Setup Mosquitto MQTT Broker: Instalasi & Konfigurasi Lengkap

# === Update repository ===
sudo apt update

# === Instal Mosquitto dan CLI tools ===
sudo apt install -y mosquitto mosquitto-clients

# === Aktifkan service agar berjalan otomatis saat boot ===
sudo systemctl enable mosquitto

# === Jalankan layanan Mosquitto ===
sudo systemctl start mosquitto

# === Cek status layanan ===
sudo systemctl status mosquitto

# === Verifikasi versi ===
mosquitto -v

# === Tambah repository resmi Eclipse Mosquitto ===
sudo apt install -y software-properties-common wget

# Download dan tambahkan GPG key
sudo wget -qO- https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key add -
sudo apt-add-repository ppa:mosquitto-dev/mosquitto-ppa

# Atau gunakan cara manual:
sudo wget https://repo.mosquitto.org/debian/mosquitto-repo.gpg.key
sudo apt-key add mosquitto-repo.gpg.key

# Tambah repository (Ubuntu 22.04 Jammy, sesuaikan untuk versi lain)
echo "deb http://ppa.launchpad.net/mosquitto-dev/mosquitto-ppa/ubuntu jammy main" | \
  sudo tee /etc/apt/sources.list.d/mosquitto.list

# === Update dan instal ===
sudo apt update
sudo apt install -y mosquitto mosquitto-clients

# === Verifikasi versi terbaru ===
mosquitto -h 2>&1 | head -3

# Raspberry Pi menggunakan repository Debian yang sama
sudo apt update
sudo apt install -y mosquitto mosquitto-clients

# Cek arsitektur ARM
uname -m
# Output: aarch64 (Pi 4/5 64-bit) atau armv7l (Pi 3/4 32-bit)

# Cek RAM tersedia (Mosquitto sangat hemat memori)
free -h
# Mosquitto hanya butuh ~2MB RAM

# Jalankan
sudo systemctl enable mosquitto
sudo systemctl start mosquitto

# Cek versi Mosquitto
mosquitto -h

# Jalankan broker dengan verbose logging (foreground)
mosquitto -v

# Output:
# mosquitto version 2.0.18 starting
# Opening ipv4 listen socket on port 1883.
# Opening ipv6 listen socket on port 1883.
# mosquitto version 2.0.18 running

# Atau jalankan dengan config file kustom
mosquitto -c "C:\mosquitto\mosquitto.conf" -v

# Cek status service Mosquitto
Get-Service mosquitto

# Jalankan service
Start-Service mosquitto

# Hentikan service
Stop-Service mosquitto

# Set agar auto-start saat boot
Set-Service -Name "mosquitto" -StartupType Automatic

# Install service manual jika belum terdaftar
sc.exe create mosquitto binPath= "C:\Program Files\mosquitto\mosquitto.exe -c C:\mosquitto\mosquitto.conf start= auto

# =============================================
# Mosquitto MQTT Broker - Konfigurasi Dasar
# File: /etc/mosquitto/mosquitto.conf
# =============================================

# === Listener ===
# Port default MQTT
listener 1883

# Izinkan anonymous (HANYA untuk testing!)
allow_anonymous true

# === Persistence ===
# Simpan data retained message dan session ke disk
persistence true
persistence_location /var/lib/mosquitto/

# === Logging ===
log_dest syslog
log_dest stdout
log_type error
log_type warning
log_type notice
log_type information
connection_messages true
log_timestamp true
log_timestamp_format %Y-%m-%dT%H:%M:%S

# === Connection Limits ===
# -1 = unlimited, 0 = disabled
max_connections -1

# Keepalive timeout (detik)
# Client yang tidak mengirim PINGREQ dalam waktu ini dianggap terputus
# Default 60 detik

# =============================================
# Mosquitto Production Configuration
# =============================================

# === Listener TCP ===
listener 1883 0.0.0.0
protocol mqtt

# === Listener WebSocket ===
listener 9001 0.0.0.0
protocol websockets

# === Autentikasi (WAJIB untuk production!) ===
allow_anonymous false
password_file /etc/mosquitto/passwd

# === ACL (Access Control List) ===
acl_file /etc/mosquitto/aclfile

# === Persistence ===
persistence true
persistence_location /var/lib/mosquitto/
autosave_interval 1800
autosave_on_changes false

# === Performance ===
max_connections 1000
max_inflight_messages 20
max_queued_messages 1000
message_size_limit 1048576

# === Logging ===
log_dest file /var/log/mosquitto/mosquitto.log
log_type error
log_type warning
log_type notice
log_type information
connection_messages true
log_timestamp true

# === Buat password file baru dengan user pertama ===
# Flag -c = create (membuat file baru, MENIMPA yang lama!)
mosquitto_passwd -c /etc/mosquitto/passwd admin

# Anda akan diminta memasukkan password dua kali
# Password: ********
# Reenter password: ********

# === Tambah user baru (tanpa -c agar tidak menimpa) ===
mosquitto_passwd -b /etc/mosquitto/passwd sensor_ruang01 password123
mosquitto_passwd -b /etc/mosquitto/passwd dashboard_viewer secret456

# === Hapus user ===
mosquitto_passwd -D /etc/mosquitto/passwd sensor_ruang01

# === Lihat isi file (ter-hash) ===
cat /etc/mosquitto/passwd
# Output:
# admin:$6$randomhash...
# sensor_ruang01:$6$randomhash...
# dashboard_viewer:$6$randomhash...

# =============================================
# Mosquitto ACL Configuration
# =============================================

# === Default: tolak semua akses ===
# (Tidak perlu ditulis, karena deny all adalah default)

# === Admin: akses penuh ke semua topik ===
user admin
topic readwrite #

# === Sensor: hanya boleh publish ke topik sendiri ===
user sensor_ruang01
topic write rumah/ruang01/#
topic read rumah/ruang01/cmd

user sensor_ruang02
topic write rumah/ruang02/#
topic read rumah/ruang02/cmd

# === Dashboard: hanya boleh subscribe (read-only) ===
user dashboard_viewer
topic read rumah/#

# === Anonymous (jika diizinkan) ===
# topic read public/#

# Aktifkan autentikasi
allow_anonymous false
password_file /etc/mosquitto/passwd

# Aktifkan ACL
acl_file /etc/mosquitto/aclfile

# Subscribe dengan autentikasi
mosquitto_sub -h localhost -t "rumah/#" -u admin -P admin_password -v

# Publish dengan autentikasi
mosquitto_pub -h localhost -t "rumah/ruang01/suhu" \
  -u sensor_ruang01 -P password123 \
  -m '{"suhu": 27.5, "kelembaban": 65}'

# Test tanpa autentikasi (seharusnya gagal di v2.x)
mosquitto_sub -h localhost -t "test"
# Error: Connection Refused: not authorised.

# Test user yang salah (seharusnya ditolak ACL)
mosquitto_pub -h localhost -t "rumah/ruang01/suhu" \
  -u dashboard_viewer -P secret456 \
  -m "test"
# Error: Connection Refused: not authorised.
# (dashboard_viewer hanya boleh READ, bukan WRITE)

# =============================================
# Buka DUA terminal secara bersamaan
# =============================================

# === TERMINAL 1: Subscriber ===
# Subscribe ke semua topik di bawah "rumah/"
mosquitto_sub -h localhost -t "rumah/#" -v

# Flag penjelasan:
# -h  = host (localhost atau IP broker)
# -t  = topik (mendukung wildcard + dan #)
# -v  = verbose (tampilkan nama topik di depan pesan)
# -u  = username
# -P  = password
# -C  = jumlah pesan lalu keluar (misal -C 5 untuk 5 pesan)
# -q  = QoS level (0, 1, atau 2)
# -k  = keepalive dalam detik


# === TERMINAL 2: Publisher ===
# Kirim pesan ke topik spesifik
mosquitto_pub -h localhost -t "rumah/ruang01/suhu" \
  -m '{"suhu": 27.5, "kelembaban": 65, "status": "ok"}' \
  -q 1 -r

# Flag penjelasan:
# -h  = host
# -t  = topik
# -m  = message/payload
# -q  = QoS level
# -r  = retained message (disimpan broker sampai ditimpa)
# -d  = debug mode (tampilkan informasi koneksi)
# -f  = baca pesan dari file

# === Simpan payload ke file ===
echo '{"suhu": 28.3, "kelembaban": 60, "gas": 350}' > /tmp/sensor_data.json

# === Publish dari file ===
mosquitto_pub -h localhost -t "rumah/ruang01/suhu" -f /tmp/sensor_data.json

# === Kirim pesan berulang setiap 5 detik (pakai shell loop) ===
while true; do
  SUHU=$(echo "scale=1; 24 + ($RANDOM % 60) / 10" | bc)
  mosquitto_pub -h localhost -t "rumah/ruang01/suhu" \
    -m "{\"suhu\": $SUHU, \"ts\": $(date +%s)}" -q 1
  echo "Dikirim: suhu=$SUHU"
  sleep 5
done

# === Subscribe dengan filter spesifik ===
# Terima hanya data suhu dari ruang01
mosquitto_sub -h localhost -t "rumah/ruang01/suhu" -v -q 1

# Terima semua data dari lantai 1
mosquitto_sub -h localhost -t "rumah/lantai1/#" -v

# =============================================
# Mosquitto Bridge Configuration
# File: /etc/mosquitto/mosquitto.conf (Edge Broker)
# =============================================

# Listener lokal
listener 1883 localhost
allow_anonymous true

# === Bridge ke Cloud Broker ===
connection cloud-bridge
address mqtt.cloud.com:8883

# Topik yang di-bridge
# Format: topic TOPIC_DIRECTION QoS LOCAL_PREFIX REMOTE_PREFIX
topic rumah/sensor/# out 1 sensor/ cloud/rumah/
topic rumah/cmd/# in 1 cmd/ cloud/rumah/cmd/

# "out" = dari lokal → remote (publish)
# "in"  = dari remote → lokal (subscribe)
# "both" = dua arah

# Autentikasi bridge
remote_username bridge_user
remote_password bridge_secret_pass

# TLS untuk bridge
bridge_cafile /etc/mosquitto/certs/ca.crt
bridge_certfile /etc/mosquitto/certs/client.crt
bridge_keyfile /etc/mosquitto/certs/client.key
bridge_tls_version tlsv1.2

# Pengaturan bridge
bridge_protocol_version mqttv311
cleansession true
keepalive_interval 60
restart_timeout 30 300
try_private true
notifications true
notification_topic $SYS/broker/bridge/edge01/state

# Quality of Service
max_inflight_messages 20

# === Restart Mosquitto setelah konfigurasi bridge ===
sudo systemctl restart mosquitto

# === Cek log untuk status bridge ===
sudo tail -f /var/log/mosquitto/mosquitto.log | grep bridge
# Output:
# Bridge cloud-bridge connecting to mqtt.cloud.com:8883
# Bridge cloud-bridge connected

# === Test: kirim data dari edge broker ===
mosquitto_pub -h localhost -t "rumah/sensor/suhu" \
  -m '{"suhu": 27.5}' -q 1

# === Verifikasi di cloud broker (server lain) ===
mosquitto_sub -h mqtt.cloud.com -t "cloud/rumah/#" \
  -u viewer -P viewer_pass -v --cafile ca.crt
# Output: cloud/rumah/sensor/suhu {"suhu": 27.5}

# =============================================
# TLS/SSL Configuration
# =============================================

# Listener TLS pada port 8883
listener 8883 0.0.0.0
protocol mqtt

# Sertifikat CA, Server, dan Key
cafile /etc/mosquitto/certs/ca.crt
certfile /etc/mosquitto/certs/server.crt
keyfile /etc/mosquitto/certs/server.key

# Require TLS version 1.2 minimum
tls_version tlsv1.2

# Require client certificate? (mutual TLS)
require_certificate false
# Set true jika ingin verifikasi identitas client via sertifikat

# Listener non-TLS hanya untuk localhost
listener 1883 localhost
protocol mqtt

# Listener WebSocket TLS
listener 9002 0.0.0.0
protocol websockets
cafile /etc/mosquitto/certs/ca.crt
certfile /etc/mosquitto/certs/server.crt
keyfile /etc/mosquitto/certs/server.key

# === Setup direktori ===
sudo mkdir -p /etc/mosquitto/certs
cd /etc/mosquitto/certs

# === 1. Buat Certificate Authority (CA) ===
openssl genrsa -out ca.key 4096
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt \
  -subj "/CN=MQTT-CA/O=BeebaneLabs/C=ID"

# === 2. Buat Server Certificate ===
openssl genrsa -out server.key 2048
openssl req -new -key server.key -out server.csr \
  -subj "/CN=mqtt.example.com/O=BeebaneLabs/C=ID"
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \
  -CAcreateserial -out server.crt -days 365 \
  -extfile <(echo "subjectAltName=DNS:mqtt.example.com,IP:192.168.1.100")

# === 3. Buat Client Certificate (opsional, untuk mutual TLS) ===
openssl genrsa -out client.key 2048
openssl req -new -key client.key -out client.csr \
  -subj "/CN=esp32-sensor-01/O=BeebaneLabs/C=ID"
openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key \
  -CAcreateserial -out client.crt -days 365

# === 4. Set permissions ===
sudo chown -R mosquitto:mosquitto /etc/mosquitto/certs
sudo chmod 600 /etc/mosquitto/certs/*.key
sudo chmod 644 /etc/mosquitto/certs/*.crt

# === 5. Restart Mosquitto ===
sudo systemctl restart mosquitto

# === 6. Verifikasi TLS ===
openssl s_client -connect localhost:8883 -CAfile ca.crt

# === Setup firewall untuk Mosquitto ===

# Izinkan MQTT non-TLS dari subnet lokal saja
sudo ufw allow from 192.168.1.0/24 to any port 1883 proto tcp

# Izinkan MQTT TLS dari mana saja
sudo ufw allow 8883/tcp

# Izinkan WebSocket (opsional)
sudo ufw allow 9001/tcp

# Izinkan SSH (jangan lupa!)
sudo ufw allow 22/tcp

# Aktifkan firewall
sudo ufw enable
sudo ufw status verbose

# === Subscribe ke semua topik $SYS ===
mosquitto_sub -h localhost -t '$SYS/#' -u admin -P pass123 -v

# === Contoh output topik $SYS ===
# $SYS/broker/version — Versi Mosquitto
# $SYS/broker/uptime — Waktu broker berjalan
# $SYS/broker/clients/connected — Client yang terhubung
# $SYS/broker/clients/total — Total client terdaftar
# $SYS/broker/messages/sent — Total pesan terkirim
# $SYS/broker/messages/received — Total pesan diterima
# $SYS/broker/messages/publish — Total pesan publish
# $SYS/broker/load/messages/received/1min — Load 1 menit
# $SYS/broker/load/messages/sent/1min — Load 1 menit
# $SYS/broker/retained messages/count — Pesan retained
# $SYS/broker/subscriptions/count — Total subscriptions
# $SYS/broker/bytes/received — Total byte diterima
# $SYS/broker/bytes/sent — Total byte terkirim

# === Monitor hanya koneksi ===
mosquitto_sub -h localhost -t '$SYS/broker/clients/#' \
  -u admin -P pass123 -v

# === Monitor hanya message stats ===
mosquitto_sub -h localhost -t '$SYS/broker/messages/#' \
  -u admin -P pass123 -v

# =============================================
# Logging Configuration
# =============================================

# Log ke file
log_dest file /var/log/mosquitto/mosquitto.log

# Log ke stdout (untuk systemd journal)
log_dest stdout

# Log ke syslog
log_dest syslog

# Jenis log yang dicatat
log_type error       # Error fatal
log_type warning     # Peringatan
log_type notice      # Informasi penting
log_type information # Informasi umum
log_type subscribe   # Aktivitas subscribe/unsubscribe
log_type unsubscribe
# log_type debug     # Debug detail (HATI-HATI: sangat verbose!)
# log_type websockets # Log WebSocket khusus

# Tampilkan info koneksi client
connection_messages true

# Format timestamp
log_timestamp true
log_timestamp_format %Y-%m-%dT%H:%M:%S

/var/log/mosquitto/mosquitto.log {
    daily
    missingok
    rotate 14
    compress
    delaycompress
    notifempty
    create 640 mosquitto mosquitto
    postrotate
        systemctl reload mosquitto 2>/dev/null || true
    endscript
}

#!/usr/bin/env python3
# mqtt_monitor.py — Monitor Mosquitto Broker via $SYS
# BeebaneLabs - https://beebanelabs.pages.dev

import paho.mqtt.client as mqtt
import json
import time
from datetime import datetime

BROKER = "localhost"
PORT = 1883
USERNAME = "admin"
PASSWORD = "admin_pass"

stats = {}

def on_connect(client, userdata, flags, rc, properties=None):
    if rc == 0:
        print("[OK] Monitor terhubung ke broker")
        client.subscribe("$SYS/#")
        print("[INFO] Memantau topik $SYS/#\n")
    else:
        print(f"[ERROR] Koneksi gagal: rc={rc}")

def on_message(client, userdata, msg):
    topic = msg.topic
    value = msg.payload.decode("utf-8")
    stats[topic] = value

    # Filter: tampilkan hanya info penting
    important = [
        "clients/connected",
        "messages/sent",
        "messages/received",
        "uptime",
        "version"
    ]

    for keyword in important:
        if keyword in topic:
            ts = datetime.now().strftime("%H:%M:%S")
            print(f"[{ts}] {topic}: {value}")
            break

def main():
    client = mqtt.Client(mqtt.CallbackAPIVersion.VERSION2, "monitor_01")
    client.username_pw_set(USERNAME, PASSWORD)
    client.on_connect = on_connect
    client.on_message = on_message

    client.connect(BROKER, PORT, keepalive=60)
    try:
        client.loop_forever()
    except KeyboardInterrupt:
        print("\n[INFO] Monitor dihentikan.")
        client.disconnect()

if __name__ == "__main__":
    main()