Skip to main content

AnvilMQ

The MQTT broker behind your edge data, run by Fireball for the whole cluster.

Category: EmberNet Platform

Operated by Fireball

AnvilMQ is one broker per cluster, shared by every organization on it. It appears in the App Store only for Fireball's platform role, and your devices and apps use it through the login Fireball gives your organization. Your own apps are deployed from the App Store in EmberCORE as usual.

AnvilMQ speaks MQTT 3.1.1 and MQTT 5, so the equipment and applications you already use connect to it unchanged. Alongside the broker it has a web dashboard, a GraphQL API for managing users and access rules, and bridges to OPC UA, PLC4X, Kafka, and NATS. The chart runs its own PostgreSQL next to it, so users, rules, retained messages, and sessions survive a restart.

This page is about the App Store listing. The broker as part of the platform, and how EmberCORE uses it, is on the AnvilMQ service page.

Secure by default​

  • No default password. On first start the chart generates a random administrator password into a Secret, anvilmq-admin, and keeps it across upgrades. Nothing is hardcoded in the broker or the chart.
  • Anonymous clients get nothing. A client that connects with no credentials can neither subscribe nor publish, and a publish gets it disconnected. Setting userManagement.anonymousEnabled to false switches the anonymous user off entirely, so a client with no credentials is refused at connect.
  • A login and a topic space for each tenant. Listing a tenant in userManagement.tenants creates its user, with a generated password and access rules for exactly its own topics. By default that is spBv1.0/<tenant>/#. The wildcards #, +, and +/# are refused as a tenant topic, and so are the reserved names Admin and Anonymous.
  • The management API checks who is asking. The GraphQL API returns users and rules only to an administrator's token.

Running on EmberNet​

  • One broker per cluster, one replica, with a PostgreSQL pod and a 2Gi volume by default.
  • Ports. MQTT on 1883, MQTT over WebSocket on 9000, the API on 4000, and the web dashboard on 8080 through a small proxy.
  • Reachable across sites over Flux. The chart publishes the broker as a Flux service, so sites reach it without an exposed port.
  • Tenant credentials land in the tenant's namespace. For each tenant the chart delivers a Secret named anvilmq-mqtt-credentials, with the keys mqtt-username and mqtt-password, into the tenant's namespace. The password lives in the broker's own Secret, and changing it and restarting the broker retires the old one.
  • Back up the Secrets. The administrator and tenant Secrets are the record of who can log in. The tenant Secrets are kept when the release is uninstalled.

Using it​

Ask Fireball for your organization's broker credentials, or read them from the Secret in your namespace, point your MQTT clients at the broker, and publish under your own topic space. Node-RED, HotLoop Flow, and Telegraf connect to it like any other MQTT client. Ignition Edge needs a user of its own.

Learn more​

Fireball deploys and operates this application as part of EmberNet.