TIPCS reference solution

TIPCS = **Telegraf + InfluxDB 3 Core + Private Data Source Connect (PDC) + optional InfluxDB 3 UI**, with **AWS IoT Core** as the public MQTT broker and **Grafana Cloud** as the dashboard layer.

Recommended topology

• Game servers / external publishers -> AWS IoT Core
• Home NAS / Portainer stack -> Telegraf + InfluxDB 3 Core + PDC agent + InfluxDB 3 UI
• Grafana Cloud -> queries InfluxDB privately through PDC

This keeps the internet-facing broker in AWS, while the cost-sensitive analytics stack runs on your NAS.

Why this split

• AWS IoT Core is the critical public entry point.
• TIPCS on the NAS is inexpensive, portable, and straightforward to move later.
• Grafana Cloud users never need direct access to your NAS.
• If the NAS or home internet fails, publishers can still publish to AWS IoT Core; dashboards/history are temporarily unavailable until the NAS returns.

Repo layout

• infra/tofu/ - OpenTofu/Terraform for AWS IoT Core
• stack/ - Portainer/Docker Compose stack for NAS deployment
• docs/ - architecture, operations, recovery
• scripts/ - helper scripts for bootstrap and smoke tests
• examples/ - sample MQTT payloads and Grafana SQL

Bootstrap order

1. Apply infra/tofu in eu-central-1
2. Note the AWS IoT data endpoint from the outputs
3. Generate/import MQTT client certs and attach policies
4. Fill stack/.env from stack/.env.example
5. Put MQTT certs under stack/secrets/mqtt/
6. Deploy stack/compose.yml in Portainer
7. Create the PDC connection manually in Grafana Cloud
8. Copy the PDC values into the Portainer stack env and redeploy the PDC agent
9. Add the InfluxDB datasource manually in Grafana Cloud using PDC and SQL

What is included

• Opinionated OpenTofu starter for AWS IoT Core
• Portainer-ready Compose stack for the NAS
• Telegraf MQTT consumer template for AWS IoT Core mTLS
• InfluxDB 3 UI preconfiguration template
• Backup/recovery notes
• Example SQL queries for Grafana Cloud panels

What you still do manually

• Grafana Cloud account, PDC connection, and datasource setup
• AWS ACM certificate request and DNS validation if you later enable a custom broker domain
• MQTT client certificate generation/import strategy

Quick start

1) Infrastructure

cd infra/tofu
cp terraform.tfvars.example terraform.tfvars
# edit terraform.tfvars
terraform init
terraform plan
terraform apply

2) Stack

cd stack
cp .env.example .env
# edit .env and put MQTT certs under secrets/mqtt/
docker compose up -d

3) Grafana Cloud

• Create a PDC connection
• Copy the PDC values into .env
• Redeploy pdc-agent
• Add an InfluxDB datasource using SQL through PDC

Notes

• The stack intentionally avoids ALB/NLB.
• The Compose stack is suitable for Portainer stacks.
• The AWS IoT Core config is intended to be reproducible and expanded later with custom domains, custom authorizers, or fleet provisioning.