---
name: integration-bridges
description: Configure and verify the Integration and Edge tier's protocol gateways, rules and external sinks using bundled examples and bounded retry contracts.
---

# Set up gateways, rules and bridges

Read [container-setup](../container-setup/SKILL.md). Select the intended
protocol, rules/schema, bridge and adapter from installed `/etc/nginz-iot/` and
`/etc/nginz/` examples and the lane product document. Modbus/OPC UA are outbound
authority clients; other gateway boundaries use their configured ingress paths.
Do not enable every example to configure one application.

The broker selects rules/bridges and durable intent; `nginz-iot-bridge` owns
blocking sink effects. Normal `bridge` starts a guardian from
`/etc/nginz-iot/bridges.toml`, with crash-isolated target workers. Validate each
selected worker config natively. `BRIDGE_CONFIG` is a focused single-worker
compatibility path, not normal multi-target deployment.

SDK material is under `/usr/local/include/nginz_iot/` and
`/usr/local/share/nginz-iot/bridge-sdk/`; adapters are under
`/opt/nginz-iot/adapters/`. Pin ABI/adapter identity and inspect its example.
Resolve sink credentials, trust and local network paths without fetching code.

Declare topic/predicate/projection, exact payload, QoS/retain, batching/order,
retry bounds, capacity/backpressure, expiry and terminal ownership. Verify input
through committed sink receipts, including outage/restart, duplicates and
terminal outcomes. Accepted input or an empty queue gauge alone does not prove
commitment. Use isolated harmless sinks and one side-effect owner.

Read [durable-recovery](../durable-recovery/SKILL.md) for intent/store recovery
and [migration-cutover](../migration-cutover/SKILL.md) when replacing a path.
Keep source retry/TTL differences explicit. Observability assets are under
`/usr/share/nginz-iot/observability/`; inspect installed requirements before
enabling scraping/alerts.

Use [panel operations](../panel-operations/SKILL.md) or
[admin API operations](../admin-api-operations/SKILL.md) to inspect configured
rules, bridges, gateways and their evidence. Live backend view/workflow lists
and verified roles determine scope; a compiled adapter or a visible page does
not enable a sink. Governed bridge drain applies only to a selected bridge and
requires matching path ID/target and current fences. API inspection does not
deploy rules, provision credentials or change arbitrary sink configuration.