switch to emqx

nix/hosts/default.nix

@@ -22,7 +22,7 @@ let
         modules.gebos-postgres
         modules.gebos-supabase
         modules.gebos-caddy
-        modules.gebos-hivemq
+        modules.gebos-emqx
         modules.gebos-ingester
         modules.gebos-frontend
         ./${name}.nix

nix/hosts/mqtt-ingest.nix

@@ -4,11 +4,15 @@
   networking.hostName = "mqtt-ingest";
 
   services.gebos.secrets.ingester = true;
-  # Broker authn/authz credentials (file-RBAC: ingester + admin MQTT users).
-  services.gebos.secrets.hivemq = true;
+  # Broker authn users (users.csv).
+  services.gebos.secrets.emqx = true;
 
-  services.gebos.hivemq = {
+  # EMQX (official container image) terminates TLS on :8883 itself and serves
+  # the ingester on loopback :1883. Certs come from security.acme via HTTP-01
+  # (lego standalone on :80) — no Caddy on this host anymore.
+  services.gebos.emqx = {
     enable = true;
+    domain = "ingest.gebos.online";
     # Persistent sessions on disk — single-node, devices reconnect on restart.
     persistentSessions = true;
     tlsPort = 8883;
@@ -16,21 +20,12 @@
 
   services.gebos.ingester = {
     enable = true;
-    # mqttBroker defaults to tcp://127.0.0.1:1883 (the local HiveMQ).
+    # mqttBroker defaults to tcp://127.0.0.1:1883 (the local EMQX).
     postgresUrl = "postgres://gebos_ingest@10.0.0.2:5432/postgres?sslmode=require";
     # GEBOS_POSTGRES_PASSWORD sourced from /run/secrets/gebos-env (sops-nix).
   };
 
-  # Caddy (layer4) terminates TLS on :8883 and forwards cleartext MQTT to
-  # HiveMQ's loopback listener on :1883. tcpProxy is the upstream backend.
-  services.gebos.caddy = {
-    enable = true;
-    sites = {
-      "ingest.gebos.online" = { tcpProxy = "127.0.0.1:1883"; };
-    };
-  };
-
-  # 8883: MQTTS for senders. 80/443: ACME challenge so Caddy can obtain/renew
-  # the ingest.gebos.online cert that the layer4 TLS handler serves.
-  networking.firewall.allowedTCPPorts = [ 80 443 8883 ];
+  # 8883: MQTTS for senders. 80: ACME HTTP-01 challenge (lego's standalone
+  # solver binds it during issuance/renewal; idle otherwise).
+  networking.firewall.allowedTCPPorts = [ 80 8883 ];
 }