DIR}/certs/cacert.pem`
+
+ Trusted PEM format CA certificates bundle file.['tlsv1.2', 'tlsv1.1'] here.
+
+
+**gateway:dtls_opts.ciphers**
+
+ *Type*: `array`
+
+ *Default*: `[]`
+
+ This config holds TLS cipher suite names separated by comma,
+or as an array of strings. e.g.
+"TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256" or
+["TLS_AES_256_GCM_SHA384","TLS_AES_128_GCM_SHA256"].
+versions ('tlsv1.1', 'tlsv1.2' or 'tlsv1.3')
+incompatible cipher suites will be silently dropped.
+For instance, if only 'tlsv1.3' is given in the versions,
+configuring cipher suites for other versions will have no effect.
+versions."RSA-PSK-AES256-GCM-SHA384,RSA-PSK-AES256-CBC-SHA384,
+RSA-PSK-AES128-GCM-SHA256,RSA-PSK-AES128-CBC-SHA256,
+RSA-PSK-AES256-CBC-SHA,RSA-PSK-AES128-CBC-SHA,
+RSA-PSK-DES-CBC3-SHA,RSA-PSK-RC4-SHA"
+
+
+**gateway:dtls_opts.secure_renegotiate**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ SSL parameter renegotiation is a feature that allows a client and a server
+to renegotiate the parameters of the SSL connection on the fly.
+RFC 5746 defines a more secure way of doing this. By enabling secure renegotiation,
+you drop support for the insecure renegotiation, prone to MitM attacks.dhfile option is not supported by TLS 1.3.
+
+
+**gateway:dtls_opts.fail_if_no_peer_cert**
+
+ *Type*: `boolean`
+
+ *Default*: `false`
+
+ Used together with {verify, verify_peer} by an TLS/DTLS server.
+If set to true, the server fails if the client does not have a
+certificate to send, that is, sends an empty certificate.
+If set to false, it fails only if the client sends an invalid
+certificate (an empty certificate is considered valid).
+
+
+**gateway:dtls_opts.honor_cipher_order**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ An important security setting, it forces the cipher to be set based
+ on the server-specified order instead of the client-specified order,
+ hence enforcing the (usually more properly configured) security
+ ordering of the server administrator.
+
+
+**gateway:dtls_opts.client_renegotiation**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ In protocols that support client-initiated renegotiation,
+the cost of resources of such an operation is higher for the server than the client.
+This can act as a vector for denial of service attacks.
+The SSL application already takes measures to counter-act such attempts,
+but client-initiated renegotiation can be strictly disabled by setting this option to false.
+The default value is true. Note that disabling renegotiation can result in
+long-lived connections becoming unusable due to limits on
+the number of messages the underlying cipher suite can encipher.['tlsv1.2', 'tlsv1.1'] here.
+
+
+**ssl_client_opts.ciphers**
+
+ *Type*: `array`
+
+ *Default*: `[]`
+
+ This config holds TLS cipher suite names separated by comma,
+or as an array of strings. e.g.
+"TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256" or
+["TLS_AES_256_GCM_SHA384","TLS_AES_128_GCM_SHA256"].
+versions ('tlsv1.1', 'tlsv1.2' or 'tlsv1.3')
+incompatible cipher suites will be silently dropped.
+For instance, if only 'tlsv1.3' is given in the versions,
+configuring cipher suites for other versions will have no effect.
+versions."RSA-PSK-AES256-GCM-SHA384,RSA-PSK-AES256-CBC-SHA384,
+RSA-PSK-AES128-GCM-SHA256,RSA-PSK-AES128-CBC-SHA256,
+RSA-PSK-AES256-CBC-SHA,RSA-PSK-AES128-CBC-SHA,
+RSA-PSK-DES-CBC3-SHA,RSA-PSK-RC4-SHA"
+
+
+**ssl_client_opts.secure_renegotiate**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ SSL parameter renegotiation is a feature that allows a client and a server
+to renegotiate the parameters of the SSL connection on the fly.
+RFC 5746 defines a more secure way of doing this. By enabling secure renegotiation,
+you drop support for the insecure renegotiation, prone to MitM attacks.['tlsv1.2', 'tlsv1.1'] here.
+
+
+**listener_ssl_opts.ciphers**
+
+ *Type*: `array`
+
+ *Default*: `[]`
+
+ This config holds TLS cipher suite names separated by comma,
+or as an array of strings. e.g.
+"TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256" or
+["TLS_AES_256_GCM_SHA384","TLS_AES_128_GCM_SHA256"].
+versions ('tlsv1.1', 'tlsv1.2' or 'tlsv1.3')
+incompatible cipher suites will be silently dropped.
+For instance, if only 'tlsv1.3' is given in the versions,
+configuring cipher suites for other versions will have no effect.
+versions."RSA-PSK-AES256-GCM-SHA384,RSA-PSK-AES256-CBC-SHA384,
+RSA-PSK-AES128-GCM-SHA256,RSA-PSK-AES128-CBC-SHA256,
+RSA-PSK-AES256-CBC-SHA,RSA-PSK-AES128-CBC-SHA,
+RSA-PSK-DES-CBC3-SHA,RSA-PSK-RC4-SHA"
+
+
+**listener_ssl_opts.secure_renegotiate**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ SSL parameter renegotiation is a feature that allows a client and a server
+to renegotiate the parameters of the SSL connection on the fly.
+RFC 5746 defines a more secure way of doing this. By enabling secure renegotiation,
+you drop support for the insecure renegotiation, prone to MitM attacks.dhfile option is not supported by TLS 1.3.
+
+
+**listener_ssl_opts.fail_if_no_peer_cert**
+
+ *Type*: `boolean`
+
+ *Default*: `false`
+
+ Used together with {verify, verify_peer} by an TLS/DTLS server.
+If set to true, the server fails if the client does not have a
+certificate to send, that is, sends an empty certificate.
+If set to false, it fails only if the client sends an invalid
+certificate (an empty certificate is considered valid).
+
+
+**listener_ssl_opts.honor_cipher_order**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ An important security setting, it forces the cipher to be set based
+ on the server-specified order instead of the client-specified order,
+ hence enforcing the (usually more properly configured) security
+ ordering of the server administrator.
+
+
+**listener_ssl_opts.client_renegotiation**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ In protocols that support client-initiated renegotiation,
+the cost of resources of such an operation is higher for the server than the client.
+This can act as a vector for denial of service attacks.
+The SSL application already takes measures to counter-act such attempts,
+but client-initiated renegotiation can be strictly disabled by setting this option to false.
+The default value is true. Note that disabling renegotiation can result in
+long-lived connections becoming unusable due to limits on
+the number of messages the underlying cipher suite can encipher.ws://{ip}:{port}/mqtt
+
+
+**ws_opts.mqtt_piggyback**
+
+ *Type*: `enum`
+
+ *Default*: `multiple`
+
+ *Optional*: `single | multiple`
+
+ Whether a WebSocket message is allowed to contain multiple MQTT packets.
+
+
+**ws_opts.compress**
+
+ *Type*: `boolean`
+
+ *Default*: `false`
+
+ If true, compress WebSocket messages using zlib.deflate_opts belong to the compression-related parameter configuration.
+
+
+**ws_opts.idle_timeout**
+
+ *Type*: `duration`
+
+ *Default*: `7200s`
+
+ Close transport-layer connections from the clients that have not sent MQTT CONNECT message within this interval.
+
+
+**ws_opts.max_frame_size**
+
+ *Type*: `infinity | integer`
+
+ *Default*: `infinity`
+
+ The maximum length of a single MQTT packet.
+
+
+**ws_opts.fail_if_no_subprotocol**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ If true, the server will return an error when
+ the client does not carry the Sec-WebSocket-Protocol field.
+ true, origin HTTP header will be
+ validated against the list of allowed origins configured in check_origins
+ parameter.
+
+
+**ws_opts.allow_origin_absence**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ If false and check_origin_enable is
+ true, the server will reject requests that don't have origin
+ HTTP header.
+
+
+**ws_opts.check_origins**
+
+ *Type*: `comma_separated_binary`
+
+ *Default*: `http://localhost:18083, http://127.0.0.1:18083`
+
+ List of allowed origins.check_origin_enable.
+
+
+**ws_opts.proxy_address_header**
+
+ *Type*: `string`
+
+ *Default*: `x-forwarded-for`
+
+ HTTP header used to pass information about the client IP address.
+Relevant when the EMQX cluster is deployed behind a load-balancer.
+
+
+**ws_opts.proxy_port_header**
+
+ *Type*: `string`
+
+ *Default*: `x-forwarded-port`
+
+ HTTP header used to pass information about the client port. Relevant when the EMQX cluster is deployed behind a load-balancer.
+
+
+**ws_opts.deflate_opts**
+
+ *Type*: [broker:deflate_opts](#deflate_opts)
+
+
+
+### listener_wss_opts
+
+
+Socket options for WebSocket/SSL connections.
+
+**listeners.wss.$name.ssl_options.cacertfile**
+
+ *Type*: `string`
+
+ *Default*: `${EMQX_ETC_DIR}/certs/cacert.pem`
+
+ Trusted PEM format CA certificates bundle file.['tlsv1.2', 'tlsv1.1'] here.
+
+
+**listeners.wss.$name.ssl_options.ciphers**
+
+ *Type*: `array`
+
+ *Default*: `[]`
+
+ This config holds TLS cipher suite names separated by comma,
+or as an array of strings. e.g.
+"TLS_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256" or
+["TLS_AES_256_GCM_SHA384","TLS_AES_128_GCM_SHA256"].
+versions ('tlsv1.1', 'tlsv1.2' or 'tlsv1.3')
+incompatible cipher suites will be silently dropped.
+For instance, if only 'tlsv1.3' is given in the versions,
+configuring cipher suites for other versions will have no effect.
+versions."RSA-PSK-AES256-GCM-SHA384,RSA-PSK-AES256-CBC-SHA384,
+RSA-PSK-AES128-GCM-SHA256,RSA-PSK-AES128-CBC-SHA256,
+RSA-PSK-AES256-CBC-SHA,RSA-PSK-AES128-CBC-SHA,
+RSA-PSK-DES-CBC3-SHA,RSA-PSK-RC4-SHA"
+
+
+**listeners.wss.$name.ssl_options.secure_renegotiate**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ SSL parameter renegotiation is a feature that allows a client and a server
+to renegotiate the parameters of the SSL connection on the fly.
+RFC 5746 defines a more secure way of doing this. By enabling secure renegotiation,
+you drop support for the insecure renegotiation, prone to MitM attacks.dhfile option is not supported by TLS 1.3.
+
+
+**listeners.wss.$name.ssl_options.fail_if_no_peer_cert**
+
+ *Type*: `boolean`
+
+ *Default*: `false`
+
+ Used together with {verify, verify_peer} by an TLS/DTLS server.
+If set to true, the server fails if the client does not have a
+certificate to send, that is, sends an empty certificate.
+If set to false, it fails only if the client sends an invalid
+certificate (an empty certificate is considered valid).
+
+
+**listeners.wss.$name.ssl_options.honor_cipher_order**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ An important security setting, it forces the cipher to be set based
+ on the server-specified order instead of the client-specified order,
+ hence enforcing the (usually more properly configured) security
+ ordering of the server administrator.
+
+
+**listeners.wss.$name.ssl_options.client_renegotiation**
+
+ *Type*: `boolean`
+
+ *Default*: `true`
+
+ In protocols that support client-initiated renegotiation,
+the cost of resources of such an operation is higher for the server than the client.
+This can act as a vector for denial of service attacks.
+The SSL application already takes measures to counter-act such attempts,
+but client-initiated renegotiation can be strictly disabled by setting this option to false.
+The default value is true. Note that disabling renegotiation can result in
+long-lived connections becoming unusable due to limits on
+the number of messages the underlying cipher suite can encipher.