nginz-iotd configuration

nginz-iotd owns shared broker state and the lifecycle of the nginx-facing shared-memory rings. Use the lane’s packaged configuration as your starting point; unknown sections and keys fail validation.

Command line

nginz-iotd --test-config --config /etc/nginz-iot/iotd.toml
nginz-iotd --foreground --config /etc/nginz-iot/iotd.toml
nginz-iotd --version

Production PostgreSQL setup is explicit:

nginz-iotd --provision-store --config /etc/nginz-iot/iotd.toml

Core production profile

[node]
node_id = "node-a"
deployment = "production"
generation = 1
writer_term = 1

[rings]
namespace = "/nginz-iot-production"
slot_size = 4096
admin_capacity = 1024
ingress_capacity = 65536
delivery_capacity = 65536
event_capacity = 262144

[broker]
profile = "production_core"
max_sessions = 100000
max_subscriptions = 500000
max_fanout = 4096
max_offline_per_session = 1024

[mqtt]
operating_profile = "tracked"
max_packet_size = 1048576
max_payload_size = 65536
max_keepalive_s = 3600
max_qos = 1

[auth]
required = true
policy_ref = "file:/etc/nginz-iot/auth.policy"
audit_key_ref = "env:NGINZ_IOT_AUDIT_KEY"

[store]
provider = "postgres"
dsn_ref = "env:NGINZ_IOT_POSTGRES_DSN"
ack_policy = "durable"
max_recovery_commands = 65536
max_recovery_mutations = 262144

[rules]
enabled = false

[schema]
enabled = false

[bridges]
enabled = false

[observe]
enabled = true
snapshot_interval_ms = 1000

[admin]
enabled = true
snapshot_max_age_ms = 5000

[ha]
mode = "single_node"

Cross-section invariants

Production profiles reject memory durability. Ring identity must match nginx. Max requires enabled rules, schema, and bridges with file references. Enterprise requires PostgreSQL durability, external fencing, governance generations, SSO, durable audit, and a live rule/schema/bridge generation.

Changing the operating profile, generation, term, or ring ABI requires a coordinated restart.

Operator inspection

The operator CLI (ngz-iot --admin-file /run/nginz-iot/iotd/admin.json health) reads the same redacted snapshot the HTTP admin module and operator console consume. The CLI does not attach to rings.

Enterprise HA uses this snapshot as readiness evidence. PostgreSQL lease ownership and the external orchestrator move traffic. See Fenced active–standby and the operator CLI.