Secure ThingsBoard MQTTS with X.509 Certificate Chain and Auto-Provisioning
This guide builds on: to enable: Why We Removed MQTTS from HAProxy In the earlier setup, HAProxy terminated TLS for
Identity, Security & PKI
Networking
IoT & Embedded Systems
Secure Bare-Metal ThingsBoard with HAProxy and Let’s Encrypt
This guide applies to bare-metal setups only. If you’re running ThingsBoard on Kubernetes, refer to your ingress controller (e.g. Traefik
Networking & Connectivity
Install and Configure HAProxy on Bare Metal Ubuntu 24.04
Set up HAProxy 3.2 on Ubuntu 24.04 and forward HTTP/HTTPS to a backend Jenkins host using SNI-based TLS passthrough. HAProxy
Identity, Security & PKI
Install Keycloak with MariaDB and NGINX Reverse Proxy (SSL Termination)
This guide shows how to install Keycloak behind NGINX with SSL termination using Let’s Encrypt, and an existing MariaDB server.
Networking & Connectivity
Set Up HAProxy for TLS Passthrough with SNI Routing on OPNsense
In this guide, we’ll configure HAProxy on OPNsense to support TLS passthrough with SNI-based routing. This allows secure HTTPS traffic
Networking & Connectivity
WireGuard VPN on OPNsense 25.1
Architecture Overview: This setup runs WireGuard on an AWS EC2-based OPNsense firewall (WireGuard server) in the public subnet (10.0.0.0/20). The
Networking & Connectivity
Configure BIND on OPNsense 25.1 as Internal DNS Server for AWS VPC
Overview Component Value Internal domain maksonlee.com DNS server IP 10.0.128.4 (OPNsense LAN IP) System DNS 127.0.0.1 (loopback) Forwarder AWS DNS
Networking & Connectivity
Let’s Encrypt on OPNsense 25.1 Using DNS-01 with Cloudflare
1. Install the ACME Client Plugin 2. Create Your Let’s Encrypt Account 3. Create Cloudflare API Token You’ll need this
Networking & Connectivity
Deploy OPNsense 25.1 Nano on AWS
Architecture Overview: Interface Subnet Private IP Public IP WAN (ena0) test-subnet-public1-ap-south-1a 10.0.0.4 Yes LAN (ena1) test-subnet-private1-ap-south-1a 10.0.128.4 No 1. Launch