Concepts & explanation
How NervesHub works under the hood: architecture, authentication, signing, deltas, and orchestration.
- ArchitectureHow NervesHub is built: the web and device endpoints, PostgreSQL and object storage, the optional ClickHouse database, and the distributed cluster.
- Deployment orchestrationHow NervesHub coordinates firmware rollouts across a fleet: the distributed orchestrator, concurrency, queues, failure handling, and the penalty box.
- Device authentication & mTLSThe two ways devices authenticate to NervesHub (shared secrets and X.509 certificates), when to use each, and where keys live (NervesKey, TPM, file).
- Device health, metrics & loggingWhat NervesHub collects from devices (health metrics, alarms, network info, geo, connection history, and optional logs) and where it's stored.
- Firmware deltasHow NervesHub delivers bandwidth-efficient partial firmware updates: what a delta is, how it's generated, and what devices need to use them.
- Firmware signing & fwupHow NervesHub keeps firmware trustworthy: signing keys, fwup, and how both the server and the device verify a signature.
- Security hardwareOptions for protecting a device's private key: NervesKey (ATECC608), TPM 2.0, ARM TrustZone, and other OpenSSL-engine-backed hardware.
- Public key infrastructureThe certificates and keys behind NervesHub's certificate-based device auth: device certificates, Signer CAs, and the chain of trust.