infinimesh v3.4.0: rules, alarms and OTA in the device layer

infinimesh v3.4.0: rules, alarms and OTA in the device layer

infinimesh 3.4 is the release where the device layer gets the parts you need to run a product on it. Rules and alarms now run in core, with a console page. OTA has a clear contract in the device shadow, and only a registered OTA addon can switch it on. Core, inf-cli, the platform operator and the Helm chart now ship together from one tag.

Apache-2.0, self-hosted, no paid tier. The device layer for your IoT and AI stack.

New to the CLI? Start with Getting started with inf.

Highlights

• Rules and alarms in core. CEL conditions, raise, ack and clear, cooldown, and four actions. Managed from the new "Rules and Alarms" console page, REST or Connect.
• OTA contract. Target version in desired state, status in reported state, bulk assign, audit on every assign. OTA addons for hawkBit, Mender or a webhook plug in through the plugins API.
• Audit log. Shadow reads, device creation, device tokens, OTA assigns, alarm ack and clear, plugin create and delete.
• Production parts. Namespace quotas, Prometheus metrics, OTLP traces, Redis MQTT sessions, CoAP ingest, file storage with http-fs.
• inf CLI 3.4. Rules, alarms, audit, plugins, OTA and quotas from the terminal. Install with Homebrew.
• Lockstep releases. One core tag releases core, inf-cli, platform-operator and the Helm chart.

Rules and alarms

A rule belongs to a namespace. Its condition is a CEL expression over reported, desired, connected, device, title, tags and ns. A value stored at reported.data.temp reads as reported.temp in a rule.

• A true condition raises an alarm for that rule and device. Alarms can be acked and clear when the clear condition is true. cooldown is the shortest wait before the same alarm can be raised again.
• Actions: log, webhook signed with HMAC-SHA256 (X-Infinimesh-Signature), MQTT publish, or a desired state patch.
• A new rule is checked against the current state of every device right away.
• Deleting a rule deletes its alarms. The default alarm list shows raised and acked alarms and hides cleared ones.
• REST: /v1/rules, /v1/alarms. Connect: infinimesh.node.v1.RulesService.
• Console: the "Rules and Alarms" page starts on the namespace selected in the header and asks before deleting a rule.

OTA contract

infinimesh does not ship firmware. It holds the contract between your device and your update server.

• Only OTA addons register with core. An OTA addon is a plugin of kind OTA, created through the plugins API with a root token (inf login --root). Its provider is hawkbit, mender or webhook. The bearer token is returned once, at creation.
• Namespace switch. A namespace OTA provider is none, hawkbit, mender or webhook. OTA can only be enabled once an OTA addon is registered. The console shows "Register an OTA addon first" until then.
• Who may write. For hawkbit, mender and webhook, OTA writes need the addon's token. A token issued for one provider is refused on a namespace using another. With provider none, a manage-level account can write.
• Shadow. desired.ota and reported.ota carry version, url, sha256, size, status, error and updated_at. Any other key is rejected. The shadow stream emits OTA_TARGET_SET and OTA_STATUS_CHANGED.
• Bulk assign. POST /v1/devices/ota:assign sets a target for a list of devices, a tag or a namespace. It needs an account or addon token. It returns one result per device, so a 200 can still carry errors for single devices. Check each result.
• Audit. Every successful assign writes ota_assign, with the plugin uuid and addon token id when an addon made the call.

Every other addon (Kafka, Postgres, InfluxDB, webhook, S3 and the rest) does not register with core. It uses the API with a normal token, the same as before.

Audit log

Append only. Rows for shadow reads, device creation, device token minting, ota_assign, alarm_ack, alarm_clear, plugin_create and plugin_delete. Query with GET /v1/audit by device, account or namespace.

GET /v1/devices/{device}/export returns the registry entry, current shadow and history references. Grants carry expires_at and a consent record. These are the building blocks for EU Data Act access requests. They do not make a product compliant by themselves.

Fleet and quotas

• BulkCreate, factory claim tokens (IssueClaim, Claim), RotateCertificate and RevokeCertificate. A rotated certificate keeps the previous one valid during rollover. A revoked certificate is rejected.
• POST /v1/devices/states:patchMany sets desired state for a namespace or tag.
• Namespace quotas limit device count and message rates on the MQTT bridge and on HTTP ingest. Zero means no limit.

Protocols, sessions and files

• CoAP. Reported state over UDP on 5683. It is plaintext with no DTLS, so keep it on a private network.
• MQTT. MQTT_SESSION_STORE=redis keeps bridge sessions in Redis, so a reconnect can land on another replica. Port 1883 only listens with MQTT_PLAINTEXT=1. Optional ECDSA server certificate next to the primary one. TLS 1.2 minimum.
• http-fs. Namespace files for the console media page. Local volume by default, or any S3 endpoint with HTTP_FS_S3_ENDPOINT. HTTP_FS_MAX_BYTES and HTTP_FS_TYPES limit size and type. Image: ghcr.io/infinimesh/core/http-fs.
• Observability. /metrics on api, shadow, gateway, pairing, console, mqtt-bridge and rules, including infinimesh_up. OTEL_EXPORTER_OTLP_ENDPOINT exports traces.

inf CLI 3.4

inf 3.4 covers rules, alarms, audit, plugins, namespace OTA, quotas, media and metrics, plus inf login --root for creating OTA addons.

brew tap infinimesh/inf-cli https://github.com/infinimesh/inf-cli
brew install inf
inf login api.example.com:443
inf --token "$ADDON" ota assign --device <device> --version 1.2.3

Prebuilt archives for macOS, Linux and Windows are on the inf-cli releases page. Full walkthrough: guides/cli-getting-started.md.

Lockstep releases

A core tag now releases everything at the same version:

Repo	What ships
core	images at ghcr.io/infinimesh/core/<service>:v3.4.0 and :latest
inf-cli	binaries, GitHub release, Homebrew formula
platform-operator	ghcr.io/infinimesh/platform-operator:v3.4.0, default core version v3.4.0
k8s	Helm chart at oci://ghcr.io/infinimesh/charts

helm install infinimesh oci://ghcr.io/infinimesh/charts/infinimesh --version 3.4.0

Release candidate images (v3.4.0-rc.N) are for testing only and are removed.

Upgrading from 3.2

• Upgrade inf-cli too. The 3.2 CLI uses the old proto paths and cannot log in to a 3.4 core. Run brew upgrade inf or download 3.4.
• API paths. The API is infinimesh.node.v1 and REST lives under /v1. The old REST paths still answer. /v1/handsfree is now /v1/pairing, and the old paths stay for one minor release.
• Compose. Set INFINIMESH_VERSION=v3.4.0 in .env. Redis 6379 and AMQP 5672 are no longer published on the host.
• MQTT. Plaintext 1883 is off unless you set MQTT_PLAINTEXT=1.
• Plugin queues. A plugin.<name> queue left over from 3.2 has to be deleted once so the shadow service can declare it as durable.
• Device tokens. A device token expires in 24 hours when no expiry is set. Reported writes need post or manage level, desired writes need manage level. An unknown access level returns 400.
• Lists. List methods return pages of 100 by default, at most 500.
• OTA. If you used the 3.4 release candidates, register an OTA addon before enabling OTA on a namespace.

Full details in CHANGELOG.md, including v3.3.0.

What comes next

hawkBit and Mender OTA addons. After that, an MCP server and an LLM addon, both coming soon and scoped by the same permission graph as people.

Bugs and questions: core issues.

v3.4.0-rc.9

This release is for testing, not for production.

Fixed

• An addon ota_assign row records the plugin uuid and the addon token id.
• POST /v1/devices/ota:assign tells a device token that bulk assign needs an account or addon token. The single-device state patch still accepts a device token.

v3.4.0-rc.8

This release is for testing, not for production.

Fixed

• An OTA plugin token and a device token load the namespace without an account claim. A token issued for mender is refused on a namespace whose provider is hawkbit.
• Creating a plugin records plugin_create. Deleting a plugin records plugin_delete.
• The root token used to create a plugin is a login with inf set to true. A login without it gets 403.

v3.4.0-rc.7

This release is for testing, not for production.

Fixed

• hawkbit, mender, and webhook OTA writes require the bearer token issued when the OTA plugin was created. The x-infinimesh-ota-provider header is not a credential. Provider none still accepts a manage-level account, and a device token with manage access.
• POST /v1/devices/ota:assign and a single device state patch accept an account token. A missing account does not crash the API.
• A successful desired.ota write records audit action ota_assign. Acknowledging or clearing an alarm records alarm_ack or alarm_clear. GET /v1/audit?namespace= lists rows for that namespace.
• The default alarm list includes acknowledged alarms and leaves out cleared ones.
• Turning OTA off keeps backend_url and backend when the request omits them.
• Creating an OTA plugin returns its bearer token once.
• The rules page starts on the namespace selected in the header. Deleting a rule asks for confirmation.

v3.4.0-rc.6

This release is for testing, not for production.

Added

• data.ota is version, url, sha256, size, status, error, and updated_at. A state patch rejects any other ota key.
• A namespace OTA provider is none, hawkbit, mender, or webhook. Enable stays off until a plugin of kind OTA is registered. POST /v1/devices/ota:assign sets a target version for devices, a tag, or a namespace and returns a result per device. The shadow stream emits OTA_TARGET_SET and OTA_STATUS_CHANGED. Each successful assign writes audit action ota_assign.

Fixed

• The rules page uses infinimesh.node.v1.RulesService. Save calls Create.
• The device card has no OTA on/off switch. The namespace page sets the provider. Enable is active only when an OTA addon is registered. The device list shows reported.data.ota.status. Assign calls POST /v1/devices/ota:assign.
• Local setup: accept the self-signed certificate separately for console, api, and media.

v3.4.0-rc.5

This release is for testing, not for production.

Fixed

• The console calls Connect on infinimesh.node.v1 and infinimesh.plugins.v1. Login uses /infinimesh.node.v1.AccountsService/Token.
• POST account token with no auth returns invalid_argument. It does not crash the API.
• The alarm title is the rule name. Clear does not keep an alarm cleared while the condition is still true. cooldown is the shortest wait after a raise before it can be raised again.

v3.4.0-rc.4

This release is for testing, not for production.

Fixed

• Acknowledging an alarm and then clearing it no longer fails. An alarm is stored as plain fields. Its key is the rule uuid, and title is the rule name. Deleting a rule deletes its alarms.
• Creating a device and minting a device token are written to the audit log. GET /v1/audit returns those rows for device and for account.

v3.4.0-rc.3

This release is for testing, not for production.

Fixed

• The rules service watches every device in a namespace. A new rule is checked against current device state. A reading can raise an alarm, and that alarm can be acknowledged and cleared. A rule reads reported.temp for a value stored at reported.data.temp, and reported.ota for a value stored at reported.data.ota.

v3.4.0-rc.14

This release is for testing, not for production.

Fixed

• inf alarms list and inf rules create accept -n for the namespace.
• inf creates the config folder when that folder is missing.

v3.4.0-rc.13

This release is for testing, not for production.

Fixed

• The console footer shows the version stamped at build time.
• The namespace picker loads the full namespace list, including one just created.
• Rules and alarms load when the page opens.
• A device shows whether its namespace has OTA on, the desired target, and the reported status.
• The theme toggle applies light, dark, or the system theme.