The broker and Kafka on the internet, with Traefik

modbee, one Kafka node and Traefik on one server: MQTT over TLS on port 8883,
Kafka over TLS with a password on port 9093, both on a free Let's Encrypt
certificate fetched and renewed by itself. Devices anywhere publish; your SCADA
or other Kafka apps, anywhere, read every message, send commands back, and know
which devices are online.

Already run Nginx Proxy Manager on the server? Use ../npm-kafka.

Start it

You need a Linux server with Docker (4 GB of memory is plenty), a DNS name
pointing at it, and ports 80, 8883 and 9093 open to the internet.

cp .env.example .env        # set DOMAIN, EMAIL, MQTT_PASSWORD and KAFKA_PASSWORD
docker compose up -d
docker compose ps           # kafka-topics "exited (0)"; the others "running"
docker compose logs traefik # the certificate arrives within a minute

First time? Set ACME_SERVER in .env to Let's Encrypt's staging server
while you try it out, and remove it when it works.

What is in Kafka

Building an app on it: docs/kafka-apps.md.

Add a device

docker compose exec modbee modbee user add tank-01 \
  --publish 'plant/${username}/#' --subscribe 'plant/${username}/cmd'

It prints the device's password, once. Many devices of one kind can register
themselves with one key instead (modbee key create):
docs/logins.md.

Good to know

• Traefik ends TLS, and passes plain MQTT to modbee. So devices cannot sign
  in with a client certificate here, and must not pin the certificate's key:
  every renewal (about every 60 days) brings a new one. They check the
  certificate against the public roots instead.
• Port 80 must stay open: Let's Encrypt checks it at every renewal.
• Kafka's port 9094 has no password. It is published on this server only
  (KAFKA_BIND=127.0.0.1). Never open it to the internet; use 9093.

Keep it running