Would it be possible to support a configuration where no non-TLS listener is created?

[DenvE]

In BrokerConfig, the default configuration always enables the following bind addresses:

bind_addresses: vec![
"0.0.0.0:1883".parse().unwrap(),
"[::]:1883".parse().unwrap(),
],

These can only be replaced with different bind addresses, but it doesn't seem possible to disable the non-TLS listener entirely. Is that correct?

Would it be possible to support a configuration where no non-TLS listener is created?

Ideally, the broker could be configured with:

only a non-TLS configuration,
only a TLS configuration, or
both a non-TLS and a TLS configuration.

This would allow deployments that require TLS-only communication without opening a listener on port 1883.

[fabracht]

You're right, TLS-only is not currently possible. I'll open an issue to add that feature. I'm a bit busy today, so I'll do it by the end of the day. I'll post the issue here.

Thanks for the suggestion.

[fabracht]

Actually, better to create it now. Issue created: #99

[DenvE]

Thanks, just some background.

For CRA, we can only allow secure connections.

In the past, I also developed my own MQTT broker/bridge, and I'm now porting that application to mqtt-lib. I intentionally hide most of the low-level broker configuration from the end user and expose only a YAML configuration file, since those settings are specific to how the system is deployed.

For example:

tcp_config:
bind_addresses:
- "127.0.0.1:1883"

tls_config:
cert_file: "./rootca/server.crt"
key_file: "./rootca/server.key"
ca_file: "./rootca/rootCA.crt"
require_client_cert: false
bind_addresses:
- "0.0.0.0:8883"

This allows deployments to configure either:

TCP only,
TLS only, or
both TCP and TLS,

without exposing unnecessary implementation details to the user.