persistence true
persistence_location /mosquitto/data/
log_dest file /mosquitto/log/mosquitto.log
log_dest stdout

# Default listener
listener 1883
allow_anonymous false
password_file /mosquitto/config/password.txt

# Local-only listener by default (inside Docker network, it's open to other containers)
# To expose to Tailscale, one might add:
# listener 1883 <tailscale_ip>