📋 Topics Covered in Final Stage
1 Full IoT architecture overview
2 Scaling strategy for 1000+ devices
3 SSL and secure MQTT communication
4 Industry deployment strategy and operations model
🏗️ Step 1: Complete IoT Architecture
🔐 Step 2: MQTT Security Implementation
pid_file /var/run/mosquitto.pid
persistence true
persistence_location /var/lib/mosquitto/
log_dest file /var/log/mosquitto/mosquitto.log
log_dest stdout
listener 8883
protocol mqtt
cafile /etc/mosquitto/certs/ca.crt
certfile /etc/mosquitto/certs/server.crt
keyfile /etc/mosquitto/certs/server.key
require_certificate true
tls_version tlsv1.2
listener 9001
protocol websockets
allow_anonymous false
allow_anonymous false
password_file /etc/mosquitto/passwd
acl_file /etc/mosquitto/acl
max_connections 10000
max_keepalive 120
message_size_limit 65536
autosave_interval 1800
autosave_on_changes false
ACL Configuration File
pattern publish "device/%u/+"
pattern subscribe "device/%u/command"
user dashboard
topic write "home/relay/+/command"
topic read "home/relay/#"
user mobile_app
topic write "home/relay/+/command"
topic read "home/relay/#"
user admin
topic readwrite "#"
user analytics
topic read "home/+/+"
topic read "lte/+/+"
SSL/TLS Certificate Setup
openssl genrsa -out ca.key 2048
openssl req -new -x509 -days 365 -key ca.key -out ca.crt \
-subj "/C=IN/ST=DL/L=Delhi/O=YaranaIoT/CN=Yarana Root CA"
openssl genrsa -out server.key 2048
openssl req -new -key server.key -out server.csr \
-subj "/C=IN/ST=DL/O=YaranaIoT/CN=broker.yaranaiot.com"
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key \
-CAcreateserial -out server.crt -days 365
sudo cp ca.crt server.crt server.key /etc/mosquitto/certs/
sudo chmod 644 /etc/mosquitto/certs/*.crt
sudo chmod 600 /etc/mosquitto/certs/*.key
📈 Step 3: Scaling Strategy for 1000+ Devices
connection broker-cluster
address broker2.local:1883
clientid bridge-broker1
try_private true
start_type automatic
topic # in 0
topic # out 0
topic # both 0
remote_username bridge_user
remote_password secure_bridge_password
bind 0.0.0.0
port 6379
cluster-enabled yes
cluster-config-file nodes.conf
cluster-node-timeout 5000
appendonly yes
⚠️
Device Scaling Limits:
🛠️ Step 4: Industry Deployment Operations
version: '3.8'
services:
mosquitto-1:
image: eclipse-mosquitto:2.0
container_name: mosquitto-1
ports:
- "1883:1883"
- "8883:8883"
- "9001:9001"
volumes:
- ./mosquitto/config:/mosquitto/config
- ./mosquitto/data:/mosquitto/data
- ./mosquitto/log:/mosquitto/log
networks:
- iot-network
restart: unless-stopped
api:
image: node:18-alpine
container_name: iot-api
working_dir: /app
volumes:
- ./api:/app
environment:
- NODE_ENV=production
- MQTT_BROKER=mqtt://mosquitto-1:1883
- REDIS_HOST=redis
- DB_HOST=timescale
networks:
- iot-network
depends_on:
- mosquitto-1
restart: unless-stopped
redis:
image: redis:7-alpine
container_name: iot-redis
ports:
- "6379:6379"
volumes:
- redis-data:/data
networks:
- iot-network
restart: unless-stopped
timescale:
image: timescale/timescaledb:latest-pg15
container_name: iot-timescale
environment:
- POSTGRES_PASSWORD=secure_password
- POSTGRES_DB=iot_data
volumes:
- timescale-data:/var/lib/postgresql/data
networks:
- iot-network
restart: unless-stopped
nginx:
image: nginx:alpine
container_name: iot-nginx
ports:
- "80:80"
- "443:443"
volumes:
- ./nginx/nginx.conf:/etc/nginx/nginx.conf
- ./nginx/ssl:/etc/nginx/ssl
networks:
- iot-network
depends_on:
- api
restart: unless-stopped
networks:
iot-network:
driver: bridge
volumes:
redis-data:
timescale-data:
Nginx Configuration for MQTT WebSocket
events {
worker_connections 1024 ;
}
stream {
upstream mqtt_backend {
server mosquitto-1:1883 ;
}
server {
listen 1883 ;
proxy_pass mqtt_backend;
proxy_connect_timeout 10s ;
proxy_timeout 300s ;
}
upstream mqtts_backend {
server mosquitto-1:8883 ;
}
server {
listen 8883 ssl;
proxy_pass mqtts_backend;
ssl_certificate /etc/nginx/ssl/server.crt;
ssl_certificate_key /etc/nginx/ssl/server.key;
ssl_protocols TLSv1.2 TLSv1.3;
}
}
http {
upstream mqtt_ws_backend {
server mosquitto-1:9001 ;
}
server {
listen 443 ssl;
server_name dashboard.example.com;
ssl_certificate /etc/nginx/ssl/server.crt;
ssl_certificate_key /etc/nginx/ssl/server.key;
location /mqtt {
proxy_pass http://mqtt_ws_backend;
proxy_http_version 1.1 ;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade" ;
proxy_set_header Host $host;
proxy_read_timeout 86400 ;
}
location / {
root /var/www/html;
index index.html;
}
}
}
📊 Step 5: Monitoring and Alerting
"connection_count"
"message_count"
"bytes_transferred"
"queue_depth"
"memory_usage"
"device_online_count"
"device_offline_count"
"message_latency"
"command_success_rate"
"last_seen_distribution"
groups :
- name: device_alerts
rules:
- alert: DeviceOffline
expr: device_offline_count > 10
for: 5m
labels:
severity: warning
annotations:
summary: "{{ $value }} devices offline"
- alert: HighMessageLatency
expr: message_latency > 5000
for: 2m
labels:
severity: critical
annotations:
summary: "High latency: {{ $value }}ms"
- alert: BrokerConnectionLimit
expr: connection_count > 9000
for: 1m
labels:
severity: critical
annotations:
summary: "Connection limit approaching"
✅ Production Deployment Checklist
Security: TLS/SSL enabled on all MQTT connectionsAuthentication: Username/password or certificates for all clientsAuthorization: ACLs configured for all user rolesMonitoring: Broker metrics exposed and dashboards set upAlerting: Alerts configured for offline devices and failuresBackup: Regular backups of configuration and dataUpdates: Patch management plan in placeDocumentation: Runbooks and procedures documentedTesting: Load testing completed at expected scaleFailover: Backup broker ready and testedFirewall: Only necessary ports exposedLogging: Centralized logging configured
🎉
Congratulations! Aapne MQTT Mastery Series complete kar liya hai! Ab aapke paas full-stack IoT system build karne ka complete knowledge hai - from broker setup se lekar production deployment tak.
💡
Next Steps:
← Phase 6: Android App
← Back to Main Index