## Broad-Announce M4 EMQX overrides.
##
## Most defaults are fine; this file is the seam where project-
## specific knobs (auth backend, ACL file location, listener
## rate limits) are set in HOCON. See base.hocon for the full
## schema; this file overrides it via env-var precedence.

## ── Authentication: built-in-db from a CSV file ──────────────
## The file is read on first boot; users added later go through
## the EMQX HTTP API. M11 will swap this for a Postgres-backed
## authentication chain so users can be added/removed from
## `sources` in the same migration as HMAC secret rotation.
authentication = [
  {
    backend = "built_in_database"
    mechanism = "password_based"
    user_id_type = "username"
    password_hash_algorithm { name = "plain", salt_position = "disable" }
  }
]

## ── Authorization: file-based ACL, default-deny on no-match ──
authorization {
  no_match = deny
  deny_action = disconnect
  cache {
    enable = true
    max_size = 32
    ttl = 1m
  }
  sources = [
    {
      type = file
      enable = true
      path = "/opt/emqx/etc/acl.conf"
    }
  ]
}

## ── Default listener: 1883, anonymous=false, max-inflight ────
listeners.tcp.default {
  bind = "0.0.0.0:1883"
  max_connections = 1024
  proxy_protocol = false
}

## ── Dashboard ─────────────────────────────────────────────────
dashboard {
  listeners.http {
    bind = 18083
  }
  default_password_login = true
}