HTTPS device ingress

The HTTPS gateway accepts bounded POST requests from devices or trusted gateways. Nginx owns TLS verification and request-body handling; nginz-iotd owns authorization, rules, routing, durability, and bridge effects.

Location configuration

location = /iot/v1/device-ingress {
  client_body_buffer_size 256k;
  client_max_body_size 256k;

  iot_gateway_https on;
  iot_gateway_https_max_body 256k;
  iot_gateway_https_tenant tenant-a;
  iot_gateway_https_verified_identity ssl_client_verify ssl_client_s_dn;
  iot_gateway_https_iotd_ring /nginz-iot-production 4096 1024 1 1;
}

Request contract

Required metadata is X-Iot-Device-Id, X-Iot-Topic, Idempotency-Key, and either application/json or application/octet-stream. X-Iot-Schema is optional.

A 202 response means the bounded payload and broker command entered the configured ring. It is not a durability acknowledgement. Missing verified identity, ring pressure, stale generation/term, or attachment failure returns 503 without queueing.

The supported body ceiling is 262,144 bytes; payloads above the inline ABI size use immutable chunk records. HTTPS device ingress is a Max and Enterprise gateway.