I was talking to a friend, extolling the features and future of @OwnTracks, a project I talked about not so long ago. Said friend asked about where to place the MQTT broker, and I said “for example, on your home-server”. He doesn’t have one. Come to think of it, not many of my friends do, so here comes a small post on setting up an MQTT broker, specifically Mosquitto, on a Raspberry Pi, which most people can easily set up.
The hardest bit is installing an OS, say, Raspbian Wheezy, onto an SD card, but there are many tutorials on how to do that. (Here’s an example using Mac OS X.) A basic install will suffice, and after logging in with Raspbian’s default username and password, we’ll get started from there.
Roger Light, Mosquitto’s creator has thankfully (!) set up a Mosquitto Debian repository we can use to obtain the latest and greatest version, so we’ll do just that. We first perform the required steps to add and activate the repository. The last step in particular can take a few moments.
Now we can go ahead and install Mosquitto proper. There are three packages:
mosquittois the MQTT broker (i.e. server)
mosquitto-clientsare the command-line clients, which I recommend you install
python-mosquittoare the Python bindings, which I also think you should install
all three packages together require about 665Kb of space, which we can easily afford even on the tiny Pi.
Regrettably, as with most Debian packages, the broker is immediately started; stop it.
That concludes the installation of the Mosquitto MQTT broker, and we’ll now proceed to its configuration. This section is geared towards a configuration of Mosquitto which will work well with @OwnTracks. In particular we want the following features enabled by default:
- Connections to the broker must be TLS protected. This requires a TLS certificate and key which will be configured automatically.
- ACLs will restrict who may access what.
Over at the OwnTracks repository, I’m working on some utilities which are going to automate this. It’s a work-in-progress (of course), but this is what
sudo ./mosquitto-setup.sh looks like at the moment:
A CA is created together with a server key-pair with a whole bunch of
Will it work? Let’s start the broker manually to see what it says:
The Mosquitto clients need to have access to a copy of the CA certificate (
ca.crt) and you can transport that insecurely to your clients (it’s a public certificate).
Newer Mosquitto 1.2 clients use TLSv1.2 per default, and to force them to use TLSv1 (which we need on the OwnTracks broker because of the apps – it’s a long story) you add the appropriate option:
That’s it for the moment.
As for ACLs, we’ll be using auth-plug because it’s so versatile. I’ll update this post as soon as we’re ready to automate setting that up as well.