Secure BLE MQTT Monitoring Platform
Built a Raspberry Pi 5 monitoring platform that ingests BLE sensor data, secures transport with TLS-enabled MQTT, processes events in Node-RED, stores metrics in InfluxDB, and visualizes them in Grafana.
Role
End-to-end IoT integration: BLE ingestion, secure MQTT transport, containerized services, telemetry processing, time-series storage, dashboarding and operational documentation.
Key results
- TLS / X.509
- Secured MQTT transport
- Podman Compose
- Containerized services
- InfluxDB
- Time-series storage
- Grafana
- Telemetry visualization
Problem and constraints
Separate homework-style steps do not communicate real engineering depth. The system needed to be combined into one coherent platform with secure transport, secret management, processing, storage, dashboards, and a repository structure that can be published safely.
Security
Mutual TLS with X.509 certificates protects MQTT traffic, Podman secrets isolate admin passwords and token keys, and the GitHub repository excludes local env files, generated tokens, and private certificate material.
Reliability
Decoupled services, restart policies, health checks, and a repeatable secret bootstrap script make the platform easier to redeploy after service failures, host changes, or fresh Pi setups.
What I built
I combined the BLE collector, Mosquitto broker, Node-RED flow, InfluxDB, and Grafana into a Podman Compose stack on Raspberry Pi 5. MQTT traffic is protected with X.509 certificates, Grafana and InfluxDB credentials are injected through Podman secrets, Node-RED credentials are moved out of hardcoded config, and the public repository now ships with .env.example, .gitignore, and a reusable create_secrets.sh workflow.
Architecture
Node
BLE sensor nodes publish environmental telemetry from ESP32-class devices into the local gateway path.
Edge
Raspberry Pi 5 hosts containerized BLE ingestion, Mosquitto, Node-RED, InfluxDB, and Grafana as one local monitoring stack managed with Podman Compose.
Cloud
The design is local-first and does not require a public cloud; processed telemetry can later be forwarded to remote dashboards or alerting systems if needed.
Technical Decisions
- BLE ingestion on Raspberry Pi 5 with MQTT as the backbone transport
- Mosquitto secured with TLS and client certificates
- Node-RED processing, InfluxDB time-series storage, and Grafana dashboards
- Podman Compose orchestration with Podman secrets and GitHub-safe repo structure
Validation
- Confirmed that Node-RED received temperature and humidity messages from MQTT and exposed normalized payload values in its debug output.
- Confirmed that the processing flow routes telemetry from Mosquitto through a transformation step to InfluxDB while retaining a debug branch for inspection.
- Queried InfluxDB Data Explorer and found persisted temperature and humidity fields in the sensor_data measurement.
- Reviewed the public repository to confirm that local environment files, generated tokens and private certificate material are excluded.
Results
Turned several separate assignments into one coherent monitoring platform
Published a public GitHub repository without shipping secrets or private key material
Shows systems integration, observability, and secure deployment on Raspberry Pi
Complete stack
Hardware & Ingestion
Messaging & Processing
Data & Visualization
Runtime & Secrets
Artifacts
Next technical step
Planned work
Add a repeatable end-to-end integration test that follows a synthetic BLE payload through MQTT processing to the persisted metric and dashboard query.