Onboarding failing: rejected MQTT CONNECT reason=invalid_mqtt_credentials

[EnumC]

Hi! I'm attempting to onboard a G30 U. The onboarding script worked and the dashboard shows the public key has been derived, but the script is stuck in a loop at:

Status for G30 U: samples=8, public_key=True, connected=False, state=ready
Public key is ready. Run one more pairing cycle so the vacuum connects.
The public key is ready. Do one final pairing cycle to finish the connection.

Reset the vacuum Wi-Fi, connect this machine to the vacuum Wi-Fi, then press Enter to send onboarding.
Type 'reselect' to choose another vacuum or 'quit' to exit.

The only warning/error in the log is: rejected MQTT CONNECT reason=invalid_mqtt_credentials.
How can I troubleshoot this issue?

Dashboard json:

[
  {
    "duid": "<redacted>",
    "did": "",
    "id_kind": "duid",
    "name": "G30 U",
    "local_key": "<redacted>",
    "source": "",
    "key_model": "roborock.vacuum.a231",
    "ips": [
      "192.168.x.x"
    ],
    "connected": false,
    "last_ip": "192.168.x.x",
    "last_http_at": "<redacted>",
    "last_http_route": "nc_prepare",
    "last_http_path": "/nc",
    "last_http_remote": "192.168.<redacted>:40454",
    "last_http_host": "api-roborock.<redacted>.com:555",
    "last_mqtt_at": "",
    "last_mqtt_topic": "",
    "last_mqtt_direction": "",
    "last_mqtt_payload_preview": "",
    "last_disconnect_at": "",
    "last_message_at": "<redacted>",
    "last_message_source": "http",
    "onboarding_steps": {
      "region": "<redacted>",
      "nc_prepare": "<redacted>"
    },
    "onboarding": {
      "required_steps": [
        "region",
        "nc_prepare"
      ],
      "step_labels": {
        "region": "Region",
        "nc_prepare": "NC Prepare",
        "login_key_sign": "Key Sign"
      },
      "missing_steps": [],
      "has_required_messages": true,
      "has_public_key": true,
      "public_key_ready": true,
      "status": "ready",
      "guidance": "Required onboarding messages captured and public key is available.",
      "key_state": {
        "query_samples": 10,
        "header_samples": 0,
        "max_signature_len": 256,
        "has_modulus": true,
        "recovery_state": "recovered",
        "recovery_note": "Public key is available.",
        "recovery_error": "",
        "recovery_started_at": "<redacted>",
        "recovery_finished_at": "<redacted>"
      }
    },
    "model": "roborock.vacuum.a231",
    "product_id": "<redacted>",
    "inventory_source": "devices",
    "linked_inventory_duid": "<redacted>",
    "linked_inventory_name": "G30 U",
    "linked_via": "model_pid"
  }
]

config.toml:

[network]
stack_fqdn = "api-<redacted>.com"
bind_host = "0.0.0.0"
https_port = 555
mqtt_tls_port = 8881
region = "us"

[broker]
mode = "embedded"
host = "127.0.0.1"
port = 18830
mosquitto_binary = "mosquitto"
enable_topic_bridge = true

[storage]
data_dir = "/data"

[tls]
mode = "cloudflare_acme"
base_domain = "<redacted>"
email = "<redacted>"
cloudflare_token_file = "/run/secrets/cloudflare_token"
renew_days_before = 30
renew_check_seconds = 43200
acme_server = "zerossl"

[admin]
password_hash = "<redacted>"
session_secret = "<redacted>"
session_ttl_seconds = 86400
protocol_auth_enabled = true
protocol_login_email = "<redacted>"
protocol_login_pin_hash = "<redacted>"

Docker log:

roborock-local-server  | 2026-04-21 01:58:05,355 [INFO] [real_stack.mqtt] [mosquitto] 1776736685: mosquitto version 2.0.21 starting
roborock-local-server  | 2026-04-21 01:58:05,355 [INFO] [real_stack.mqtt] [mosquitto] 1776736685: Config loaded from /data/state/mqtt_broker/mosquitto.conf.
roborock-local-server  | 2026-04-21 01:58:05,355 [INFO] [real_stack.mqtt] [mosquitto] 1776736685: Opening ipv4 listen socket on port 18830.
roborock-local-server  | 2026-04-21 01:58:05,355 [INFO] [real_stack.mqtt] [mosquitto] 1776736685: mosquitto version 2.0.21 running
roborock-local-server  | 2026-04-21 01:58:05,453 [INFO] [real_stack.mqtt] Mosquitto ready on 0.0.0.0:18830 using /usr/sbin/mosquitto
roborock-local-server  | 2026-04-21 01:58:05,453 [INFO] [real_stack.mqtt] [mosquitto] 1776736685: New connection from 127.0.0.1:45130 on port 18830.
roborock-local-server  | 2026-04-21 01:58:05,453 [INFO] [real_stack.mqtt] [mosquitto] 1776736685: Client <unknown> closed its connection.
roborock-local-server  | 2026-04-21 01:58:05,476 [INFO] [real_stack.mqtt] [mosquitto] 1776736685: New connection from 127.0.0.1:46257 on port 18830.
roborock-local-server  | 2026-04-21 01:58:05,486 [INFO] [real_stack.mqtt] [mosquitto] 1776736685: New client connected from 127.0.0.1:46257 as auto-C4406954-B36E-0180-0D7C-E61F83453BC6 (p2, c1, k60).
roborock-local-server  | 2026-04-21 01:58:05,487 [INFO] [real_stack.mqtt] MQTT topic bridge connected (127.0.0.1:18830), subscribed to rr/m/i/# and rr/d/i/#
roborock-local-server  | 2026-04-21 01:58:05,506 [INFO] HTTPS server listening on 0.0.0.0:555
roborock-local-server  | 2026-04-21 01:58:05,506 [INFO] MQTT TLS proxy listening on 0.0.0.0:8881
roborock-local-server  | 2026-04-21 01:58:05,506 [INFO] MQTT backend embedded on 127.0.0.1:18830
roborock-local-server  | 2026-04-21 01:58:05,507 [INFO] [real_stack.mqtt] TLS MQTT proxy listening on 0.0.0.0:8881 -> 127.0.0.1:18830
roborock-local-server  | 2026-04-21 01:59:59,794 [INFO] [real_stack.api] GET /favicon.ico host=api-roborock.example.com:555 route=catchall body_sha256=<redacted>
roborock-local-server  | 2026-04-21 02:22:32,473 [INFO] [real_stack.api] GET / host=api-roborock.example.com:555 route=region body_sha256=<redacted>
roborock-local-server  | 2026-04-21 02:24:51,867 [INFO] [real_stack.api] GET /apple-touch-icon-precomposed.png host=api-roborock.example.com:555 route=catchall body_sha256=<redacted>
roborock-local-server  | 2026-04-21 02:24:51,882 [INFO] [real_stack.api] GET /favicon.ico host=api-roborock.example.com:555 route=catchall body_sha256=<redacted>
roborock-local-server  | 2026-04-21 02:24:51,883 [INFO] [real_stack.api] GET /apple-touch-icon.png host=api-roborock.example.com:555 route=catchall body_sha256=<redacted>
roborock-local-server  | 2026-04-21 02:24:52,044 [INFO] [real_stack.api] GET /apple-touch-icon-precomposed.png host=api-roborock.example.com:555 route=catchall body_sha256=<redacted>
roborock-local-server  | 2026-04-21 02:24:52,045 [INFO] [real_stack.api] GET /apple-touch-icon.png host=api-roborock.example.com:555 route=catchall body_sha256=<redacted>
roborock-local-server  | 2026-04-21 02:24:52,045 [INFO] [real_stack.api] GET /favicon.ico host=api-roborock.example.com:555 route=catchall body_sha256=<redacted>
roborock-local-server  | 2026-04-21 02:24:52,213 [INFO] [real_stack.api] GET /apple-touch-icon-precomposed.png host=api-roborock.example.com:555 route=catchall body_sha256=<redacted>
roborock-local-server  | 2026-04-21 02:24:52,214 [INFO] [real_stack.api] GET /apple-touch-icon.png host=api-roborock.example.com:555 route=catchall body_sha256=<redacted>
roborock-local-server  | 2026-04-21 02:24:52,214 [INFO] [real_stack.api] GET /favicon.ico host=api-roborock.example.com:555 route=catchall body_sha256=<redacted>
roborock-local-server  | 2026-04-21 02:24:56,348 [INFO] [real_stack.api] GET /favicon.ico host=api-roborock.example.com:555 route=catchall body_sha256=<redacted>
roborock-local-server  | 2026-04-21 03:48:35,678 [INFO] [real_stack.api] GET /apple-touch-icon.png host=api-roborock.example.com:555 route=catchall body_sha256=<redacted>
roborock-local-server  | 2026-04-21 03:48:35,696 [INFO] [real_stack.api] GET /apple-touch-icon-precomposed.png host=api-roborock.example.com:555 route=catchall body_sha256=<redacted>
roborock-local-server  | 2026-04-21 03:48:35,699 [INFO] [real_stack.api] GET /favicon.ico host=api-roborock.example.com:555 route=catchall body_sha256=<redacted>
roborock-local-server  | 2026-04-21 03:48:35,700 [INFO] [real_stack.api] GET /apple-touch-icon.png host=api-roborock.example.com:555 route=catchall body_sha256=<redacted>
roborock-local-server  | 2026-04-21 03:48:35,701 [INFO] [real_stack.api] GET /favicon.ico host=api-roborock.example.com:555 route=catchall body_sha256=<redacted>
roborock-local-server  | 2026-04-21 03:56:26,276 [INFO] [real_stack.api] GET /region host=api-roborock.example.com:555 route=region body_sha256=<redacted>
roborock-local-server  | 2026-04-21 04:01:41,014 [INFO] [real_stack.api] GET /region host=api-roborock.example.com:555 route=region body_sha256=<redacted>
roborock-local-server  | 2026-04-21 04:07:47,340 [INFO] [real_stack.api] GET /region host=api-roborock.example.com:555 route=region body_sha256=<redacted>
roborock-local-server  | 2026-04-21 04:07:47,450 [INFO] [real_stack.api] POST /nc host=api-roborock.example.com:555 route=nc_prepare body_sha256=<redacted>
roborock-local-server  | 2026-04-21 04:07:47,620 [INFO] [real_stack.mqtt] TLS handshake ok from 192.168.x.x:58556 (TLSv1.3)
roborock-local-server  | 2026-04-21 04:07:47,621 [INFO] [real_stack.mqtt] [conn 1] backend connect 127.0.0.1:18830 from 192.168.x.x:58556
roborock-local-server  | 2026-04-21 04:07:47,622 [WARNING] [real_stack.mqtt] [conn 1] rejected MQTT CONNECT reason=invalid_mqtt_credentials client_id=<redacted> username=<redacted>
roborock-local-server  | 2026-04-21 04:07:47,622 [INFO] [real_stack.mqtt] [conn 1 c2b] CONNECT len=82 hex=<redacted>
roborock-local-server  | 2026-04-21 04:07:47,623 [INFO] [real_stack.mqtt] [conn 1 c2b] CONNECT protocol_level=4
roborock-local-server  | 2026-04-21 04:07:47,623 [INFO] [real_stack.mqtt] [conn 1 b2c] CONNACK len=4 hex=20020005
roborock-local-server  | 2026-04-21 04:07:47,623 [INFO] [real_stack.mqtt] [conn 1] closed
roborock-local-server  | 2026-04-21 04:07:49,822 [INFO] [real_stack.mqtt] TLS handshake ok from 192.168.x.x:47332 (TLSv1.3)
roborock-local-server  | 2026-04-21 04:07:49,823 [INFO] [real_stack.mqtt] [conn 2] backend connect 127.0.0.1:18830 from 192.168.x.x:47332
roborock-local-server  | 2026-04-21 04:07:49,824 [WARNING] [real_stack.mqtt] [conn 2] rejected MQTT CONNECT reason=invalid_mqtt_credentials client_id=<redacted> username=<redacted>
roborock-local-server  | 2026-04-21 04:07:49,824 [INFO] [real_stack.mqtt] [conn 2 c2b] CONNECT len=82 hex=<redacted>
roborock-local-server  | 2026-04-21 04:07:49,824 [INFO] [real_stack.mqtt] [conn 2 c2b] CONNECT protocol_level=4
roborock-local-server  | 2026-04-21 04:07:49,824 [INFO] [real_stack.mqtt] [conn 2 b2c] CONNACK len=4 hex=20020005
roborock-local-server  | 2026-04-21 04:07:49,825 [INFO] [real_stack.mqtt] [conn 2] closed
roborock-local-server  | 2026-04-21 04:07:58,030 [INFO] [real_stack.mqtt] TLS handshake ok from 192.168.x.x:57662 (TLSv1.3)
roborock-local-server  | 2026-04-21 04:07:58,031 [INFO] [real_stack.mqtt] [conn 3] backend connect 127.0.0.1:18830 from 192.168.x.x:57662
roborock-local-server  | 2026-04-21 04:07:58,042 [WARNING] [real_stack.mqtt] [conn 3] rejected MQTT CONNECT reason=invalid_mqtt_credentials client_id=<redacted> username=<redacted>
roborock-local-server  | 2026-04-21 04:07:58,042 [INFO] [real_stack.mqtt] [conn 3 c2b] CONNECT len=82 hex=<redacted>
roborock-local-server  | 2026-04-21 04:07:58,042 [INFO] [real_stack.mqtt] [conn 3 c2b] CONNECT protocol_level=4
roborock-local-server  | 2026-04-21 04:07:58,042 [INFO] [real_stack.mqtt] [conn 3 b2c] CONNACK len=4 hex=20020005
roborock-local-server  | 2026-04-21 04:07:58,042 [INFO] [real_stack.mqtt] [conn 3] closed
roborock-local-server  | 2026-04-21 04:08:16,254 [INFO] [real_stack.mqtt] TLS handshake ok from 192.168.x.x:56476 (TLSv1.3)
roborock-local-server  | 2026-04-21 04:08:16,254 [INFO] [real_stack.mqtt] [conn 4] backend connect 127.0.0.1:18830 from 192.168.x.x:56476
roborock-local-server  | 2026-04-21 04:08:16,269 [WARNING] [real_stack.mqtt] [conn 4] rejected MQTT CONNECT reason=invalid_mqtt_credentials client_id=<redacted> username=<redacted>
roborock-local-server  | 2026-04-21 04:08:16,269 [INFO] [real_stack.mqtt] [conn 4 c2b] CONNECT len=82 hex=<redacted>
roborock-local-server  | 2026-04-21 04:08:16,270 [INFO] [real_stack.mqtt] [conn 4] closed
roborock-local-server  | 2026-04-21 04:08:16,270 [INFO] [real_stack.mqtt] [conn 4 c2b] CONNECT protocol_level=4
roborock-local-server  | 2026-04-21 04:08:16,270 [INFO] [real_stack.mqtt] [conn 4 b2c] CONNACK len=4 hex=20020005
roborock-local-server  | 2026-04-21 04:08:48,503 [INFO] [real_stack.mqtt] TLS handshake ok from 192.168.x.x:52338 (TLSv1.3)
roborock-local-server  | 2026-04-21 04:08:48,503 [INFO] [real_stack.mqtt] [conn 5] backend connect 127.0.0.1:18830 from 192.168.x.x:52338
roborock-local-server  | 2026-04-21 04:08:48,505 [WARNING] [real_stack.mqtt] [conn 5] rejected MQTT CONNECT reason=invalid_mqtt_credentials client_id=<redacted> username=<redacted>
roborock-local-server  | 2026-04-21 04:08:48,505 [INFO] [real_stack.mqtt] [conn 5 c2b] CONNECT len=82 hex=<redacted>
roborock-local-server  | 2026-04-21 04:08:48,505 [INFO] [real_stack.mqtt] [conn 5 c2b] CONNECT protocol_level=4
roborock-local-server  | 2026-04-21 04:08:48,505 [INFO] [real_stack.mqtt] [conn 5 b2c] CONNACK len=4 hex=20020005
roborock-local-server  | 2026-04-21 04:08:48,505 [INFO] [real_stack.mqtt] [conn 5] closed
roborock-local-server  | 2026-04-21 04:12:52,852 [INFO] [real_stack.api] GET /region host=api-roborock.example.com:555 route=region body_sha256=<redacted>
roborock-local-server  | 2026-04-21 04:12:52,973 [INFO] [real_stack.api] POST /nc host=api-roborock.example.com:555 route=nc_prepare body_sha256=<redacted>
roborock-local-server  | 2026-04-21 04:12:53,146 [INFO] [real_stack.mqtt] TLS handshake ok from 192.168.x.x:50110 (TLSv1.3)
roborock-local-server  | 2026-04-21 04:12:53,146 [INFO] [real_stack.mqtt] [conn 6] backend connect 127.0.0.1:18830 from 192.168.x.x:50110
roborock-local-server  | 2026-04-21 04:12:53,148 [WARNING] [real_stack.mqtt] [conn 6] rejected MQTT CONNECT reason=invalid_mqtt_credentials client_id=<redacted> username=<redacted>
roborock-local-server  | 2026-04-21 04:12:53,148 [INFO] [real_stack.mqtt] [conn 6] closed
roborock-local-server  | 2026-04-21 04:12:53,148 [INFO] [real_stack.mqtt] [conn 6 c2b] CONNECT len=82 hex=<redacted>
roborock-local-server  | 2026-04-21 04:12:53,148 [INFO] [real_stack.mqtt] [conn 6 c2b] CONNECT protocol_level=4
roborock-local-server  | 2026-04-21 04:12:53,148 [INFO] [real_stack.mqtt] [conn 6 b2c] CONNACK len=4 hex=20020005
roborock-local-server  | 2026-04-21 04:12:55,360 [INFO] [real_stack.mqtt] TLS handshake ok from 192.168.x.x:50122 (TLSv1.3)
roborock-local-server  | 2026-04-21 04:12:55,360 [INFO] [real_stack.mqtt] [conn 7] backend connect 127.0.0.1:18830 from 192.168.x.x:50122
roborock-local-server  | 2026-04-21 04:12:55,362 [WARNING] [real_stack.mqtt] [conn 7] rejected MQTT CONNECT reason=invalid_mqtt_credentials client_id=<redacted> username=<redacted>
roborock-local-server  | 2026-04-21 04:12:55,362 [INFO] [real_stack.mqtt] [conn 7 c2b] CONNECT len=82 hex=<redacted>
roborock-local-server  | 2026-04-21 04:12:55,362 [INFO] [real_stack.mqtt] [conn 7 c2b] CONNECT protocol_level=4
roborock-local-server  | 2026-04-21 04:12:55,362 [INFO] [real_stack.mqtt] [conn 7 b2c] CONNACK len=4 hex=20020005
roborock-local-server  | 2026-04-21 04:12:55,362 [INFO] [real_stack.mqtt] [conn 7] closed
roborock-local-server  | 2026-04-21 04:13:03,555 [INFO] [real_stack.mqtt] TLS handshake ok from 192.168.x.x:57790 (TLSv1.3)
roborock-local-server  | 2026-04-21 04:13:03,555 [INFO] [real_stack.mqtt] [conn 8] backend connect 127.0.0.1:18830 from 192.168.x.x:57790
roborock-local-server  | 2026-04-21 04:13:03,570 [WARNING] [real_stack.mqtt] [conn 8] rejected MQTT CONNECT reason=invalid_mqtt_credentials client_id=<redacted> username=<redacted>
roborock-local-server  | 2026-04-21 04:13:03,570 [INFO] [real_stack.mqtt] [conn 8 c2b] CONNECT len=82 hex=<redacted>
roborock-local-server  | 2026-04-21 04:13:03,570 [INFO] [real_stack.mqtt] [conn 8] closed
roborock-local-server  | 2026-04-21 04:13:03,570 [INFO] [real_stack.mqtt] [conn 8 c2b] CONNECT protocol_level=4
roborock-local-server  | 2026-04-21 04:13:03,570 [INFO] [real_stack.mqtt] [conn 8 b2c] CONNACK len=4 hex=20020005
roborock-local-server  | 2026-04-21 04:13:21,798 [INFO] [real_stack.mqtt] TLS handshake ok from 192.168.x.x:43128 (TLSv1.3)
roborock-local-server  | 2026-04-21 04:13:21,798 [INFO] [real_stack.mqtt] [conn 9] backend connect 127.0.0.1:18830 from 192.168.x.x:43128
roborock-local-server  | 2026-04-21 04:13:21,813 [WARNING] [real_stack.mqtt] [conn 9] rejected MQTT CONNECT reason=invalid_mqtt_credentials client_id=<redacted> username=<redacted>
roborock-local-server  | 2026-04-21 04:13:21,813 [INFO] [real_stack.mqtt] [conn 9 c2b] CONNECT len=82 hex=<redacted>
roborock-local-server  | 2026-04-21 04:13:21,814 [INFO] [real_stack.mqtt] [conn 9 c2b] CONNECT protocol_level=4
roborock-local-server  | 2026-04-21 04:13:21,814 [INFO] [real_stack.mqtt] [conn 9] closed
roborock-local-server  | 2026-04-21 04:13:21,814 [INFO] [real_stack.mqtt] [conn 9 b2c] CONNACK len=4 hex=20020005
roborock-local-server  | 2026-04-21 04:13:54,034 [INFO] [real_stack.mqtt] TLS handshake ok from 192.168.x.x:39776 (TLSv1.3)
roborock-local-server  | 2026-04-21 04:13:54,034 [INFO] [real_stack.mqtt] [conn 10] backend connect 127.0.0.1:18830 from 192.168.x.x:39776
roborock-local-server  | 2026-04-21 04:13:54,050 [WARNING] [real_stack.mqtt] [conn 10] rejected MQTT CONNECT reason=invalid_mqtt_credentials client_id=<redacted> username=<redacted>
roborock-local-server  | 2026-04-21 04:13:54,050 [INFO] [real_stack.mqtt] [conn 10 c2b] CONNECT len=82 hex=<redacted>
roborock-local-server  | 2026-04-21 04:13:54,051 [INFO] [real_stack.mqtt] [conn 10] closed
roborock-local-server  | 2026-04-21 04:13:54,051 [INFO] [real_stack.mqtt] [conn 10 c2b] CONNECT protocol_level=4
roborock-local-server  | 2026-04-21 04:13:54,051 [INFO] [real_stack.mqtt] [conn 10 b2c] CONNACK len=4 hex=20020005
roborock-local-server  | 2026-04-21 04:21:14,697 [INFO] [real_stack.api] GET /region host=api-roborock.example.com:555 route=region body_sha256=<redacted>
roborock-local-server  | 2026-04-21 04:21:14,802 [INFO] [real_stack.api] POST /nc host=api-roborock.example.com:555 route=nc_prepare body_sha256=<redacted>
roborock-local-server  | 2026-04-21 04:21:14,971 [INFO] [real_stack.mqtt] TLS handshake ok from 192.168.x.x:53332 (TLSv1.3)
roborock-local-server  | 2026-04-21 04:21:14,972 [INFO] [real_stack.mqtt] [conn 11] backend connect 127.0.0.1:18830 from 192.168.x.x:53332
roborock-local-server  | 2026-04-21 04:21:14,973 [WARNING] [real_stack.mqtt] [conn 11] rejected MQTT CONNECT reason=invalid_mqtt_credentials client_id=<redacted> username=<redacted>
roborock-local-server  | 2026-04-21 04:21:14,973 [INFO] [real_stack.mqtt] [conn 11 c2b] CONNECT len=82 hex=<redacted>
roborock-local-server  | 2026-04-21 04:21:14,974 [INFO] [real_stack.mqtt] [conn 11 c2b] CONNECT protocol_level=4
roborock-local-server  | 2026-04-21 04:21:14,974 [INFO] [real_stack.mqtt] [conn 11 b2c] CONNACK len=4 hex=20020005
roborock-local-server  | 2026-04-21 04:21:14,974 [INFO] [real_stack.mqtt] [conn 11] closed
roborock-local-server  | 2026-04-21 04:21:17,155 [INFO] [real_stack.mqtt] TLS handshake ok from 192.168.x.x:53344 (TLSv1.3)
roborock-local-server  | 2026-04-21 04:21:17,155 [INFO] [real_stack.mqtt] [conn 12] backend connect 127.0.0.1:18830 from 192.168.x.x:53344
roborock-local-server  | 2026-04-21 04:21:17,160 [WARNING] [real_stack.mqtt] [conn 12] rejected MQTT CONNECT reason=invalid_mqtt_credentials client_id=<redacted> username=<redacted>
roborock-local-server  | 2026-04-21 04:21:17,160 [INFO] [real_stack.mqtt] [conn 12 c2b] CONNECT len=82 hex=<redacted>
roborock-local-server  | 2026-04-21 04:21:17,160 [INFO] [real_stack.mqtt] [conn 12 c2b] CONNECT protocol_level=4
roborock-local-server  | 2026-04-21 04:21:17,160 [INFO] [real_stack.mqtt] [conn 12] closed
roborock-local-server  | 2026-04-21 04:21:17,160 [INFO] [real_stack.mqtt] [conn 12 b2c] CONNACK len=4 hex=20020005
roborock-local-server  | 2026-04-21 04:21:25,367 [INFO] [real_stack.mqtt] TLS handshake ok from 192.168.x.x:43320 (TLSv1.3)
roborock-local-server  | 2026-04-21 04:21:25,367 [INFO] [real_stack.mqtt] [conn 13] backend connect 127.0.0.1:18830 from 192.168.x.x:43320
roborock-local-server  | 2026-04-21 04:21:25,381 [WARNING] [real_stack.mqtt] [conn 13] rejected MQTT CONNECT reason=invalid_mqtt_credentials client_id=<redacted> username=<redacted>
roborock-local-server  | 2026-04-21 04:21:25,381 [INFO] [real_stack.mqtt] [conn 13 c2b] CONNECT len=82 hex=<redacted>
roborock-local-server  | 2026-04-21 04:21:25,381 [INFO] [real_stack.mqtt] [conn 13 c2b] CONNECT protocol_level=4
roborock-local-server  | 2026-04-21 04:21:25,381 [INFO] [real_stack.mqtt] [conn 13] closed
roborock-local-server  | 2026-04-21 04:21:25,381 [INFO] [real_stack.mqtt] [conn 13 b2c] CONNACK len=4 hex=20020005
roborock-local-server  | 2026-04-21 04:21:43,603 [INFO] [real_stack.mqtt] TLS handshake ok from 192.168.x.x:49824 (TLSv1.3)
roborock-local-server  | 2026-04-21 04:21:43,604 [INFO] [real_stack.mqtt] [conn 14] backend connect 127.0.0.1:18830 from 192.168.x.x:49824
roborock-local-server  | 2026-04-21 04:21:43,625 [WARNING] [real_stack.mqtt] [conn 14] rejected MQTT CONNECT reason=invalid_mqtt_credentials client_id=<redacted> username=<redacted>
roborock-local-server  | 2026-04-21 04:21:43,625 [INFO] [real_stack.mqtt] [conn 14 c2b] CONNECT len=82 hex=<redacted>
roborock-local-server  | 2026-04-21 04:21:43,625 [INFO] [real_stack.mqtt] [conn 14 c2b] CONNECT protocol_level=4
roborock-local-server  | 2026-04-21 04:21:43,626 [INFO] [real_stack.mqtt] [conn 14 b2c] CONNACK len=4 hex=20020005
roborock-local-server  | 2026-04-21 04:21:43,626 [INFO] [real_stack.mqtt] [conn 14] closed
roborock-local-server  | 2026-04-21 04:22:15,887 [INFO] [real_stack.mqtt] TLS handshake ok from 192.168.x.x:54922 (TLSv1.3)
roborock-local-server  | 2026-04-21 04:22:15,887 [INFO] [real_stack.mqtt] [conn 15] backend connect 127.0.0.1:18830 from 192.168.x.x:54922
roborock-local-server  | 2026-04-21 04:22:15,903 [WARNING] [real_stack.mqtt] [conn 15] rejected MQTT CONNECT reason=invalid_mqtt_credentials client_id=<redacted> username=<redacted>
roborock-local-server  | 2026-04-21 04:22:15,903 [INFO] [real_stack.mqtt] [conn 15 c2b] CONNECT len=82 hex=<redacted>
roborock-local-server  | 2026-04-21 04:22:15,904 [INFO] [real_stack.mqtt] [conn 15 c2b] CONNECT protocol_level=4
roborock-local-server  | 2026-04-21 04:22:15,904 [INFO] [real_stack.mqtt] [conn 15 b2c] CONNACK len=4 hex=20020005
roborock-local-server  | 2026-04-21 04:22:15,904 [INFO] [real_stack.mqtt] [conn 15] closed

[Lash-L]

Hey @EnumC! The repo is currently going through a period of solidification and hardening in preparation for the v1 release. I'd recommend waiting for that unless you like to tinker and experiment! In which case feel free to proceed! You should be able to disable auth in the admin ui. You can then onboard again. If you turn auth back on it (might) still work!

[EnumC]

Thanks @Lash-L for all your hard work. You're right, it looks like the mqtt credential logic is broken. Unfortunately disabling "Require token/Hawk auth" didn't solve the issue. The backfill_device_mqtt_passwords() never ran when I did onboarding because the mqtt_usr is also empty.

For now, I modified

local_roborock_server/src/roborock_local_server/bundled_backend/mqtt_broker_server/server.py

Line 17 in bfafdc0

def build_broker_config(port: int) -> str:

to use a password_file. And then I tied in this method by taking the parsed username and password from

local_roborock_server/src/roborock_local_server/bundled_backend/shared/runtime_credentials.py

Line 666 in bfafdc0

def backfill_device_mqtt_passwords(self, log_path: str | Path) -> int:

, feeding it into mosquito's password hashing generator, then to the persistent password file whenever there's a rejected MQTT CONNECT.

Sounds like you're already working on auth though. I'm happy to make a PR with some of the changes if needed, but I haven't figured out an optimal way to handle auth globally.

[EnumC]

Barring the mqtt auth issue, I can confirm the G30 U (region specific variant of Saros 10R) works great in HA with Roborock + Roborock Custom map. I also had to run rm /root/config/.storage/roborock/* then reboot the home assistant instance to clear the robot's cached ip.