The broker on the internet, with Traefik

modbee behind Traefik: MQTT over TLS on port 8883 with a free Let's Encrypt
certificate, fetched and renewed by itself. For devices anywhere - on cellular,
at customers' sites - talking to your server.

Already run Nginx Proxy Manager on the server? Use ../npm instead.
Want the messages in Kafka too? Use ../traefik-kafka.

Start it

You need a Linux server with Docker, a DNS name pointing at it, and ports 80
and 8883 open to the internet.

cp .env.example .env        # set DOMAIN, EMAIL and MQTT_PASSWORD
docker compose up -d
docker compose logs traefik # the certificate arrives within a minute

Devices connect to mqtts://<DOMAIN>:8883 and check the certificate against
the usual public roots (Let's Encrypt's ISRG Root X1).

First time? Set ACME_SERVER in .env to Let's Encrypt's staging server
while you try it out - its limits are generous - and remove it when it works.

Add a device

docker compose exec modbee modbee user add tank-01 \
  --publish 'plant/${username}/#' --subscribe 'plant/${username}/cmd'

It prints the device's password, once. Many devices of one kind can register
themselves with one key instead (modbee key create):
docs/logins.md.

Check it works

From any computer with Docker:

docker run --rm ghcr.io/mod-bee/modbee-mqtt pub --tls -h <DOMAIN> \
  -u admin -P '<MQTT_PASSWORD>' -t plant/test -m hi -q 1

Good to know

• Traefik ends TLS, and passes plain MQTT to modbee. So devices cannot sign
  in with a client certificate here, and must not pin the certificate's key:
  every renewal (about every 60 days) brings a new one. They check the
  certificate against the public roots instead.
• Port 80 must stay open: Let's Encrypt checks it at every renewal.

Keep it running