Thanks - I tried the above, along with this suggestion (very similar to yours):
Bizzarely, I do now get a single device connecting. However, all other devices - including HA itself connecting from localhost, are rejected
[s6-init] making user provided files available at /var/run/s6/etc...exited 0.
[s6-init] ensuring user provided files have correct perms...exited 0.
[fix-attrs.d] applying ownership & permissions fixes...
[fix-attrs.d] done.
[cont-init.d] executing container initialization scripts...
[cont-init.d] mosquitto.sh: executing...
[18:25:11] INFO: SSL is not enabled
[cont-init.d] mosquitto.sh: exited 0.
[cont-init.d] nginx.sh: executing...
[cont-init.d] nginx.sh: exited 0.
[cont-init.d] done.
[services.d] starting services
[services.d] done.
[18:25:12] INFO: Starting NGINX for authentication handling...
[18:25:12] INFO: Starting mosquitto MQTT broker...
1639160712: mosquitto version 1.6.12 starting
1639160712: |-- *** auth-plug: startup
[18:25:13] INFO: Successfully send discovery information to Home Assistant.
[18:25:13] INFO: Successfully send service information to the Supervisor.
1639160712: Config loaded from /etc/mosquitto/mosquitto.conf.
1639160712: Loading plugin: /usr/share/mosquitto/auth-plug.so
1639160712: ├── Username/password checking enabled.
1639160712: ├── TLS-PSK checking enabled.
1639160712: └── Extended authentication not enabled.
1639160712: Opening ipv4 listen socket on port 1883.
1639160712: Opening ipv6 listen socket on port 1883.
1639160712: Opening websockets listen socket on port 1884.
1639160712: Warning: Mosquitto should not be run as root/administrator.
1639160712: mosquitto version 1.6.12 running
1639160712: New connection from 127.0.0.1 on port 1883.
1639160712: Socket error on client <unknown>, disconnecting.
1639160748: New client connected from 192.168.1.153 as OTGW2C:F4:32:57:D8:CD (p2, c1, k15).
1639160782: New connection from 192.168.1.48 on port 1883.
401: Unauthorized1639160782: Socket error on client <unknown>, disconnecting.