Skip to Content

Mosquitto works, right up until you want to see inside it

who is actually connected
EMQX Guide · Part 1

Mosquitto works, right up until you want to see inside it

The Mosquitto add-on built into Home Assistant is most people's first MQTT broker, and for a handful of devices it is entirely fine. Push dozens of sensors, switches and telemetry feeds through it and something starts to itch: there is no screen that tells you who is online, who is subscribed, or whether a message ever went out. This part covers what a broker actually does, what EMQX adds on top of that, what its 5.x architecture separates from what, and then the install itself — repository, start, first login, and the ports that decide whether it starts at all.

5.8.9
The EMQX the add-on actually runs, Open Source edition. The add-on's own version, 5.9.0, only adds an ngrok tunnel
5 ports
Open on the Home Assistant host itself, because the add-on runs with host_network: true
1 clash
Mosquitto and EMQX both listen for MQTT on 1883, so only one of the two can be started
Why look past Mosquitto

Dozens of sensors, and no way to look at any of them

Mosquitto gives you a bare-bones config file and connection records scattered through a log. That is genuinely enough while you have five devices and you remember all five of them.

It stops being enough at the point where you cannot answer a simple question without guessing. Which of these three questions have you already asked yourself out loud?

You ask“Is that sensor in the garage still connected, or did it drop off the wifi last Tuesday?”
You ask“Is anything actually subscribed to this topic, or have I been publishing into a void for a week?”
You ask“The automation did not fire. Did the message never arrive, or did it arrive and Home Assistant ignored it?”

Every one of those is a question about state you cannot see. An admin interface that shows who is online, who is subscribed, and whether messages are going out is where EMQX earns its place next to Home Assistant.

This part does two things. First it builds the model — publisher, subscriber, topic, broker — because everything in the eight parts after this one is a variation on those four words. Then it installs the thing. Part 2 takes you round the Dashboard and into MQTT proper.

This is not an argument for deleting Mosquitto. If your host is tight on resources and all you need is a plain broker that moves messages, Mosquitto is still very light and it is still the right answer. The trade is spelled out in full further down, with the comparison table the add-on README carries.
Publish, subscribe, topic

Three parts that never have to know about each other

MQTT stands for Message Queuing Telemetry Transport. It is the lightweight messaging protocol most used in the Internet of Things, and the reason it caught on is a single design decision: a client does not ask a server for data.

Instead it uses the publish/subscribe model. A publisher sends messages out sorted by topic. A subscriber subscribes only to the topics it cares about. The server in the middle — the broker — routes and filters every incoming message and delivers it to every subscriber interested in that topic.

TermPlain EnglishIn one line
MQTT Brokermessage brokerThe server that routes every message between you and your devices
Publisherthe senderAn endpoint that publishes messages to a topic
Subscriberthe receiverAn endpoint that declares which topics it wants messages from
Topicmessage labelThe hierarchical name a message is filed under, for example living-room/temperature
Clustera group of nodesSeveral nodes working together to provide one broker service
Dashboardweb admin interfaceThe Web UI built into EMQX

The relationship between the three is the whole point. Publishers and subscribers are fully decoupled. Neither needs to know the other exists. The only thing they share is a topic agreed in advance.

That decoupling is what makes the system cheap to grow. Add a sensor and you have added a publisher. Add a screen and you have added a subscriber. No other endpoint has to change, and nothing has to be told about the new arrival.

It also explains the one failure that catches everybody once. A topic is a hierarchical name, agreed in advance — living-room/temperature reads as a room, then a reading inside it. Nothing enforces that agreement. If the sensor publishes to living-room/temperature and Home Assistant subscribes to livingroom/temperature, both sides are working perfectly and nothing arrives, because as far as the broker is concerned those are two unrelated topics with no subscribers in common. No error appears anywhere. Part 2 goes into how topic names are built and matched; for now, take the silence seriously.

flowchart LR
  P1["A temperature sensor
publishes to the topic
living-room/temperature"] --> B["EMQX, the broker
routes and filters
every message
that arrives"] P2["A second sensor,
added next month,
publishes to its own topic"] --> B B --> S1["Home Assistant,
subscribed to
living-room/temperature"] B --> S2["A browser page over
WebSocket, subscribed
to the same topic"]
Nobody on the left knows anybody on the rightTwo publishers on the left, the broker in the middle, two subscribers on the right. Every arrow passes through the middle box, and not one box on the left names a box on the right. The topic is the only thing the two sides have in common.
In plain terms

The broker is a post office. The publisher writes the address on the envelope — that address is the topic — and drops the letter in. The post office delivers it only to the people who signed up for that address. The sender never learns who collected it, and the people collecting never learn who sent it. Adding another sender does not require telling anybody. That is not a limitation of the post office. It is the reason it scales to a whole city.

Two capabilities are worth naming this early, because they come up constantly later. EMQX supports MQTT 3.1, 3.1.1 and 5.0, so an older device that only speaks 3.1.1 and a new one that speaks 5.0 can sit on the same broker. And it lets a web browser publish MQTT messages directly over WebSocket, which Mosquitto does not do by default. That second one is why the Dashboard can carry a working test client you can publish from without installing anything.

Learn the four words properly now. Publisher, subscriber, topic, broker. Every chapter after this one — authentication, authorization, the Rule Engine, bridging — is a rule about which publisher may write to which topic, or which subscriber may read from it. If the four words are solid, the rest is detail.
EMQX next to Mosquitto

What the extra resources actually buy you

If you are moving over from the Mosquitto built into Home Assistant, the first thing you want is a straight comparison. The Woow EMQX add-on README carries one; these are the main points from it.

CapabilityMosquittoEMQX
Graphical admin interfaceNone, config file onlyDashboard (Web UI)
Client managementNoneReal-time monitoring
Rule EngineNoneData Integration
WebSocket supportNeeds extra configurationBuilt in
ACL managementSet in a fileManaged in the Web UI
ClusteringNoneSupported
Resource useVery lowModerate
Maximum connectionsThousandsMillions

Read the bottom two rows together, because on their own each one is misleading. “Millions” is not a number your house will ever need. “Moderate” resource use is a real cost you pay every day. Nobody installs EMQX at home for the connection ceiling.

The honest conclusion is the one the source draws: you do not have to replace Mosquitto today. It is still very light, and if all you need is a plain broker it is still enough. But if you want visual management, subscription diagnostics, a WebSocket test client, the Rule Engine, and room to grow later, the moderate resource use buys you noticeably more to work with.

Check the memory before you commit. EMQX costs a little more RAM and CPU than Mosquitto, and the Woow README recommends at least 512MB RAM. If memory on your host is already tight, Mosquitto may still be the lighter and better choice. Look at what your hardware has before you install, not after the swap has gone badly.
Inside EMQX 5.x

The Dashboard is not the broker

EMQX is designed for high concurrency and high availability. It is built on the Erlang/OTP platform, uses a fully asynchronous architecture, and layers connections, sessions, routing and clustering separately. That layering is why a single node can carry connections in the millions, and why several nodes can be joined into a cluster to scale out.

One separation in 5.x matters more than the rest for anyone running this at home. EMQX 5.x separates the Dashboard from message processing. The Dashboard only gives you a visual way to work. EMQX keeps sending and receiving messages whether or not the Dashboard is open.

flowchart LR
  L1["Connection
the socket a device opens"] --> L2["Session
who this client is and
what it subscribed to"] --> L3["Route
which subscribers this
topic has to reach"] --> L4["Cluster
one node here, more
nodes if you add them"] DASH["The Dashboard, port 18083
a visual way to work"] -.-> L2 DASH -.-> L3
Four layers, and a screen looking in at themThe four solid boxes step left to right: connection, session, route, cluster. The Dashboard is the box on its own at the bottom left, and the two dotted lines are the whole of its involvement. Close it and the solid chain above still runs.
In plain terms

Closing the Dashboard is switching off the monitor in the back office, not locking the shop. The tills keep ringing, the deliveries keep arriving, and the only thing that changed is that nobody is watching the screen. This matters the first time your browser tab times out and you assume your automations went down with it. They did not.

What a cluster is, and why you do not need one

A cluster is how EMQX delivers high availability: several EMQX nodes make up a single broker service. When one of them fails, the MQTT service does not stop, and adding nodes raises overall throughput.

The add-on you are about to install defaults to a single node, and that is enough. Understanding what a cluster is for is worth the two minutes anyway, because it gives you the mental model for where the expansion joint is, once you have more devices and a real throughput or redundancy requirement.

Two version numbers that do not match, on purpose

This trips people up on day one, so it is worth stating plainly. The EMQX version bundled with the Woow EMQX add-on is 5.8.9 (Open Source). The add-on's own version is 5.9.0. Those are two different things being counted.

EMQX 5.8.9 (Open Source) — the MQTT broker you are actually running. Every menu path, default value and screen described in this series matches it
Woow EMQX add-on 5.9.0 — the package version Woow maintains. The only thing 5.9.0 adds is an ngrok TCP tunnel; the underlying broker is still 5.8.9

So if you go looking for a 5.9 feature in the broker, you will not find one, because there isn't one. Everything that follows is written against the facts and menu paths of 5.8.9.

Three EMQX products, and only one of them is what you are installing. EMQX Open Source is the open source and free edition, which you build and host yourself. EMQX Enterprise is paid software that you also deploy yourself — self-hosted in the same way, but with advanced Data Integration and advanced security features. EMQX Cloud is a separate cloud service that EMQX hosts for you, its own cloud product and a different distribution channel from Enterprise. This guide covers Open Source 5.8.9 throughout. Where a later part mentions a feature that is not in the open source edition, it says so at that point.
Installing the add-on

Repository, install, start, log in

The Home Assistant add-on store does not carry Woow EMQX by default, so the first move is adding the WoowTech repository to your Home Assistant. A repository is just an address you paste in once; after that the store knows where to look.

Woow EMQX is a Home Assistant add-on that WOOWTECH maintains as a fork of hassio-addons/addon-emqx. It ships EMQX 5.8.9 (Open Source) on the Erlang/OTP runtime, with a built-in SQLite store for its settings.

The install itself is not hard. What makes it go wrong is starting it before three words mean anything to you, because then the add-on refuses to run and you are left in front of a log with no idea why. The three are worth reading once now, in this order:

host_network mode — the add-on uses the host's own network rather than a private one inside the container. Covered in full in the next section
1883 and 18083 — the MQTT port and the Dashboard port. These are the two that decide whether it starts and whether you can get in
Ingress — the sidebar entry that opens the Dashboard for you, so there is no port to type

The whole run is five moves: add the repository, install, start, log in for the first time with admin / public, change the default password.

TermPlain EnglishWhat it means
Repositoryadd-on sourceWhere Home Assistant gets extra add-ons from
Host Networkhost network modeThe mode in which the add-on uses the host's network directly
Ingressentry channelOpens the add-on's web page straight from the Home Assistant sidebar
Listener Portlistener portWhich ports the broker takes MQTT and admin traffic on
Web UIweb admin interfaceThe way in to the EMQX Dashboard
  1. Step 1

    Add the WoowTech repository

    In Home Assistant, go to Settings → Add-ons → Add-on store, open the ⋯ menu at the top right, choose Add repository, paste in the address below and click Add.

    https://github.com/WOOWTECH/Woow_ha_emqx

    Paste the whole thing, including the trailing Woow_ha_emqx. A truncated address is the most common reason the add-on never shows up afterwards.

  2. Step 2

    Install Woow EMQX

    Refresh the store, find Woow EMQX, open it and click Install. The download can take a while — this is a broker with a full web interface inside it, not a small integration. Leave it alone until it finishes.

  3. Step 3

    Check host_network, then Start

    On the add-on page, check that host_network is enabled, then click Start. Afterwards, read the log and confirm there is no port already in use error. That log line is the single most useful thing on the page at this moment, and it is the one people skip.

  4. Step 4

    Open the Web UI and log in for the first time

    Click Open Web UI. Log in with the user name admin and the password public. If you are asked to change the password, change it there and then, and do not use public again before you create real MQTT accounts in a later chapter.

  5. Step 5

    Find where the version is shown

    Locate the page in the Dashboard that shows the version and license information, and note down what it says. You will want that version number the day you need to report a problem or check whether a documented feature exists in your build. Part 2 then walks you through the sidebar modules one by one.

The default password, and why it is not really a password

The default account for the EMQX Dashboard is admin / public. The official documentation is explicit about what happens next: the first time you log in with the default credentials, EMQX detects that you are still on the default password and forces you to change it. The new password cannot be the same as the old one, and keeping public for real use is not recommended.

In plain terms

A new safe arrives with 0000 on the dial. That is not a combination, it is a placeholder printed in a manual that everybody can download. public is the same thing. It is not a weak password that a determined attacker might eventually guess; it is a published value that anyone who has read the documentation already knows.

This is the first real step in protecting the admin surface, and it deserves the weight. The Dashboard is the way in to controlling the whole broker — anyone who guesses admin / public can rewrite all of your authentication and authorization. In this part you only have to change the Dashboard login password. Creating real MQTT accounts for your devices and for Home Assistant comes later in the series.

If you forget the new password, EMQX gives you a CLI command to reset it: emqx ctl admins passwd <username> <new-password> — the two values in angle brackets are placeholders you replace with your own. The later chapter on diagnostics and the API covers where you run it and what else emqx ctl can do.
Ports and the way in

Five ports on your own host, and two doors to the Dashboard

The add-on runs with host_network: true. That means it does not seal its networking into a small virtual network inside the container. It sends and receives MQTT on the ports of the Home Assistant host itself.

In plain terms

Most add-ons are a flat inside a building with their own internal doorbell, and Home Assistant forwards visitors to them. This one is not. It has been handed the building's own numbered street doors. The upside is that a phone app or a device out on your network walks straight in with nothing in between. The cost is that door 1883 belongs to one tenant only, and if Mosquitto is already standing behind it, EMQX cannot open it.

Because of host_network, these five ports are open on the Home Assistant host itself. The add-on README lists the following defaults.

PortProtocolWhat it means
1883MQTTStandard MQTT (TCP)
8083MQTT/WSMQTT over WebSocket
8084MQTT/WSSMQTT over secure WebSocket (TLS)
8883MQTTSMQTT over SSL/TLS
18083HTTPEMQX Dashboard (the admin interface)

Day to day you only need two of them: 1883 for devices and Home Assistant, and 18083 to open the Dashboard. The rest are the WebSocket and TLS options, and they matter later in the series when you put the broker behind TLS.

If another service is holding one of the ports — WebRTC uses 8083, for example — you have to stop the conflicting side first, and then change the port on the Dashboard's Listeners page.

Ingress, or the port, and why there are two

The add-on also serves its admin interface through ingress mode. You can open the EMQX Dashboard straight from the Home Assistant sidebar, with no need to remember http://<host>:18083. The add-on's config.yaml already sets both ingress_port: 18083 and host_network: true, so there is nothing for you to configure here.

flowchart TD
  A["You want the
EMQX Dashboard"] --> B{"Which way in?"} B -->|"the EMQX icon in the
Home Assistant sidebar"| C["Ingress: Home Assistant
proxies it for you. No port to
remember, and no worry about
someone else connecting to it directly"] B -->|"you type the
address yourself"| D["Port 18083 on the Home
Assistant host, reached
directly over HTTP"] C --> E["The same Dashboard,
with the same admin login"] D --> E
Two doors, one DashboardThe sidebar route is the branch on the left, typing the address yourself is the branch on the right, and both arrive at the same single box at the bottom. What differs is the security and the convenience of the way in, not the Dashboard you land on.

Both routes reach the same Dashboard. The difference is security and convenience: Ingress is the reverse-proxy entry point Home Assistant provides, so there is no port to remember and no worry about someone else connecting to it directly. Going straight to 18083 is the fallback when the sidebar entry is not working, and it is also how you check whether the problem is EMQX or the Ingress layer in front of it.

Mosquitto and Woow EMQX cannot both be started. Both add-ons listen for MQTT on 1883, and once the port conflicts, one of the two will not start. Either pick one of them, or use Listeners to move one of them to a different port. Deciding this before you press Start saves you reading a log to discover it.
When it does not start

Four failures, and what each one is telling you

Four things go wrong often enough to be worth naming. They happen in a fixed order — the store, the start, the Dashboard, the password — so working through them in that order finds the fault faster than picking the one that sounds most likely.

flowchart TD
  A["Something is wrong
after the install"] --> B{"Does Woow EMQX show
up in the add-on store?"} B -->|"no"| C["Refresh the page, or leave the store
and come back. Check you pasted the
whole address, ending in Woow_ha_emqx"] B -->|"yes"| D{"Does the add-on start?"} D -->|"no, the log says
a port is in use"| E["Mosquitto or WebRTC is holding
1883 or 8083. Stop that service
first, then start EMQX"] D -->|"yes, it reports running"| F{"Does the Dashboard open?"} F -->|"no"| G["Go in through Ingress, the EMQX icon
in the sidebar. Or check that nothing
else is holding 18083"] F -->|"yes"| H{"Were you asked to
change the password?"} H -->|"no"| I["This is not a fresh install. Change
admin and public by hand in the
Dashboard user settings"] H -->|"yes"| J["Change it, and stop
using public"]
Four checks in the order they failFour questions in a staircase down to the right. Each no branch peels off to the left and ends there. Five boxes end the chart: four of them hang off a no, and the fifth, at the bottom right, is the only yes that finishes instead of asking the next question.
  1. 1

    You added the repository but Woow EMQX does not show up in the store

    Refresh the page, or leave the store and come back in. If it is still missing, check that you pasted the whole URL, including the trailing Woow_ha_emqx. A copy that stopped at WOOWTECH looks convincing and points at nothing installable.

  2. 2

    It will not start, and the log says a port is in use

    The most likely cause is that the Mosquitto add-on or WebRTC is running at the same time, and both hold 1883 or 8083. Stop the conflicting service first, then start EMQX. Note that this is not something you can fix from inside EMQX — it never got far enough to have a Dashboard for you to change the setting in.

  3. 3

    The Dashboard will not open

    Get in through Ingress — the EMQX icon in the sidebar — or use http://<home-assistant-host>:18083 instead, replacing the placeholder with your own host. Check that nothing else is holding 18083. If the add-on log shows errors, read those before you start changing ports.

  4. 4

    You were never asked to change the password

    Then this is not a fresh install — somebody, possibly you, has been here before. If you are still on the default credentials, change them by hand in the Dashboard's user settings. Once you have changed it, really stop using public.

Still not sure what the broker is doing at all

If the model has not clicked yet, go back to the post office. The publisher writes the envelope, which is the topic, and drops the letter in. The broker delivers it only to the recipients who subscribed to that envelope. Subscribers do not know the senders, and senders do not know the subscribers. Everything in the Dashboard is a view onto that one arrangement: who is holding an envelope open, and what came through it.

If you cannot find EMQX anywhere, check first that the add-on is installed and started — those are two separate states, and an installed-but-stopped add-on shows no Web UI at all. Once it is running, the two ways to open the Dashboard are the sidebar icon and port 18083, as above.
Questions people ask

The ones that come up every time

Is EMQX free?
EMQX Open Source is the open source and free edition, and you can build and host it yourself. EMQX Enterprise is paid software that you also deploy yourself — self-hosted in the same way, but with advanced Data Integration and advanced security features. EMQX Cloud is a separate cloud service that EMQX hosts for you, its own cloud product and a different distribution channel from Enterprise. This guide covers Open Source 5.8.9.
Why not just use Home Assistant's Mosquitto?
Mosquitto is light and sits right next to Home Assistant out of the box. But over the long run, when you are managing many devices, watching connections, writing rules and debugging, the EMQX Dashboard, WebSocket, subscription diagnostics and Data Integration save you a great deal of time. If you have the resources for it, EMQX is the more capable choice.
How does add-on version 5.9.0 relate to EMQX 5.8.9?
The add-on's 5.9.0 is the package version Woow maintains, and the only thing it adds is an ngrok TCP tunnel. The MQTT broker you are actually running is still EMQX 5.8.9. The text, menus and default values in this guide all match 5.8.9.
Can Mosquitto and Woow EMQX run at the same time?
No. Both add-ons listen for MQTT on 1883, and once the port conflicts one of the two cannot start. Either pick one of them, or use Listeners to move one of them to a different port.
Why must I change the password immediately after installing?
The default admin / public is a public value to anyone who has read the documentation. If your host is exposed to the outside, leaving it in place hands over control of the whole broker. Make changing it to a strong password of your own the very first thing you do.
What is Ingress, and how does it differ from going straight to 18083?
Ingress is the reverse-proxy entry point Home Assistant provides: you open EMQX from the sidebar, with no port to remember and no worry about someone else connecting to it directly. Going straight to 18083 reaches the same Dashboard; the difference is security and convenience.
It uses more resources once installed — will it slow Home Assistant down?
EMQX costs a little more RAM and CPU than Mosquitto. The Woow README recommends at least 512MB RAM. If memory on your host is tight, Mosquitto may still be the lighter choice; if you want EMQX, check first that your hardware can carry it.
Do I need to set up two machines for a cluster right now?
No. For now it is enough to understand the idea: a cluster means several nodes sharing one broker, so a single node failing does not interrupt the service. A single node at home is entirely sufficient. Plan a cluster later, once you have more devices and a real throughput or redundancy requirement.
I still cannot picture what a broker actually does.
Think of the broker as a post office, or a router. The publisher writes the envelope — that is the topic — and drops the letter in, and the broker delivers it only to the recipients who subscribed to that envelope. Subscribers do not know the senders, and senders do not know the subscribers.
I have installed it and the Dashboard will not open. Where do I start?
Check the add-on log for errors first, then make sure nothing else is holding 18083. If the log is clean, try the other door: the sidebar icon if you were using the port, or http://<home-assistant-host>:18083 if you were using the sidebar. Tunnel and Ingress settings are covered in later parts of this series.
Next

Where to go from here

keep going

It is running. Now learn to read it.

Part 2 takes you round the Dashboard module by module — what each panel in the sidebar is for, and which numbers on the overview are worth watching — and then builds the MQTT mental model properly: topics, the shape of a topic tree, and what the protocol guarantees about a message once you have published it.

Open the full guide

Part 1 of the WoowTech EMQX Complete Guide series on the Apporo blog.

Adapted from the WoowTech EMQX Complete Guide, produced by WoowTech and released under CC BY 4.0. This adaptation is published by Apporo under the same licence.

Light · Air · Water · Control · apporo

in EMQX
Lock it down, then learn to read the log