diff --git a/.templates/mosquitto/directoryfix.sh b/.templates/mosquitto/directoryfix.sh
index dd76786e7..b0d2fa6ce 100755
--- a/.templates/mosquitto/directoryfix.sh
+++ b/.templates/mosquitto/directoryfix.sh
@@ -1,5 +1,13 @@
 #!/bin/bash
 
+# should not run as root
+[ "$EUID" -eq 0 ] && echo "This script should NOT be run using sudo" && exit -1
+
+# expects to run from IOTstack
+[ $(basename "$PWD") = "IOTstack" ] || echo -e \
+"Warning: This script expects to be run from ~/IOTstack.\n" \
+"        The script will continue but may produce unexpected results."
+
 [ -d ./volumes/mosquitto ] || sudo mkdir -p ./volumes/mosquitto
 
 #check user 1883
diff --git a/.templates/mosquitto/mosquitto.conf b/.templates/mosquitto/mosquitto.conf
index 21bcb6187..e2c092f85 100644
--- a/.templates/mosquitto/mosquitto.conf
+++ b/.templates/mosquitto/mosquitto.conf
@@ -1,19 +1,33 @@
 # required by https://mosquitto.org/documentation/migrating-to-2-0/
+#
 listener 1883
 
+# persistence enabled for remembering retain flag across restarts
+#
 persistence true
-persistence_location /mosquitto/data/
+persistence_location /mosquitto/data
+
+# logging options:
+#   enable one of the following (stdout = less wear on SD cards but
+#   logs do not persist across restarts)
 #log_dest file /mosquitto/log/mosquitto.log
-# To avoid flash wearing
 log_dest stdout
+log_timestamp_format %Y-%m-%dT%H:%M:%S
 
-# To enable passwords:
-# 1. Uncomment "password_file"; and
-# 2. Change "allow_anonymous" to "false"
+# password handling:
+#   password_file commented-out allow_anonymous true =
+#     open access
+#   password_file commented-out allow_anonymous false =
+#     no access
+#   password_file activated     allow_anonymous true =
+#     passwords omitted is permitted but
+#     passwords provided must match pwfile
+#   password_file activated     allow_anonymous false =
+#     no access without passwords
+#     passwords provided must match pwfile
+#
 #password_file /mosquitto/pwfile/pwfile
 allow_anonymous true
 
-#Uncomment to enable filters
+# Uncomment to enable filters
 #acl_file /mosquitto/config/filter.acl
-
-log_timestamp_format %Y-%m-%dT%H:%M:%S
diff --git a/.templates/mosquitto/service.yml b/.templates/mosquitto/service.yml
index 29e139609..64ba05c78 100644
--- a/.templates/mosquitto/service.yml
+++ b/.templates/mosquitto/service.yml
@@ -9,5 +9,4 @@
       - ./volumes/mosquitto/data:/mosquitto/data
       - ./volumes/mosquitto/log:/mosquitto/log
       - ./volumes/mosquitto/pwfile:/mosquitto/pwfile
-      - ./services/mosquitto/mosquitto.conf:/mosquitto/config/mosquitto.conf
-      - ./services/mosquitto/filter.acl:/mosquitto/config/filter.acl
+      - ./services/mosquitto:/mosquitto/config:ro