Client Area

Hong Kong VPS for IoT: Self-Hosted MQTT Broker for Asia Devices (2026)

MQTT is the dominant protocol for IoT device communication — lightweight, publish-subscribe, and designed for unreliable networks. Running a Mosquitto MQTT broker on a Hong Kong VPS with CN2 GIA routing gives IoT deployments across Asia-Pacific a central message hub with sub-50ms latency to mainland Chinese devices and stable connections across Asian networks, without the per-message pricing of cloud IoT platforms like AWS IoT Core or Azure IoT Hub.

Why Self-Host Your MQTT Broker?

  • Cost — AWS IoT Core charges $1 per million messages; a self-hosted Mosquitto on a VPS handles millions of messages for a flat monthly fee
  • China device connectivity — CN2 GIA routing means IoT devices in mainland China connect at 30–50ms versus 200ms+ to AWS US or EU endpoints
  • Data sovereignty — sensor readings and device telemetry stay on your infrastructure
  • No vendor lock-in — standard MQTT protocol works with any client SDK (Python, C/C++, Arduino, ESP32, Raspberry Pi)
  • Full protocol control — configure QoS levels, retained messages, LWT, bridging, and access control exactly as your application requires

Common IoT Architectures Using This Setup

  • Smart building sensor networks (temperature, humidity, occupancy) across offices in HK, Shanghai, and Singapore
  • Industrial monitoring systems in mainland Chinese manufacturing facilities
  • Smart agriculture — soil sensors and irrigation controllers in Asia-Pacific farm networks
  • Fleet tracking — vehicle GPS devices publishing location updates via MQTT
  • Retail analytics — footfall counters, POS system event streams

Step 1: Install Mosquitto MQTT Broker

apt update && apt upgrade -y
apt install -y mosquitto mosquitto-clients ufw

# Enable and start Mosquitto
systemctl enable --now mosquitto

# Verify it's running
mosquitto -v --version

Step 2: Configure Mosquitto for Production

<code">cat > /etc/mosquitto/conf.d/production.conf << 'EOF'
# Listen on standard MQTT port (TLS — no plaintext in production)
listener 8883
protocol mqtt

# WebSockets over TLS (for browser-based dashboards)
listener 9001
protocol websockets

# TLS configuration
cafile /etc/letsencrypt/live/mqtt.yourdomain.com/chain.pem
certfile /etc/letsencrypt/live/mqtt.yourdomain.com/cert.pem
keyfile /etc/letsencrypt/live/mqtt.yourdomain.com/privkey.pem
tls_version tlsv1.2

# Require authentication (never run without this in production)
allow_anonymous false
password_file /etc/mosquitto/passwd

# Access control list
acl_file /etc/mosquitto/acl

# Persistence — retain messages across restarts
persistence true
persistence_location /var/lib/mosquitto/

# Logging
log_dest file /var/log/mosquitto/mosquitto.log
log_type error
log_type warning
log_type information

# Connection limits
max_connections 5000
EOF

Issue TLS Certificate

apt install -y certbot

# Standalone mode (port 80 must be free)
certbot certonly --standalone -d mqtt.yourdomain.com

# Mosquitto needs to read the cert — add to renewal hook
cat > /etc/letsencrypt/renewal-hooks/deploy/mosquitto.sh << 'EOF'
#!/bin/bash
systemctl restart mosquitto
EOF
chmod +x /etc/letsencrypt/renewal-hooks/deploy/mosquitto.sh

Create Users and Passwords

<code"># Create password file and add users
mosquitto_passwd -c /etc/mosquitto/passwd device_user
mosquitto_passwd /etc/mosquitto/passwd dashboard_user
mosquitto_passwd /etc/mosquitto/passwd admin_user

Configure Access Control List

cat > /etc/mosquitto/acl << 'EOF'
# Admin — full access
user admin_user
topic readwrite #

# IoT devices — can only publish to their own topics
user device_user
topic write devices/%c/telemetry
topic write devices/%c/status
topic read devices/%c/commands

# Dashboard — read all telemetry, write commands
user dashboard_user
topic read devices/+/telemetry
topic read devices/+/status
topic write devices/+/commands
EOF

systemctl restart mosquitto

ufw allow 8883/tcp  # MQTT over TLS
ufw allow 9001/tcp  # MQTT WebSockets
ufw enable

Step 3: Test the Broker

# Subscribe to a test topic
mosquitto_sub -h mqtt.yourdomain.com -p 8883 \
  --capath /etc/ssl/certs \
  -u dashboard_user -P your_password \
  -t "devices/+/telemetry" -v &

# Publish a test message (from another terminal or device)
mosquitto_pub -h mqtt.yourdomain.com -p 8883 \
  --capath /etc/ssl/certs \
  -u device_user -P device_password \
  -t "devices/sensor001/telemetry" \
  -m '{"temperature": 23.5, "humidity": 65, "timestamp": 1720000000}'

Step 4: Connect IoT Devices

Python (Raspberry Pi / Linux Device)

<code">pip3 install paho-mqtt

import paho.mqtt.client as mqtt
import json, time, ssl

client = mqtt.Client(client_id="sensor001", protocol=mqtt.MQTTv5)
client.username_pw_set("device_user", "device_password")
client.tls_set(cert_reqs=ssl.CERT_REQUIRED, tls_version=ssl.PROTOCOL_TLS)

client.connect("mqtt.yourdomain.com", 8883, 60)

while True:
    payload = json.dumps({
        "temperature": read_temperature(),  # Your sensor reading function
        "humidity": read_humidity(),
        "device_id": "sensor001",
        "timestamp": int(time.time())
    })
    client.publish("devices/sensor001/telemetry", payload, qos=1)
    time.sleep(60)  # Publish every minute

Arduino / ESP32 (MicroPython)

<code">from umqtt.robust import MQTTClient
import ssl, ujson, time

def connect_mqtt():
    client = MQTTClient(
        "esp32_sensor01",
        "mqtt.yourdomain.com",
        port=8883,
        user="device_user",
        password="device_password",
        ssl=True
    )
    client.connect()
    return client

client = connect_mqtt()

while True:
    data = ujson.dumps({
        "temp": read_dht22_temp(),
        "humidity": read_dht22_humidity()
    })
    client.publish(b"devices/esp32_sensor01/telemetry", data)
    time.sleep(30)

Step 5: Deploy Node-RED for IoT Data Processing

Node-RED provides a visual flow editor for processing MQTT messages — routing sensor data to databases, triggering alerts, and transforming payloads without writing code.

<code">apt install -y nodejs npm
npm install -g --unsafe-perm node-red

# Run Node-RED as a systemd service
cat > /etc/systemd/system/node-red.service << 'EOF'
[Unit]
Description=Node-RED
After=network.target

[Service]
ExecStart=/usr/bin/node-red --max-old-space-size=256
Restart=on-failure
User=nodered
WorkingDirectory=/home/nodered

[Install]
WantedBy=multi-user.target
EOF

useradd -m nodered
systemctl enable --now node-red

In Node-RED’s flow editor (accessible at http://YOUR_VPS_IP:1880), add MQTT input nodes pointing to your Mosquitto broker and wire them to InfluxDB write nodes for time-series storage, or email/Telegram alert nodes for threshold breaches.

Step 6: Time-Series Storage with InfluxDB

<code"># Install InfluxDB 2.x for IoT telemetry storage
wget -q https://repos.influxdata.com/influxdata-archive_compat.key
echo "393e8779c89ac8d958f81f942f9ad7fb82a25e133faddaf92e15b16e6ac9ce4c \
influxdata-archive_compat.key" | sha256sum -c
cat influxdata-archive_compat.key | gpg --dearmor | \
  tee /etc/apt/trusted.gpg.d/influxdata-archive_compat.gpg
echo "deb [signed-by=/etc/apt/trusted.gpg.d/influxdata-archive_compat.gpg] \
  https://repos.influxdata.com/debian stable main" | \
  tee /etc/apt/sources.list.d/influxdata.list

apt update && apt install -y influxdb2
systemctl enable --now influxdb

Configure Node-RED with the InfluxDB output node to write every MQTT telemetry message as a time-series point. Visualise with Grafana connected to InfluxDB — you get a real-time IoT dashboard showing all device metrics across your Asia-Pacific deployment.

Scaling: Mosquitto Bridge for Multi-Region

For IoT deployments spanning multiple Asian regions, configure Mosquitto bridge — devices in mainland China connect to a local Shanghai bridge broker that forwards to your Hong Kong VPS over CN2 GIA:

<code"># On a lightweight VPS in Shanghai (bridge broker):
cat >> /etc/mosquitto/conf.d/bridge.conf << 'EOF'
# Bridge to HK central broker
connection bridge-to-hk
address mqtt.yourdomain.com:8883
topic devices/# both 1

bridge_capath /etc/ssl/certs
bridge_tls_version tlsv1.2
bridge_login device_user
bridge_password device_password

cleansession false
start_type automatic
EOF

Devices publish to the local Shanghai broker (low latency), which bridges all messages to your Hong Kong VPS over a persistent TLS connection using CN2 GIA routing.

Conclusion

A self-hosted Mosquitto MQTT broker on a Hong Kong VPS with CN2 GIA routing provides the ideal central hub for Asia-Pacific IoT deployments — sub-50ms device connectivity to mainland China, unlimited message throughput at flat monthly cost, and full control over topic namespaces, access control, and data retention. Node-RED and InfluxDB round out the stack into a complete IoT data pipeline from device to dashboard.

Deploy your IoT hub: Browse Server.HK Hong Kong VPS plans — a 2 GB plan handles Mosquitto with thousands of concurrent device connections; add InfluxDB and Grafana on a 4 GB plan.