# Plain MQTT on 1883 (demo only: a real deployment must use TLS).
listener 1883
# Boards have no credentials before enrollment; Dynamic Security decides what anonymous clients may do.
allow_anonymous true

# Dynamic Security plugin: users, roles and ACLs live in a JSON file and are changed over MQTT.
plugin /usr/lib/mosquitto_dynamic_security.so
plugin_opt_config_file /mosquitto/data/dynamic-security.json

# Verbose logging (connections, subscribes, dynsec commands) so broker behaviour is visible.
log_dest stdout
log_type error
log_type warning
log_type notice
log_type information
log_type subscribe
log_type unsubscribe
log_timestamp true