#TLS

Opening a broker to browsers and devices on the internet is less about encryption than identity. Each entrance now accepts one kind of credential, every token is bound to its own name and addressed to this broker, and TLS ends in nginx.

SMTP and IMAP credentials fail late and far from their cause: a reset email that never arrives. A small check proves both directions first, with a tokenised test message, a read-only inbox check, and broken config kept distinct from a broken server.

A laptop and a borrowed Colab GPU talked through a public MQTT broker that anyone could read. Giving that channel an identity took an afternoon on the broker and eight obstacles in the clients — mostly safeguards that were right for the old setup and wrong for the new one.

Three environments sharing one fixed domain name, separated at the socket rather than by name, with a banner on every environment except production — and live proxy config rendered from a template, never linked into a repository where a branch switch could rewrite it.