Josh Kalderimis

How NervesHub works under the hood: architecture, authentication, signing, deltas, and orchestration.

Concepts & explanation

How NervesHub is built: the web and device endpoints, PostgreSQL and object storage, the optional ClickHouse database, and the distributed cluster.

Architecture

How NervesHub coordinates firmware rollouts across a fleet: the distributed orchestrator, concurrency, queues, failure handling, and the penalty box.

Deployment orchestration

The two ways devices authenticate to NervesHub (shared secrets and X.509 certificates), when to use each, and where keys live (NervesKey, TPM, file).

Device authentication & mTLS

What NervesHub collects from devices (health metrics, alarms, network info, geo, connection history, and optional logs) and where it's stored.

Device health, metrics & logging

How NervesHub delivers bandwidth-efficient partial firmware updates: what a delta is, how it's generated, and what devices need to use them.

Firmware deltas

How NervesHub keeps firmware trustworthy: signing keys, fwup, and how both the server and the device verify a signature.

Firmware signing & fwup

Options for protecting a device's private key: NervesKey (ATECC608), TPM 2.0, ARM TrustZone, and other OpenSSL-engine-backed hardware.

Security hardware

The certificates and keys behind NervesHub's certificate-based device auth: device certificates, Signer CAs, and the chain of trust.

Public key infrastructure

Feedback

Roadmap

Changelog

Start here: what NervesHub is, hosted vs self-hosted, core concepts, and the vocabulary.

Getting Started

What NervesHub is, how it delivers signed OTA firmware to Nerves devices, and where to start.

Introduction

How self-hosted NervesHub and the hosted NervesCloud service differ, and which host your devices and CLI connect to.

NervesHub vs NervesCloud

A glossary of NervesHub terms: orgs, products, devices, firmware, deployment groups, releases, auth, and observability.

Terminology

How NervesHub is organised: organizations, products, devices, firmware, deployment groups, and releases, and how they fit together.

Core concepts at a glance

Start-to-finish guides: your first OTA update, production auth, and running your own server.

Tutorials

Connect a Nerves device and ship your first OTA update with shared-secret auth — from mix nerves.new to a device updating.

Quickstart

Run your own NervesHub: architecture, Docker, PostgreSQL, object storage, optional ClickHouse, and the core environment variables.

Self-hosting NervesHub

Set up certificate-based (mTLS) device auth with NervesKey hardware: choose a method, provision the chip, and ship signed firmware.

Production setup with NervesKey

Task-focused guides for everyday work: managing devices, firmware, deployments, and more.

How-to guides

Manage a NervesHub organization: invite users, assign roles, and maintain firmware signing keys and certificate authorities.

Manage organizations & users

Create and configure products in NervesHub: members, enabling the Health, Geo, Local Shell, and Logging extensions, and product settings.

Manage products

Work with devices in NervesHub: tags, the device detail tabs, and actions like reboot, reconnect, identify, and clearing the penalty box.

Manage devices

Build, sign, upload, and manage firmware in NervesHub: metadata, delta-updatable images, and deletion rules.

Manage firmware

Target devices and roll out firmware safely with deployment groups — conditions, concurrency, failure limits, and releases.

Deployment groups & releases

Create reusable Elixir snippets and run them on demand against online devices from NervesHub.

Support scripts

Debug live devices from the NervesHub web UI: enable the remote IEx console and the local shell, and understand their differences.

Remote console & local shell

Configure the Health and Geo extensions in NervesHubLink: metric sets, custom metadata, alarms, and location resolvers.

Device health, metrics & geo

Configure the NervesHubLink device client: connection, authentication, remote IEx, update behavior, retries, CA certs, and proxies.

Configure NervesHubLink

Look-up material: the HTTP API, device socket, nh CLI commands, and configuration options.

Reference

The websocket protocol devices use to talk to NervesHub: connection, authentication, channels, messages, and API versions.

Device socket & channel API

Every NervesHubLink config key in one place: connection, authentication, updates, downloads, extensions, and testing.

NervesHubLink configuration reference

The full set of environment variables for configuring a self-hosted NervesHub: endpoints, database, storage, TLS, email, auth, and tuning.

Self-hosting configuration reference

Command reference for the nh CLI: auth, config, orgs, products, devices, firmware, signing keys, deployments, and CA certificates.