Support TLS with optional CA validation

mqtt_exporter/main.py

@@ -6,6 +6,7 @@
 import logging
 import re
 import signal
+import ssl
 import sys
 from dataclasses import dataclass
 
@@ -409,6 +410,20 @@ def main():
         # if MQTT version 5 is not requested, we let MQTT lib choose the protocol version
         client = mqtt.Client(client_id=settings.MQTT_CLIENT_ID)
 
+    client.enable_logger(LOG)
+
+    if settings.MQTT_ENABLE_TLS:
+        LOG.debug("Enabling TLS on MQTT client")
+        ssl_context = ssl.create_default_context()
+        ssl_context.load_default_certs()
+
+        if settings.MQTT_TLS_NO_VERIFY:
+            LOG.debug("Not verifying MQTT certificate authority is trusted")
+            ssl_context.check_hostname = False
+            ssl_context.verify_mode = ssl.CERT_NONE
+
+    client.tls_set_context(ssl_context)
+
     def stop_request(signum, frame):
         """Stop handler for SIGTERM and SIGINT.
 

mqtt_exporter/settings.py

@@ -21,6 +21,8 @@
 MQTT_V5_PROTOCOL = os.getenv("MQTT_V5_PROTOCOL", "False") == "True"
 MQTT_CLIENT_ID = os.getenv("MQTT_CLIENT_ID", "")
 MQTT_EXPOSE_CLIENT_ID = os.getenv("MQTT_EXPOSE_CLIENT_ID", "False") == "True"
+MQTT_ENABLE_TLS = os.getenv("MQTT_ENABLE_TLS", "False") == "True"
+MQTT_TLS_NO_VERIFY = os.getenv("MQTT_TLS_NO_VERIFY", "False") == "True"
 PROMETHEUS_ADDRESS = os.getenv("PROMETHEUS_ADDRESS", "0.0.0.0")
 PROMETHEUS_PORT = int(os.getenv("PROMETHEUS_PORT", "9000"))