Configuration

The MQTT Broker reads its settings from the host’s configuration file — slotd.conf on a hosted slot, stationd.conf on a station — when the extension is loaded at start-up. A key that is absent takes its default. A key whose value does not parse as its type also takes its default, and the host logs a warning naming it. A Boolean key is 1, true, yes or on, or 0, false, no or off, compared without regard to case — any other value, including a typo, is warned about and takes the default.

This page names the key behind each behaviour. What the behaviours are — how a device authenticates, which topics it may touch, what happens as it crosses a limit — is in the Overview.

Listener

The broker listens on a Unix socket when one is named, and on TCP otherwise. mqttbroker.listenSocket takes precedence: when it is set to a non-empty path the TCP keys are not consulted at all.

Key	Type	Default	Effect
`mqttbroker.listenSocket`	String	`""`	Unix-socket path to listen on. Empty means listen on TCP instead.
`mqttbroker.listenHost`	String	`0.0.0.0`	TCP bind address. Consulted only when `listenSocket` is empty.
`mqttbroker.listenPort`	Integer	`1883`	TCP bind port. Consulted only when `listenSocket` is empty.

Per-Task node caps

Each cap limits how many nodes of one operation a single Task may contain. A negative value means unlimited. The cap travels to the editor in the operation’s schema, so the editor refuses to add the node that would exceed it.

Key	Type	Default	Documented on
`mqttbroker.maxTriggerPerTask`	Integer	`-1`	MQTT Trigger
`mqttbroker.maxActionPerTask`	Integer	`-1`	MQTT Action

Broker capabilities

What the broker advertises and accepts. These are the settings behind Broker constraints.

Key	Type	Default	Effect
`mqttbroker.maxQos`	Integer	`2`	Highest QoS level the broker grants. A subscription or publish above it is downgraded to this level.
`mqttbroker.retainAvailable`	Boolean	`true`	When `false`, the broker accepts the `retain` flag but stores nothing; subscribers receive live messages only.
`mqttbroker.willsAvailable`	Boolean	`true`	When `false`, the broker refuses a `CONNECT` that carries a will message.
`mqttbroker.requireSlotPrefix`	Boolean	`false`	When `true`, every topic must begin with `<slot>/`. This is a namespace convention: isolation between slots does not depend on it.

Device limits

The settings behind Per-device limits and the lifecycle of a misbehaving device.

Key	Type	Default	Effect
`mqttbroker.maxDevices`	Integer	`-1`	How many devices may be registered. Negative means unlimited. A registration beyond the cap is refused.
`mqttbroker.publishLimit`	Integer	`0`	`PUBLISH` packets one device may send within a wall-clock minute. `0` disables the limit.
`mqttbroker.connectLimit`	Integer	`0`	`CONNECT` attempts one device may make within a wall-clock minute, successful or not. `0` disables the limit.
`mqttbroker.breachedLimit`	Integer	`0`	How many breached minutes within a rolling hour disable the device and force-disconnect it. `0` means a breach never escalates to a block.

A breached minute counts once, however many packets exceed the limit inside it: the first excess emits a throttle event, the rest are denied quietly. That is why breachedLimit counts minutes rather than packets — it measures how long a device has been misbehaving, not how hard.

Front door

Bounds applied before a connection is trusted, so an unauthenticated peer cannot hold resources or burn CPU.

Key	Type	Default	Effect
`mqttbroker.halfOpenDeadlineMs`	Integer	`10000`	A connection that has not produced a `CONNECT` verdict within this many milliseconds is closed.
`mqttbroker.halfOpenMaxBytes`	Integer	`2048`	A connection that buffers this many bytes before a `CONNECT` verdict is closed.
`mqttbroker.preVerifyConnectLimit`	Integer	`0`	`CONNECT` attempts accepted per source IP per minute, counted before the credential check. `0` disables it.
`mqttbroker.maxPendingVerifies`	Integer	`64`	How many `CONNECT`s may be waiting on the password verifier at once. One past this is answered Server unavailable (v5 `0x89`, v3.1.1 `0x03`) immediately and closed, with nothing checked: a queue deeper than a client’s patience yields only timeouts and the retries that deepen it. `0` removes the bound.
`mqttbroker.secretHashOpsLimit`	Integer	`3`	argon2 operations for hashing a secret the box generates (see Credentials).
`mqttbroker.secretHashMemLimit`	Integer	`8192`	argon2 memory, in bytes, for the same.

preVerifyConnectLimit is keyed on the source IP rather than the client id, because the client id is chosen by whoever is connecting: a flood that varies its client id would otherwise get a fresh budget each time.

A verify for a connection that closes while queued is dropped before it costs anything, so a client that gives up does not keep occupying the verifier after it has gone. The two limits together decide what a reconnect storm — every device of a box returning at once after a restart — costs: a generated secret verifies in about a millisecond, and maxPendingVerifies is how long a device is made to wait before it is told to come back later instead. A device provisioned with a certificate never enters this queue: its proof is the TLS handshake at the edge, and the broker admits it with one comparison.

Sessions and delivery

Key	Type	Default	Effect
`mqttbroker.maxPacketSize`	Integer	`262144`	Largest MQTT packet accepted, in bytes, including headers and properties. A packet whose declared size exceeds it is rejected without being buffered.
`mqttbroker.maxQueuedBytes`	Integer	`1048576`	Most a connection may hold in outbound bytes its peer has not yet read. A device that stops reading is closed once its queue reaches this; a device reading at its own pace never does. `0` removes the bound.
`mqttbroker.maxInflight`	Integer	`64`	Per-connection outbound QoS 1/2 window, and the inbound QoS 2 receive window.
`mqttbroker.qosRetransmitMs`	Integer	`3000`	How long to wait for an acknowledgement before redelivering a QoS 1/2 message, in milliseconds.
`mqttbroker.qosMaxRetries`	Integer	`5`	How many unacknowledged retransmits are attempted before the connection is closed.
`mqttbroker.retainedMaxEntries`	Integer	`1024`	Retained messages stored per slot. The oldest is evicted when the store is full.
`mqttbroker.maxSubscriptionsPerClient`	Integer	`0`	Distinct active topic filters one client may hold. `0` means unlimited.
`mqttbroker.maxClientsPerRunner`	Integer	`0`	Concurrently established or in-progress clients one runner may hold. `0` means unlimited.

Statistics

Key	Type	Default	Effect
`mqttbroker.statsPeriodMs`	Integer	`60000`	How often each runner reports what its broker carried, in milliseconds. `0` stops the reports.

Bandwidth shaping

Shaping is per slot, with a two-rate token bucket: a floor bucket that refills at a guaranteed rate, and a ceiling bucket that bounds the absolute draw. A slot over its floor borrows from a per-runner surplus pool, up to its ceiling. A slot over budget has its reads paused until the debt is repaid.

All rates are bytes per second and all burst capacities are bytes.

Key	Type	Default	Effect
`mqttbroker.bwEnabled`	Integer	`0`	Non-zero enables shaping.
`mqttbroker.bwPubRate`	Integer	`0`	Guaranteed floor rate per slot. A slot with a floor of `0` is never over budget — shaping is off for it.
`mqttbroker.bwPubCeil`	Integer	`0`	Maximum sustained rate per slot. Must be at least `bwPubRate`.
`mqttbroker.bwBurst`	Integer	`0`	Floor bucket capacity — the guaranteed burst.
`mqttbroker.bwCeilBurst`	Integer	`0`	Ceiling bucket capacity — the largest borrowed burst. Must be at least `bwBurst`.
`mqttbroker.bwPoolRate`	Integer	`0`	Refill rate of the per-runner surplus pool.
`mqttbroker.bwPoolBurst`	Integer	`0`	Capacity of the per-runner surplus pool.
`mqttbroker.bwTickMs`	Integer	`25`	How often paused slots are refilled and reconsidered, in milliseconds.

Values for your plan

The numbers a hosted slot actually runs with are set per plan. This page gives the defaults the extension applies when a key is absent; the values in force for your plan are listed in the Acceptable Use Policy.