OPC UA client gateway

nginz-iotd is the sole configuration and runtime authority for the selected OPC UA client profile. It runs the bounded open62541 client, namespace resolution, reads, subscriptions, reconnect, backfill, and governed writes. The former nginx scaffold accepted no OPC UA connection and transferred no configuration, so it was removed.

Configuration

[opcua]
enabled = true
config_ref = "file:/etc/nginz-iot/opcua.conf"

Run nginz-iotd --test-config --config /etc/nginz-iot/iotd.toml before startup or reload. The reviewed client file contains the endpoint, security mode, certificate, key, trust, namespace/NodeId mappings, sampling limits, notification capacity, backfill capacity, and governed write policy. Security mode is Sign or SignAndEncrypt; private key bytes never cross an ABI ring.

This profile initiates OPC UA sessions from the node; it is not an inbound OPC UA server. All inbound device and operator traffic still enters through nginx. A future server profile would require a real nginx listener module with explicit secure-channel, connection, worker, and reload ownership.

The selected client profile is a Max and Enterprise gateway. It is not a general OPC UA server, method-call browser, or historical-access implementation.