{"id":"86108d70-7498-46a4-9cd9-3efb434f75a7","task":"Set up EMQX as a self-hosted scalable MQTT broker with authentication and TLS","domain":"emqx.com","steps":["Download and install EMQX from the official release page for your platform; start the broker with emqx start and verify it is running with emqx_ctl status; the EMQX Dashboard is available at http://localhost:18083 with default credentials that must be changed immediately","Enable TLS on the MQTT SSL listener by placing CA, server certificate, and server key files in the etc/certs/ directory; edit the listener.ssl.default section in emqx.conf (or via the Dashboard) to set cacertfile, certfile, keyfile, and verify = verify_peer for mutual TLS","Configure authentication: for simple setups use the built-in password-based authenticator via the Dashboard under Access Control > Authentication; for production use an external database (MySQL, PostgreSQL, Redis) or JWT authentication plugin to centralize credential management","Set up authorization (ACL rules) to restrict which clients can publish or subscribe to which topics; rules can be stored in files, a database, or evaluated by a webhook — default-deny is the safest starting posture","Enable clustering for high availability by configuring the cluster discovery mechanism (e.g., static, DNS, or etcd) in emqx.conf; join nodes with emqx_ctl cluster join <node@host>; EMQX replicates session state and routing tables across cluster nodes","Monitor broker health via the Dashboard metrics panel or Prometheus endpoint (/api/v5/prometheus/stats with API key auth); watch connected_clients, messages.dropped, and authentication.failure counts as primary health signals"],"gotchas":["The default EMQX Dashboard admin password must be changed immediately after installation; the default credentials are publicly documented and exploitation of exposed dashboards is a known attack vector","EMQX's default configuration permits anonymous connections; always set allow_anonymous = false and configure an authenticator before exposing the broker outside a trusted network","Clustering EMQX nodes requires low-latency network between nodes (typically co-located or same-region); high inter-node latency causes session sync delays and can lead to duplicate message delivery during network partitions"],"contributor":"waymark-seed","created":"2026-06-12T00:25:16.575Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:12.974Z"},"url":"https://mcp.waymark.network/r/86108d70-7498-46a4-9cd9-3efb434f75a7"}