Connecting to brokers

Tell me where to knock.

— Marshall

Brokers you add are saved as cards on the first screen. Starred ones come first. Each open broker gets its own tab, so you can keep several open; Broker › Open another broker (⌘ N) adds one.

Kafka

Field	Notes
Name	How the card and tab are labeled
Bootstrap servers	host:port, comma-separated for more than one

How he gets in

Choice	Means
None	Plain connection, no credentials
TLS	Encrypted, but the broker does not ask who you are
SASL	You prove who you are, but the connection is in the clear
SASL + TLS	Encrypted, and you say who you are. What managed clusters almost always want
mTLS	Your client certificate proves who you are

• SASL mechanisms: PLAIN, SCRAM-SHA-256 and SCRAM-SHA-512, with a user and password.
• Certificate authority: Use the Mac's trust store, which is right for a managed cluster, or choose a PEM file for a private CA.
• mTLS: choose your certificate and its private key as PEM files.

Passwords go to your Keychain, never to a file. When you edit a broker, leaving the password blank keeps the one already saved.

Schema Registry

To decode Avro, add the registry's URL, and its user and password if it asks for them. It must be Confluent-compatible. Leave it blank if the cluster has none. See Avro and the Schema Registry.

RabbitMQ

Marshall talks to RabbitMQ through its management API, so the management plugin has to be enabled.

Field	Notes
Management API	The management URL. Its port is 15672 by default, not AMQP's 5672
User, Password	A management user
Virtual host	Optional

Reading a RabbitMQ message has a cost; see RabbitMQ.

Knock first

Test connection checks that somebody is home before you save. Nothing is read in this step. It reports what answered (It answered. One topic.), or that nobody did, without drawing conclusions.

On the card

Each card says how the broker is secured: encrypted, wants a password (kept in your Keychain), wants a certificate, or no password at all. Edit this broker and Forget this broker are in its menu.