Infrastructure, Monitoring & Security

Who this is for: Operators responsible for running SandGrain in a shared or production-like environment.

What you'll learn: The network and security architecture, how to monitor health, and the practices that keep a deployment secure.

Network architecture

The laptop and Pis communicate over HTTP and MQTT on a shared /24 subnet:

Service	Port
Gateway listen	8080
MQTT (Mosquitto)	1883
TrustBridge backend	3000
TrustBridge frontend	5173
MySQL	3306

Scaling and availability

The Gateway handles multiple device channels concurrently (MAX_DEVICES, consecutive ports from PORT_BASE).
The split topology distributes the device and gateway roles across machines.
The backend entrypoint waits for MySQL to be healthy and seeds once before starting the API; the Gateway must be initialized before devices connect.

Monitoring

Logs: tail any service with start-all.* logs <be|fe|cloud-sdk|mysql|mosquitto>. Use the per-module SDK debug flags during development, and note the Gateway emits gw_log telemetry over MQTT.
Alerting: watch for SGR_SDK_COMM_ERROR (critical/unrecoverable comms) and SGR_SDK_ERROR (critical internal) from SGR_SDK_GW_Run.
Health: docker ps (five containers, MySQL healthy); the frontend login page reachable; the gateway log showing Whitelist loaded: N device(s); and device logs showing Device SDK initialized OK and MQTT connected.

Security architecture

Hardware-rooted device identity, with whitelist-based authorization.
CRC integrity checks on messages.
Credentials isolated in env files and in the crypto chip.

Secure deployment practices

Ship with debug flags disabled and CRC enabled.
Set bit-flip thresholds explicitly, and restrict the whitelist to known TIDs.
Keep MQTT, Cloudflare Access, and tenant credentials out of source control. Secret keys never leave the crypto chip.
Authentication relies on crypto-chip-derived Response Words; transport may add TLS per platform, via the Portability Layer.

Compliance

Maintain auditable enrollment and lifecycle records via TrustBridge, and retain firmware verification results (FW_OK / FW_NOK) and installation decisions.