Install Node-RED

Download and run the Node-RED installation script:
```
bash <(curl -sL https://github.com/node-red/linux-installers/releases/latest/download/install-update-nodered-deb)
```
tip
The release asset above is named install-update-nodered-deb — if it 404s in the future, check the node-red/linux-installers releases page for the current asset name.
Enable the Node-RED service to start automatically on boot:
```
sudo systemctl enable nodered.service
```
Reboot the system to complete the installation:
```
sudo reboot
```
Now, you can access Node-RED at this address: http://[TARGET IP ADDRESS]:1880/

Hardening & Data Flow

Set an explicit credential-encryption secret. Without this, Node-RED regenerates a new one on every restart and any stored flow credentials become unrecoverable. In ~/.node-red/settings.js, uncomment and set:
```
credentialSecret: "<a random secret>",
```

Secure the editor. It is wide open by default — Node-RED's own install output explicitly warns against exposing it unsecured. Generate a password hash:

node-red admin hash-pw

Then, in settings.js, uncomment and fill in the adminAuth block with that hash:

adminAuth: {
    type: "credentials",
    users: [{
        username: "admin",
        password: "<bcrypt hash from above>",
        permissions: "*"
    }]
},

sudo systemctl restart nodered.service

Install the InfluxDB node:
```
cd ~/.node-red && npm install node-red-contrib-influxdb
sudo systemctl restart nodered.service
```
tip
A restart is required — Node-RED does not hot-load newly installed node types while already running.
Build a flow: MQTT in (topic application/+/device/+/event/up, broker localhost:1883) → Function (parse the ChirpStack uplink JSON, set msg.measurement and msg.payload = [fields, tags]) → InfluxDB out (config node: influxdbVersion: "2.0", url: http://localhost:8086, token from the Install InfluxDB step; node: org: fiber, bucket: fiber).

tip
Without a LoRaWAN gateway/device connected yet, this flow is scaffolding — build it now so it's ready as soon as a gateway and device are registered (see Register a Gateway and a Device above) and passing real uplinks.

Hardening & Data Flow​

Hardening & Data Flow