Prototypes: sim edges → Pi onboarding → wss/mTLS → two-tier backend spike

[ramaguruprakash]

What this is

The four working prototypes behind the decisions in docs/aws-arch-v2-plan.md
(PR #), built for #79 on a laptop + a Synergy Logic SL-RP4
(Raspberry Pi 4, 2 GB, 32-bit). Sharing them in-repo so the team can reproduce
the conclusions instead of taking the plan doc's word for them.

Each directory is self-contained (own compose file/scripts) with a README.md
(run + verify steps) and a LEARNINGS.md (what broke and why). P3 (MQTT meter
ingestion) was planned but not built — the numbering gap is intentional.

Prototype	Proves	Feeds the AWS plan as
p1-edge-to-backend	N simulated edges → one backend → InfluxDB; telemetry read back out via the UI websocket (probe scripts included)	The local stand-in for the ECS backend; source of the backend 2026.1.0 pin and the Felix config path==PID findings
p2-edge-on-pi	The edge runs natively on the real 2 GB Pi and onboards via an apikey registry (register-edge.sh → provision-edge.sh), coexisting with OpenPLC under a systemd memory cap	The onboarding flow — Odoo plays the registry role in the deployed stack
p4-secure-edge-backend	wss + mTLS in front of the backend (nginx TLS proxy, internal CA, per-edge client certs) — no OpenEMS code change needed, JVM truststore flags suffice; apikey confirmed hidden on the wire	ALB + ACM replaces the nginx proxy (PR-C); the mTLS pattern is reserved for the hardening phase
p5-two-tier-backend	Stock two-tier 2026.6.0 (backend + backend-edge) cannot serve a directly-connected edge with file metadata	Independent reproduction of upstream blockers OpenEMS/openems#3796 / #3797 — the evidence behind keeping the monolith pin until they land

Credentials / publication safety

• All secrets in here are documented throwaway local-dev credentials;
  simulator apikeys equal their edge-ids by design.
• The one real device apikey (slrp4-09) is redacted from the P1 registry;
  issue a fresh one with register-edge.sh --rotate when reproducing.
• TLS material for P4 is generated locally by make-certs.sh and gitignored —
  no keys or certs are in this PR.
• Personal device-access tooling and unrelated scripts from the original
  workspace were deliberately not imported.

How to try it

Start with prototypes/README.md, then p1-edge-to-backend/README.md —
P1 runs entirely on a laptop (./scale-edges.sh 5 && docker compose up -d),
no hardware or AWS needed. P2/P4 need a Pi; P5 is compose-only.