ADR-0002: Self-Hosted EMQX Broker
Status
Accepted
Context
Device control (transmitters, stream players) needs a message broker that can issue and revoke credentials per individual device, at a fleet scale that will grow over time, without being constrained by a third-party provider's per-connection or per-plan pricing ceiling.
Decision
Run a self-hosted EMQX broker (built from emqx/) rather than a managed
MQTT service, with per-device credentials provisioned from day one.
Alternatives Considered
Not recorded in source material.
Consequences
- Per-device credentials and revocation are possible immediately, with no connection-count ceiling imposed by an external plan.
- Broker operations — sizing, TLS certificate renewal, upgrades, backups, rate-limit tuning — now belong to this team rather than a managed-service provider. See Device Deployment for the operational surface this creates.
- A single EMQX node is treated as sufficient for the pilot stage, with HA migration deferred to a named fleet-size trigger — see the transmitter roadmap for that threshold.