mosquitto

hcom does not connect machines directly. It syncs through a broker — a small server that every machine dials out to and that relays messages between them. mosquitto is a lightweight, widely used MQTT broker, and one instance is enough to be that relay for a whole set of machines.

You run your own rather than use a public broker for two reasons. First, the public test brokers (for example mosquitto.org’s) are shared and unreliable, and many are blocked from locked-down networks anyway. Second, even though hcom encrypts every message end-to-end so the broker only ever sees ciphertext, the broker is still the one place all the traffic passes through — so it is worth keeping it private and authenticated.

Set it up

Install mosquitto from your package manager, then give it a password file and a config that binds to the private network and refuses anonymous clients.

# create a user + password (you will be prompted for the password)
mosquitto_passwd -c /etc/mosquitto/passwd hcom

# /etc/mosquitto/conf.d/private.conf
listener 1883 <broker's-private-IP>     # bind to the tailnet address, NOT 0.0.0.0
allow_anonymous false
password_file /etc/mosquitto/passwd

Restart mosquitto, and point hcom at it with mqtt://<broker's-private-IP>:1883 plus that password (see hcom ).

Two settings that keep it private

listener 1883 <private-IP> binds the broker to your private network only — on a public host, that bind is what keeps it off the open internet, so do not use 0.0.0.0. allow_anonymous false makes the password mandatory. On Linux, also note that mosquitto’s password_file must be owned by the mosquitto user, or the broker refuses to start.

What syncs through it: hcom .
Full walk-through: Connect machines with hcom .

Source: content/tools/mosquitto.md · maintained in the nuilab-agenticai repository.

Set it up

Next