Transport configuration

ThingsBoard Edge runs the same transport services as ThingsBoard Community Edition — MQTT, HTTP, CoAP, LwM2M, and SNMP. Set the variables listed below in /etc/tb-edge/conf/tb-edge.conf (Linux) or as container environment variables (Docker / Kubernetes). For instructions on applying changes, see How to change configuration.

Parameter	Env variable	Default	Description
transport.sessions.inactivity_timeout	TB_TRANSPORT_SESSIONS_INACTIVITY_TIMEOUT	600000	Session inactivity timeout in milliseconds. After this period of no activity, the session is closed and all subscriptions are deleted. Should be ≥ the device inactivity timeout (DEFAULT_INACTIVITY_TIMEOUT, which is in seconds).
transport.sessions.report_timeout	TB_TRANSPORT_SESSIONS_REPORT_TIMEOUT	3000	Interval (ms) for periodic check of expired sessions and reporting of session last-activity changes.
transport.activity.reporting_strategy	TB_TRANSPORT_ACTIVITY_REPORTING_STRATEGY	LAST	Strategy for reporting activity events per reporting period. Values: FIRST, LAST, FIRST_AND_LAST, ALL.
transport.json.type_cast_enabled	JSON_TYPE_CAST_ENABLED	true	Cast string data to numeric when possible while processing telemetry/attributes JSON.
transport.json.max_string_value_length	JSON_MAX_STRING_VALUE_LENGTH	0	Maximum allowed string value length in telemetry/attributes JSON. 0 disables the check.
transport.client_side_rpc.timeout	CLIENT_SIDE_RPC_TIMEOUT	60000	Processing timeout (ms) for client-side RPC commands.
transport.api_enabled	TB_TRANSPORT_API_ENABLED	true	Enable/disable all transport protocols (HTTP, MQTT, CoAP, LwM2M). Takes priority over each protocol’s own enabled flag.
transport.log.enabled	TB_TRANSPORT_LOG_ENABLED	true	Log transport messages to telemetry (e.g. LwM2M registration updates).
transport.log.max_length	TB_TRANSPORT_LOG_MAX_LENGTH	1024	Maximum length of a transport log message. Content is truncated to this value.
transport.rate_limits.ip_limits_enabled	TB_TRANSPORT_IP_RATE_LIMITS_ENABLED	false	Enable/disable IP-based rate limits. Device and tenant-specific limits are controlled via Tenant Profile.
transport.rate_limits.max_wrong_credentials_per_ip	TB_TRANSPORT_MAX_WRONG_CREDENTIALS_PER_IP	10	Maximum number of connection attempts with invalid credentials before an IP is blocked.
transport.rate_limits.ip_block_timeout	TB_TRANSPORT_IP_BLOCK_TIMEOUT	60000	Timeout (ms) after which a blocked IP address is unblocked.

Default ports: 8080 (plain), 443 (TLS)

Parameter	Env variable	Default	Description
transport.http.enabled	HTTP_ENABLED	true	Enable/disable the HTTP transport protocol.
transport.http.request_timeout	HTTP_REQUEST_TIMEOUT	60000	HTTP request processing timeout in milliseconds.
transport.http.max_request_timeout	HTTP_MAX_REQUEST_TIMEOUT	300000	HTTP maximum request processing timeout in milliseconds.
transport.http.max_payload_size	HTTP_TRANSPORT_MAX_PAYLOAD_SIZE_LIMIT_CONFIGURATION	/api/v1/*/rpc/**=65536;/api/v1/**=52428800	Semicolon-separated list of urlPattern=maxPayloadSize pairs. First match wins.

Default ports: 1883 (plain), 8883 (TLS)

Parameter	Env variable	Default	Description
transport.mqtt.enabled	MQTT_ENABLED	true	Enable/disable the MQTT transport protocol.
transport.mqtt.bind_address	MQTT_BIND_ADDRESS	0.0.0.0	MQTT bind address.
transport.mqtt.bind_port	MQTT_BIND_PORT	1883	MQTT bind port.
transport.mqtt.proxy_enabled	MQTT_PROXY_PROTOCOL_ENABLED	false	Enable HAProxy PROXY protocol support (v1 and v2). Useful for obtaining the real client IP for logs and rate limits.
transport.mqtt.timeout	MQTT_TIMEOUT	10000	MQTT processing timeout in milliseconds.
transport.mqtt.disconnect_timeout	MQTT_DISCONNECT_TIMEOUT	1000	Time (ms) to wait for client disconnect after the server sends a disconnect message.
transport.mqtt.msg_queue_size_per_device_limit	MQTT_MSG_QUEUE_SIZE_PER_DEVICE_LIMIT	100	Max messages queued before the device connects. Applied before Tenant Profile limits.
transport.mqtt.gateway_metrics_report_interval_sec	MQTT_GATEWAY_METRICS_REPORT_INTERVAL_SEC	60	Interval (s) for periodic reporting of gateway metrics.
transport.mqtt.netty.leak_detector_level	NETTY_LEAK_DETECTOR_LVL	DISABLED	Netty buffer leak detector level.
transport.mqtt.netty.boss_group_thread_count	NETTY_BOSS_GROUP_THREADS	1	Number of Netty boss threads.
transport.mqtt.netty.worker_group_thread_count	NETTY_WORKER_GROUP_THREADS	12	Number of Netty worker threads.
transport.mqtt.netty.max_payload_size	NETTY_MAX_PAYLOAD_SIZE	65536	Maximum MQTT payload size in bytes.
transport.mqtt.netty.so_keep_alive	NETTY_SO_KEEPALIVE	false	Enable TCP keepalive probes on idle connections.
transport.mqtt.ssl.enabled	MQTT_SSL_ENABLED	false	Enable/disable MQTT SSL support.
transport.mqtt.ssl.bind_address	MQTT_SSL_BIND_ADDRESS	0.0.0.0	MQTT SSL bind address.
transport.mqtt.ssl.bind_port	MQTT_SSL_BIND_PORT	8883	MQTT SSL bind port.
transport.mqtt.ssl.protocol	MQTT_SSL_PROTOCOL	TLSv1.2	SSL protocol. See Java standard algorithm names.
transport.mqtt.ssl.credentials.type	MQTT_SSL_CREDENTIALS_TYPE	PEM	Server credentials type: PEM (certificate file) or KEYSTORE (Java keystore).
transport.mqtt.ssl.credentials.pem.cert_file	MQTT_SSL_PEM_CERT	mqttserver.pem	Path to the server certificate (or chain) file. May include the private key.
transport.mqtt.ssl.credentials.pem.key_file	MQTT_SSL_PEM_KEY	mqttserver_key.pem	Path to the server private key file. Required if the key is not in the cert file.
transport.mqtt.ssl.credentials.pem.key_password	MQTT_SSL_PEM_KEY_PASSWORD	server_key_password	Password for the server private key (optional).
transport.mqtt.ssl.credentials.keystore.type	MQTT_SSL_KEY_STORE_TYPE	JKS	Key store type: JKS or PKCS12.
transport.mqtt.ssl.credentials.keystore.store_file	MQTT_SSL_KEY_STORE	mqttserver.jks	Path to the keystore holding the SSL certificate.
transport.mqtt.ssl.credentials.keystore.store_password	MQTT_SSL_KEY_STORE_PASSWORD	server_ks_password	Password to access the keystore.
transport.mqtt.ssl.credentials.keystore.key_alias	MQTT_SSL_KEY_ALIAS	(none)	Alias of the private key. If not set, the first private key in the keystore is used.
transport.mqtt.ssl.credentials.keystore.key_password	MQTT_SSL_KEY_PASSWORD	server_key_password	Password to access the private key (optional).
transport.mqtt.ssl.skip_validity_check_for_client_cert	MQTT_SSL_SKIP_VALIDITY_CHECK_FOR_CLIENT_CERT	false	Skip certificate validity check for client certificates.

Default ports: 5683 UDP (plain), 5684 UDP (DTLS)

Parameter	Env variable	Default	Description
transport.coap.enabled	COAP_ENABLED	true	Enable/disable the CoAP transport protocol.
transport.coap.timeout	COAP_TIMEOUT	10000	CoAP processing timeout in milliseconds.
transport.coap.piggyback_timeout	COAP_PIGGYBACK_TIMEOUT	500	CoAP piggyback response timeout in milliseconds.
transport.coap.psm_activity_timer	COAP_PSM_ACTIVITY_TIMER	10000	Default PSM Activity Timer if not specified in the device profile.
transport.coap.paging_transmission_window	COAP_PAGING_TRANSMISSION_WINDOW	10000	Default Paging Transmission Window if not specified in the device profile.

Default ports: 5685 CoAP, 5686 CoAP/DTLS, 5687 Bootstrap, 5688 Bootstrap/DTLS

Parameter	Env variable	Default	Description
transport.lwm2m.enabled	LWM2M_ENABLED	true	Enable/disable the LwM2M transport protocol.
transport.lwm2m.dtls.retransmission_timeout	LWM2M_DTLS_RETRANSMISSION_TIMEOUT_MS	9000	DTLS retransmission timeout in milliseconds (RFC 7925 default).
transport.lwm2m.dtls.connection_id_length	LWM2M_DTLS_CONNECTION_ID_LENGTH	(off)	DTLS Connection ID length (RFC 9146). Values: off, on, or a positive integer for CID size in bytes.
transport.lwm2m.server.id	LWM2M_SERVER_ID	123	LwM2M server identifier.
transport.lwm2m.server.bind_address	LWM2M_BIND_ADDRESS	0.0.0.0	LwM2M server bind address.
transport.lwm2m.server.bind_port	LWM2M_BIND_PORT	5685	LwM2M server CoAP bind port.
transport.lwm2m.server.security.bind_address	LWM2M_SECURITY_BIND_ADDRESS	0.0.0.0	LwM2M server DTLS bind address.
transport.lwm2m.server.security.bind_port	LWM2M_SECURITY_BIND_PORT	5686	LwM2M server DTLS bind port.
transport.lwm2m.server.security.credentials.enabled	LWM2M_SERVER_CREDENTIALS_ENABLED	false	Enable LwM2M server X.509 / RPK certificate support.
transport.lwm2m.server.security.credentials.type	LWM2M_SERVER_CREDENTIALS_TYPE	PEM	Server credentials type: PEM or KEYSTORE.
transport.lwm2m.server.security.credentials.pem.cert_file	LWM2M_SERVER_PEM_CERT	lwm2mserver.pem	Path to the server certificate (or chain) file.
transport.lwm2m.server.security.credentials.pem.key_file	LWM2M_SERVER_PEM_KEY	lwm2mserver_key.pem	Path to the server private key file. Required if not included in the cert file.
transport.lwm2m.server.security.credentials.pem.key_password	LWM2M_SERVER_PEM_KEY_PASSWORD	server_key_password	Server private key password (optional).
transport.lwm2m.server.security.credentials.keystore.type	LWM2M_SERVER_KEY_STORE_TYPE	JKS	Keystore type: JKS or PKCS12.
transport.lwm2m.server.security.credentials.keystore.store_file	LWM2M_SERVER_KEY_STORE	lwm2mserver.jks	Path to the keystore holding the SSL certificate.
transport.lwm2m.server.security.credentials.keystore.store_password	LWM2M_SERVER_KEY_STORE_PASSWORD	server_ks_password	Password to access the keystore.
transport.lwm2m.server.security.credentials.keystore.key_alias	LWM2M_SERVER_KEY_ALIAS	server	Key alias in the keystore.
transport.lwm2m.server.security.credentials.keystore.key_password	LWM2M_SERVER_KEY_PASSWORD	server_ks_password	Password to access the private key.
transport.lwm2m.server.security.skip_validity_check_for_client_cert	TB_LWM2M_SERVER_SECURITY_SKIP_VALIDITY_CHECK_FOR_CLIENT_CERT	false	Skip validity check for client X.509 certificates.
transport.lwm2m.bootstrap.enabled	LWM2M_ENABLED_BS	true	Enable/disable the LwM2M Bootstrap server.
transport.lwm2m.bootstrap.id	LWM2M_SERVER_ID_BS	111	Bootstrap server short ID (used in the LwM2M Security object).
transport.lwm2m.bootstrap.bind_address	LWM2M_BS_BIND_ADDRESS	0.0.0.0	Bootstrap server bind address.
transport.lwm2m.bootstrap.bind_port	LWM2M_BS_BIND_PORT	5687	Bootstrap server CoAP bind port.
transport.lwm2m.bootstrap.security.bind_address	LWM2M_BS_SECURITY_BIND_ADDRESS	0.0.0.0	Bootstrap server DTLS bind address.
transport.lwm2m.bootstrap.security.bind_port	LWM2M_BS_SECURITY_BIND_PORT	5688	Bootstrap server DTLS bind port.
transport.lwm2m.bootstrap.security.credentials.enabled	LWM2M_BS_CREDENTIALS_ENABLED	false	Enable Bootstrap server X.509 / RPK certificate support.
transport.lwm2m.bootstrap.security.credentials.type	LWM2M_BS_CREDENTIALS_TYPE	PEM	Bootstrap server credentials type: PEM or KEYSTORE.
transport.lwm2m.bootstrap.security.credentials.pem.cert_file	LWM2M_BS_PEM_CERT	lwm2mserver.pem	Path to the bootstrap server certificate (or chain) file.
transport.lwm2m.bootstrap.security.credentials.pem.key_file	LWM2M_BS_PEM_KEY	lwm2mserver_key.pem	Path to the bootstrap server private key file.
transport.lwm2m.bootstrap.security.credentials.pem.key_password	LWM2M_BS_PEM_KEY_PASSWORD	server_key_password	Bootstrap server private key password (optional).
transport.lwm2m.bootstrap.security.credentials.keystore.type	LWM2M_BS_KEY_STORE_TYPE	JKS	Bootstrap keystore type: JKS or PKCS12.
transport.lwm2m.bootstrap.security.credentials.keystore.store_file	LWM2M_BS_KEY_STORE	lwm2mserver.jks	Path to the bootstrap keystore.
transport.lwm2m.bootstrap.security.credentials.keystore.store_password	LWM2M_BS_KEY_STORE_PASSWORD	server_ks_password	Password to access the bootstrap keystore.
transport.lwm2m.bootstrap.security.credentials.keystore.key_alias	LWM2M_BS_KEY_ALIAS	bootstrap	Key alias in the bootstrap keystore.
transport.lwm2m.bootstrap.security.credentials.keystore.key_password	LWM2M_BS_KEY_PASSWORD	server_ks_password	Password to access the bootstrap private key.
transport.lwm2m.security.trust-credentials.enabled	LWM2M_TRUST_CREDENTIALS_ENABLED	false	Load X.509 trust certificates for client verification.
transport.lwm2m.security.trust-credentials.type	LWM2M_TRUST_CREDENTIALS_TYPE	PEM	Trust store type: PEM or KEYSTORE.
transport.lwm2m.security.trust-credentials.pem.cert_file	LWM2M_TRUST_PEM_CERT	lwm2mtruststorechain.pem	Path to the trust certificate chain file.
transport.lwm2m.security.trust-credentials.keystore.type	LWM2M_TRUST_KEY_STORE_TYPE	JKS	Trust keystore type: JKS or PKCS12.
transport.lwm2m.security.trust-credentials.keystore.store_file	LWM2M_TRUST_KEY_STORE	lwm2mtruststorechain.jks	Path to the trust keystore.
transport.lwm2m.security.trust-credentials.keystore.store_password	LWM2M_TRUST_KEY_STORE_PASSWORD	server_ks_password	Password to access the trust keystore.
transport.lwm2m.security.recommended_ciphers	LWM2M_RECOMMENDED_CIPHERS	false	Allow only recommended DTLS cipher suites.
transport.lwm2m.security.recommended_supported_groups	LWM2M_RECOMMENDED_SUPPORTED_GROUPS	true	Allow only recommended DTLS supported groups (curves).
transport.lwm2m.timeout	LWM2M_TIMEOUT	120000	LwM2M operation timeout in milliseconds.
transport.lwm2m.uplink_pool_size	LWM2M_UPLINK_POOL_SIZE	10	Thread pool size for LwM2M uplink processing.
transport.lwm2m.downlink_pool_size	LWM2M_DOWNLINK_POOL_SIZE	10	Thread pool size for LwM2M downlink processing.
transport.lwm2m.ota_pool_size	LWM2M_OTA_POOL_SIZE	10	Thread pool size for OTA update processing.
transport.lwm2m.clean_period_in_sec	LWM2M_CLEAN_PERIOD_IN_SEC	2	Period (s) for cleanup of stale registrations in the store.
transport.lwm2m.log_max_length	LWM2M_LOG_MAX_LENGTH	1024	Maximum LwM2M log message size.
transport.lwm2m.psm_activity_timer	LWM2M_PSM_ACTIVITY_TIMER	10000	Default PSM Activity Timer if not specified in the device profile.
transport.lwm2m.paging_transmission_window	LWM2M_PAGING_TRANSMISSION_WINDOW	10000	Default Paging Transmission Window for eDRX support if not specified in the device profile.

Default port: 161 UDP

Parameter	Env variable	Default	Description
transport.snmp.enabled	SNMP_ENABLED	true	Enable/disable the SNMP transport protocol.
transport.snmp.bind_port	SNMP_BIND_PORT	1620	SNMP bind port.
transport.snmp.response_processing.parallelism_level	SNMP_RESPONSE_PROCESSING_PARALLELISM_LEVEL	4	Parallelism level for the executor handling responses from SNMP devices.
transport.snmp.underlying_protocol	SNMP_UNDERLYING_PROTOCOL	udp	Transport protocol for SNMP: udp or tcp.
transport.snmp.max_request_oids	SNMP_MAX_REQUEST_OIDS	100	Maximum OID mappings per single SNMP request PDU. Larger requests are split into multiple PDUs.
transport.snmp.request_chunk_delay_ms	SNMP_REQUEST_CHUNK_DELAY_MS	100	Delay (ms) between sending each PDU chunk when a request is split.
transport.snmp.response.ignore_type_cast_errors	SNMP_RESPONSE_IGNORE_TYPE_CAST_ERRORS	false	Ignore type mismatch errors in SNMP response values.
transport.snmp.scheduler_thread_pool_size	SNMP_SCHEDULER_THREAD_POOL_SIZE	4	Thread pool size for the scheduler that executes device polling tasks.

Parameter	Env variable	Default	Description
transport.stats.enabled	TB_TRANSPORT_STATS_ENABLED	true	Enable/disable collection of transport statistics.
transport.stats.print-interval-ms	TB_TRANSPORT_STATS_PRINT_INTERVAL_MS	60000	Interval (ms) for logging transport statistics.

Parameter	Env variable	Default	Description
coap.enabled	COAP_SERVER_ENABLED	true	Enable/disable the CoAP server.
coap.bind_address	COAP_BIND_ADDRESS	0.0.0.0	CoAP server bind address.
coap.bind_port	COAP_BIND_PORT	5683	CoAP server bind port.
coap.dtls.enabled	COAP_DTLS_ENABLED	false	Enable/disable DTLS 1.2 support.
coap.dtls.retransmission_timeout	COAP_DTLS_RETRANSMISSION_TIMEOUT_MS	9000	DTLS retransmission timeout in milliseconds.
coap.dtls.bind_address	COAP_DTLS_BIND_ADDRESS	0.0.0.0	CoAP DTLS bind address.
coap.dtls.bind_port	COAP_DTLS_BIND_PORT	5684	CoAP DTLS bind port.
coap.dtls.connection_id_length	COAP_DTLS_CONNECTION_ID_LENGTH	(off)	DTLS Connection ID length (RFC 9146). Values: off, on, or a positive integer for CID size in bytes.
coap.dtls.credentials.type	COAP_DTLS_CREDENTIALS_TYPE	PEM	Server credentials type: PEM or KEYSTORE.
coap.dtls.credentials.pem.cert_file	COAP_DTLS_PEM_CERT	coapserver.pem	Path to the server certificate (or chain) file.
coap.dtls.credentials.pem.key_file	COAP_DTLS_PEM_KEY	coapserver_key.pem	Path to the server private key file. Required if not included in the cert file.
coap.dtls.credentials.pem.key_password	COAP_DTLS_PEM_KEY_PASSWORD	server_key_password	Server private key password (optional).
coap.dtls.credentials.keystore.type	COAP_DTLS_KEY_STORE_TYPE	JKS	Keystore type: JKS or PKCS12.
coap.dtls.credentials.keystore.store_file	COAP_DTLS_KEY_STORE	coapserver.jks	Path to the keystore holding the SSL certificate.
coap.dtls.credentials.keystore.store_password	COAP_DTLS_KEY_STORE_PASSWORD	server_ks_password	Password to access the keystore.
coap.dtls.credentials.keystore.key_alias	COAP_DTLS_KEY_ALIAS	serveralias	Key alias in the keystore.
coap.dtls.credentials.keystore.key_password	COAP_DTLS_KEY_PASSWORD	server_key_password	Password to access the private key.
coap.dtls.x509.skip_validity_check_for_client_cert	TB_COAP_X509_DTLS_SKIP_VALIDITY_CHECK_FOR_CLIENT_CERT	false	Skip certificate validity check for client certificates.
coap.dtls.x509.dtls_session_inactivity_timeout	TB_COAP_X509_DTLS_SESSION_INACTIVITY_TIMEOUT	86400000	DTLS session inactivity timeout (ms). Used to clean up the session cache.
coap.dtls.x509.dtls_session_report_timeout	TB_COAP_X509_DTLS_SESSION_REPORT_TIMEOUT	1800000	Interval (ms) for periodic eviction of timed-out DTLS sessions.

Controls which connectivity endpoints are advertised in the Check connectivity widget on the device page.

Parameter	Env variable	Default	Description
device.connectivity.http.enabled	DEVICE_CONNECTIVITY_HTTP_ENABLED	true	Include HTTP curl command in connectivity check.
device.connectivity.http.host	DEVICE_CONNECTIVITY_HTTP_HOST	(base URL)	HTTP transport host. Defaults to the base URL if empty.
device.connectivity.http.port	DEVICE_CONNECTIVITY_HTTP_PORT	8080	HTTP transport port.
device.connectivity.https.enabled	DEVICE_CONNECTIVITY_HTTPS_ENABLED	false	Include HTTPS curl command in connectivity check.
device.connectivity.https.host	DEVICE_CONNECTIVITY_HTTPS_HOST	(base URL)	HTTPS transport host. Defaults to the base URL if empty.
device.connectivity.https.port	DEVICE_CONNECTIVITY_HTTPS_PORT	443	HTTPS transport port.
device.connectivity.mqtt.enabled	DEVICE_CONNECTIVITY_MQTT_ENABLED	true	Include MQTT mosquitto command in connectivity check.
device.connectivity.mqtt.host	DEVICE_CONNECTIVITY_MQTT_HOST	(base URL)	MQTT transport host. Defaults to the base URL host if empty.
device.connectivity.mqtt.port	DEVICE_CONNECTIVITY_MQTT_PORT	1883	MQTT transport port.
device.connectivity.mqtts.enabled	DEVICE_CONNECTIVITY_MQTTS_ENABLED	false	Include MQTTS mosquitto command in connectivity check.
device.connectivity.mqtts.host	DEVICE_CONNECTIVITY_MQTTS_HOST	(base URL)	MQTTS transport host. Defaults to the base URL host if empty.
device.connectivity.mqtts.port	DEVICE_CONNECTIVITY_MQTTS_PORT	8883	MQTTS transport port.
device.connectivity.mqtts.pem_cert_file	DEVICE_CONNECTIVITY_MQTTS_CA_ROOT_CERT	cafile.pem	Path to the MQTT CA root certificate file.
device.connectivity.coap.enabled	DEVICE_CONNECTIVITY_COAP_ENABLED	true	Include CoAP command in connectivity check.
device.connectivity.coap.host	DEVICE_CONNECTIVITY_COAP_HOST	(base URL)	CoAP transport host. Defaults to the base URL host if empty.
device.connectivity.coap.port	DEVICE_CONNECTIVITY_COAP_PORT	5683	CoAP transport port.
device.connectivity.coaps.enabled	DEVICE_CONNECTIVITY_COAPS_ENABLED	false	Include CoAPs command in connectivity check.
device.connectivity.coaps.host	DEVICE_CONNECTIVITY_COAPS_HOST	(base URL)	CoAPs transport host. Defaults to the base URL host if empty.
device.connectivity.coaps.port	DEVICE_CONNECTIVITY_COAPS_PORT	5684	CoAPs transport port.