Project: an MQTT sensor dashboard

What you will build and what you need

You will turn the readings from your sensor projects into live graphs with history and alerts, all hosted on your own hardware. The same pattern, broker plus collector plus time-series database plus visualisation, is used in industry, so the skills transfer directly to work.

A simpler alternative is Node-RED, which can subscribe to MQTT and draw basic charts with little configuration. The stack below takes longer but scales and keeps history properly.

Design

Sensors publish JSON to sensors/<device-id>/env. Only the broker port (8883) is reachable from the IoT network. InfluxDB listens on the Pi itself, and Grafana is reachable only from your management network or through a VPN.

Build steps

1. Install Raspberry Pi OS Lite, update it, create a non-default user with SSH keys and enable the firewall.
2. Install the broker: sudo apt install mosquitto mosquitto-clients.
3. Create a small private certificate authority (CA) and a broker certificate whose name matches the Pi's hostname, then configure Mosquitto as below.
4. Create users with sudo mosquitto_passwd -c /etc/mosquitto/passwd telegraf (drop -c for further users) and write the ACL file.
5. Install InfluxDB, Telegraf and Grafana from the vendors' official package repositories, create a bucket called sensors and a write-only token for Telegraf.
6. Configure Telegraf, restart it, and check data arrives in the InfluxDB data explorer.
7. In Grafana, add InfluxDB as a data source with a read-only token, build panels and add an alert rule.

# /etc/mosquitto/conf.d/secure.conf
listener 8883
cafile /etc/mosquitto/certs/ca.crt
certfile /etc/mosquitto/certs/broker.crt
keyfile /etc/mosquitto/certs/broker.key
allow_anonymous false
password_file /etc/mosquitto/passwd
acl_file /etc/mosquitto/acl

# /etc/mosquitto/acl
user telegraf
topic read sensors/#
pattern write sensors/%u/#

# /etc/telegraf/telegraf.d/mqtt.conf
[[inputs.mqtt_consumer]]
  servers = ["ssl://pi-broker.lan:8883"]
  topics = ["sensors/+/env"]
  username = "telegraf"
  password = "${MQTT_PASS}"
  tls_ca = "/etc/telegraf/ca.crt"
  data_format = "json"
  topic_tag = "topic"

[[outputs.influxdb_v2]]
  urls = ["http://127.0.0.1:8086"]
  token = "${INFLUX_TOKEN}"
  organization = "home"
  bucket = "sensors"

The pattern line uses %u for the username, so a device that logs in as temp01 can write only under sensors/temp01/. Secrets are read from environment variables set in the Telegraf service file rather than typed into the config.

Security checklist and next steps

• Broker: no anonymous access, TLS only, per-device users, ACLs, and no port forwarding from the internet.
• Tokens: separate write-only (Telegraf) and read-only (Grafana) InfluxDB tokens.
• Grafana: change the default admin password at first login, disable sign-up, and reach it over HTTPS or a VPN.
• Host: automatic security updates, SSH keys only, a host firewall allowing just 8883 from the IoT VLAN and 22/3000 from management.
• Data: set a retention period on the bucket and back up the configs and dashboards.

Next, add alerts for missing data (a sensor that goes quiet), and practise reading the broker log at /var/log/mosquitto/mosquitto.log to spot failed logins.