2026-07-08 08:14:42 +00:00
1 changed files with 20 additions and 0 deletions
@@ -12,11 +12,31 @@ data:
    log_type warning
    log_type notice

+    # --- Resource / DoS guards ------------------------------------------
+    # The broker is now load-bearing and reachable by ~30 untrusted IoT
+    # devices (the Shelly fleet) plus the edge host, on a single 256Mi
+    # replica. Bound what a misbehaving or compromised client can do:
+    #   message_size_limit  caps a single publish (MQTT allows up to 256 MB —
+    #                       one such message would OOM the broker). Every
+    #                       legit payload here (HA discovery, Shelly/open3e/
+    #                       evcc telemetry) is well under 10 KB.
+    #   persistent_client_expiration reaps abandoned persistent sessions so
+    #                       their queued state can't accumulate (the edge
+    #                       bridges reconnect within seconds, so they never
+    #                       hit this).
+    #   max_connections (per listener) bounds a connection flood (~40 clients
+    #                       today; 200 is generous headroom, not unlimited).
+    message_size_limit 1048576
+    persistent_client_expiration 1d
+
    # Omit the bind address so mosquitto listens on all interfaces
    # (v4 + v6 wildcard). With a bind address of 0.0.0.0 the broker
    # accepts v4 only and refuses TCP on the v6 LB VIP fd99::81.
    listener 1883
+    max_connections 200
+
    listener 8883
+    max_connections 200
    certfile /mosquitto/tls/tls.crt
    keyfile /mosquitto/tls/tls.key