The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →The shortest repeatable way to self-host EMQX on a VPS is to run the official Docker image on a supported Linux server, persist /opt/emqx/data and /opt/emqx/log, assign a permanent node name such as [email protected], and expose only the listeners your clients need. For Internet-facing devices, use TLS, authentication, authorization rules, and a restricted Dashboard before allowing production traffic.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
This guide covers a single-node deployment, firewall design, first login, encrypted MQTT and WebSocket listeners, backups, upgrades, troubleshooting, and the operational choices that matter when a broker is carrying real telemetry or game-device traffic.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
What you need before installing EMQX
Prepare the VPS and its identity before starting the container. Changing fundamental settings after clients and data are attached is more disruptive than choosing them correctly at the beginning.
A supported Linux VPS
Use a Linux VPS with Docker support, a static public IP, a fully qualified domain name (FQDN), and enough disk for retained messages, rule-engine data, logs, and backups. EMQX also supports package installation on a computer or virtual machine running Ubuntu, Debian, Rocky Linux or RHEL, and Amazon Linux. Docker is the most repeatable path for a fresh single node because the broker, version, and runtime are defined together.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
There is no universal CPU, memory, or disk recommendation that fits every deployment. Capacity depends on concurrent clients, connection churn, message rate, payload size, retained messages, rules, integrations, and logging. Start with a monitored VPS rather than treating a published “minimum” as a production guarantee, then increase resources when CPU saturation, memory pressure, disk latency, or file-descriptor exhaustion appears.
Stable DNS and node naming
Choose the final hostname first, for example broker.example.com, and make its DNS record resolve to the VPS. EMQX’s node name should use the form emqx@<host>. A stable name is not cosmetic: changing it later can cause data loss, so do not start with a temporary hostname if the node will become permanent.
Locale, limits, and free ports
- Use a UTF-8 locale on the Linux host.
- Confirm that the required TCP ports are not already occupied.
- Set file-descriptor and service limits for the expected connection count; the default limit on a small VPS may be too low for a busy broker.
- Reserve space for backups outside the container’s writable layer.
Choose the listeners and firewall policy
Expose only the protocols your clients actually use. The following are EMQX’s standard listener roles for a single node.
| Port | Protocol and purpose | Internet exposure |
|---|---|---|
| 1883/TCP | MQTT over unencrypted TCP | Keep internal or use only during a controlled migration; do not use for credentials or telemetry across an untrusted network. |
| 8883/TCP | MQTT over SSL/TLS | Preferred MQTT port for public or otherwise untrusted networks. |
| 8083/TCP | MQTT over WebSocket | Use only when browser or WebSocket clients require it; traffic is not encrypted by this listener alone. |
| 8084/TCP | MQTT over secure WebSocket (WSS) | Preferred WebSocket listener for Internet clients. |
| 18083/TCP | HTTP Dashboard and REST API | Restrict to an administrator IP range, VPN, or private network. Do not broadly publish it. |
| 4370/TCP | Erlang distribution | Internal cluster/control traffic only. |
| 5370/TCP and offsets | Cluster RPC | Internal cluster/control traffic only. |
Use both the VPS provider’s security group and the host firewall. A typical public policy permits 22/TCP only from an administration network, 8883/TCP from MQTT clients, 8084/TCP from WebSocket clients, and 18083/TCP only from a VPN or fixed administrator address. Omit 1883, 8083, 4370, and 5370 from public rules unless a narrowly defined private network requires them.
Install EMQX with Docker
1. Create persistent directories
Persistent mounts keep broker state and crash evidence when the container is recreated. Create the directories on the VPS and make them writable by the container’s emqx user, UID 1000.
sudo mkdir -p /opt/emqx/data /opt/emqx/log
sudo chown -R 1000:1000 /opt/emqx/data /opt/emqx/logAt minimum, the log directory must be writable by UID 1000. Keeping both directories owned by that UID avoids permission failures when EMQX writes state, logs, or crash dumps.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems2. Run a deliberately pinned image
The following is a representative single-node command using the official Enterprise image tag 6.3.1. Image tags are time-sensitive; check the current EMQX release and deliberately choose the version you intend to operate rather than silently tracking a moving tag.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
docker run -d
--name emqx
--hostname broker.example.com
--restart unless-stopped
-e [email protected]
-p 1883:1883
-p 8883:8883
-p 8083:8083
-p 8084:8084
-p 18083:18083
-v /opt/emqx/data:/opt/emqx/data
-v /opt/emqx/log:/opt/emqx/log
emqx/emqx-enterprise:6.3.1Replace the hostname and node name with the FQDN you selected. If you do not need plaintext MQTT or ordinary WebSocket connections, remove the 1883 and 8083 mappings instead of exposing listeners that clients should not use. The mapping does not by itself configure certificates or authentication; those are separate steps.
3. Confirm startup and mounts
docker ps --filter name=emqx
docker logs --tail 100 emqx
docker inspect emqxThe container should remain in an Up state, and the inspect output should show the two host mounts. Logs should not contain permission errors, a node-name mismatch, or a port-bind failure. Resolve those errors before opening the VPS firewall.
Secure the host before accepting clients
Apply network rules in two layers
Configure the provider security group first, then mirror the policy in the VPS firewall (for example, nftables, UFW, or firewalld). Permit management access only from trusted administrator addresses. Permit 8883 and/or 8084 from the networks that actually contain clients. Keep 18083 closed to the public Internet whenever possible.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchDo not open Erlang distribution port 4370 or cluster RPC port 5370 to arbitrary addresses. Those ports support internal broker control and clustering; public exposure creates an unnecessary attack surface. If you later build a cluster, allow these ports only between the specific node addresses and account for their documented offsets.
Check reachability from the right networks
Test each port from an allowed network and from a deliberately disallowed network. A port that is closed from your laptop may be correctly restricted, while a port that is open from everywhere may violate your intended policy. Record the expected source ranges so a future firewall change can be reviewed against a known baseline.
Complete the first Dashboard login
The quick-start Dashboard is available at http://<host>:18083/. The documented initial credentials are username admin and password public. Treat them as bootstrap credentials only.
- Open the Dashboard from the administrator network or VPN you allowed.
- Sign in with the initial account.
- Change the password immediately to a unique, high-entropy value.
- Restrict port 18083 at the firewall if it was temporarily open.
- Confirm that the displayed node name matches the permanent FQDN-based name.
- Review listener status before connecting any production device.
Never leave the default password in place and never use the quick-start exposure as a permanent management design. If the Dashboard must be reachable remotely, put it behind a restricted network path rather than relying on obscurity.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Require authentication and authorization
EMQX allows all clients to connect when authentication is not enabled. That default is useful for a local smoke test but unsafe on a public VPS. Configure an authentication source and authorization rules before opening MQTT to real devices.
Authentication identifies the client
Choose the identity system that matches your fleet: a managed credential store, an external authentication service, or client certificates. Give each device or service its own identity where possible so one compromised credential can be revoked without replacing every client credential. Avoid sharing a single username and password among an entire fleet.
Authorization limits topics
Authentication answers “who is connecting”; authorization or ACL rules answer “what may that identity publish or subscribe to.” Define topic namespaces before writing rules. For example, separate device telemetry, commands, retained configuration, and administrative topics. Grant the narrowest publish and subscribe rights needed for each role, and explicitly test that a client cannot read another tenant’s topics or publish into command paths it should not control.
Verify rejection, not just success
- Connect with a valid test identity and confirm it can perform only its assigned operations.
- Attempt a connection with an invalid password and confirm the broker rejects it.
- Attempt a forbidden publish and subscribe operation and confirm the ACL denies it.
- Review broker logs for both successful and rejected attempts.
Perform these tests before deployment and after changes to authentication, ACLs, listener settings, or external identity services.
Enable TLS for MQTT and WebSocket traffic
Use TLS whenever traffic crosses an untrusted network. Configure 8883 for MQTT over TLS and 8084 for secure WebSockets. Obtain a certificate from a trusted certificate authority or your controlled internal PKI, install the certificate and private key according to the EMQX version’s listener configuration, and distribute the required trust chain to clients.
Certificate and protocol requirements
- Use a certificate whose name matches the hostname clients use.
- Disable legacy protocol versions and weak cipher suites according to your organization’s security baseline.
- Renew certificates before expiry and verify the complete chain from a real client, not just from the broker host.
- Protect the private key with filesystem permissions and avoid placing it in an image layer.
When mutual TLS is appropriate
Use mutual TLS when the client certificate itself must establish identity. EMQX requires peer verification and a trusted CA bundle for certificate-to-username or certificate-to-client-ID mapping. A server certificate alone encrypts the connection; it does not prove which device is connecting.
Keep 1883 and 8083 disabled or private after TLS testing succeeds. If a transitional plaintext listener is unavoidable, restrict it to an internal network, document its removal date, and do not send reusable credentials over it.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Validate a complete MQTT path
Validation should cover DNS, transport, identity, permissions, messages, and observability rather than stopping at “the container started.”
- Resolve the VPS FQDN from a client network and verify it returns the intended public IP.
- Check that the node name uses the same host identity selected during installation.
- Connect a test client to 8883 with certificate validation enabled, or to 8084 for WSS.
- Authenticate with the test identity and confirm the expected ACL.
- Publish a small test message to a dedicated test topic.
- Subscribe with an authorized client and verify delivery.
- Repeat with an unauthorized identity and confirm rejection or denial.
- Inspect Dashboard status and container logs for connection, TLS, and authorization events.
Do not treat a successful connection to 1883 as proof that production security is correct; it proves only that an unencrypted listener is reachable.
Backups, upgrades, and recovery
Back up the data directory
Back up /opt/emqx/data periodically for production safety, excluding the trace folder. Store backups outside the VPS or on a separate failure domain, protect them as sensitive data, and record the EMQX version and configuration associated with each backup.
A backup is not a recovery plan until it has been restored. Use a staging VPS to practice replacing the container, restoring the data directory, checking ownership, and validating client connections. Keep a written runbook that includes DNS changes, firewall rules, certificate locations, secrets, image version, and the order in which services are started. A restore test should be scheduled and documented; do not assume that an untested archive is usable.
Free tools Windows power users keep installed
One-click scans. No signup required.
Upgrade deliberately
- Read the release notes for the target EMQX version and check compatibility with your authentication sources, integrations, and clients.
- Take a fresh data backup, excluding
trace. - Record the current image tag and container configuration.
- Pull the selected replacement image and stop the old container during the maintenance window.
- Recreate the container with the same node name and persistent mounts.
- Check logs, listener status, authentication, ACLs, and a publish/subscribe test before declaring the upgrade complete.
Never change the node name as part of an upgrade. Preserve the data and log mounts so a container replacement does not erase node state or crash evidence.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Docker versus package installation
Docker is the fastest documented starting point, but it is not the only supported deployment model. Choose the model that fits your operational tooling.
| Deployment model | Strengths | Responsibilities |
|---|---|---|
| Official Docker image | Repeatable image version, simple replacement, explicit volume mounts, and an easy single-node run command. | Maintain Docker, container configuration, host firewall, volume ownership, image updates, and backups. |
| Linux package on a VM or VPS | Integrates with the host’s service manager and package lifecycle; suitable when your team standardizes on native services. | Manage repository packages, service limits, filesystem paths, upgrades, and rollback procedures on the host. |
Both models still require the same node-name discipline, listener policy, TLS, authentication, ACLs, firewall restrictions, monitoring, and backups. Changing installation method does not remove those responsibilities.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Operational checks after launch
- Monitor container or service uptime, restart counts, CPU, memory, disk usage, and disk latency.
- Watch connection counts, rejected authentications, authorization denials, and TLS failures.
- Alert before certificates expire and before the data filesystem fills.
- Rotate credentials and certificates on a documented schedule.
- Keep the Dashboard restricted and review administrative accounts periodically.
- Confirm backup jobs complete and that old backups can be read.
- Review file-descriptor limits as client count and connection churn increase.
Resource planning must follow observed workload. Message rates, payload sizes, retained data, rules, integrations, and client count can change the correct VPS size substantially, so measure these dimensions rather than selecting hardware from a generic connection number.
Troubleshooting common failures
The container exits immediately
Run docker logs emqx and inspect the exit reason. Port-bind errors mean another process is using a published port; permission errors usually indicate incorrect ownership on a mounted directory; node-name errors indicate that the configured host identity does not match the intended stable name. Correct the cause, remove and recreate the container with the same persistent mounts, and check the logs again.
The Dashboard cannot be reached
Confirm the container is running, port 18083 is published, the provider security group and host firewall allow your administrator address, and the browser is using the correct FQDN or IP. If MQTT works but the Dashboard does not, check the firewall and port mapping rather than changing MQTT listener settings.
TLS clients report certificate errors
Verify that the client hostname matches the certificate, the full trusted chain is installed, the client clock is correct, and the broker is serving the intended certificate. A successful TCP connection to 8883 does not prove certificate validation succeeded.
Clients connect but cannot publish or subscribe
Separate authentication from authorization in your diagnosis. An accepted connection with denied operations usually indicates an ACL or topic-pattern problem. Test the exact topic, operation, and identity, then inspect authorization logs.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Data or logs disappear after recreation
Check docker inspect emqx for both host mounts. Without the data mount, node state is inside the disposable container; without the log mount, file logs and crash evidence are lost when the container is replaced. Also verify that UID 1000 can write to the mounted paths.
Production launch checklist
- DNS resolves to the VPS, and the permanent node name is
emqx@<host>. - The selected image version is pinned deliberately and recorded.
/opt/emqx/dataand/opt/emqx/logare persistent, writable mounts.- Only required listener ports are exposed.
- 1883 and 8083 are private or disabled unless a documented transitional need exists.
- 8883 or 8084 is configured with a trusted certificate and modern TLS settings.
- Authentication and ACL rules are active and tested with both permitted and denied operations.
- The default Dashboard password has been replaced, and port 18083 is restricted.
- Cluster/control ports 4370 and 5370 are not publicly reachable.
- Data backups exclude
trace, are stored separately, and have a tested restore procedure. - File-descriptor limits, disk capacity, certificates, logs, and rejected connections are monitored.
A single-node EMQX VPS is straightforward to run when identity, persistence, network exposure, and security are decided before clients arrive. Docker supplies the repeatable packaging; the reliability of the service comes from the surrounding hostname, firewall, TLS, access controls, backups, and recovery discipline.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
