The next question would be: How to do authorization on mqtt. As netmaker uses client certs and mosquitto use clients certs as authorization. As above solution uses http routers, not the Traefik tcp routers, I suppose it could be extended with Traefik also checking the proper client cert before upgrading the connection to secure websockets.