diff --git a/db/.env.template b/db/.env.template
index b76ca87..c64dd27 100644
--- a/db/.env.template
+++ b/db/.env.template
@@ -1,2 +1,4 @@
 INFLUX_PORT=8181
 UI_PORT=8093
+MQTT_USERNAME=
+MQTT_PASSWORD=
diff --git a/db/README.md b/db/README.md
index 3e52a95..5e95ebd 100644
--- a/db/README.md
+++ b/db/README.md
@@ -6,7 +6,7 @@
 echo "apiv3_$(openssl rand -base64 64 | tr -d '+/=')" > secrets/admin-token.txt
 ```
 
-2. Copy `.env.template` to `.env` and change value if necessary:
+2. Copy `.env.template` to `.env` and change/add value if necessary:
 
 ```bash
 cp .env.template .env
diff --git a/db/docker-compose.yml b/db/docker-compose.yml
index f5af80f..12241c7 100644
--- a/db/docker-compose.yml
+++ b/db/docker-compose.yml
@@ -60,8 +60,23 @@ services:
         provence || echo "Database provence already exists"
       '
 
+  mqtt:
+    image: rabbitmq:4-management-alpine
+    container_name: mqtt
+    restart: unless-stopped
+    ports:
+      - "15672:15672" # Management plugin HTTP port
+      - "1883:1883" # MQTT port
+    volumes:
+      - rabbitmq_data:/var/lib/rabbitmq
+    environment:
+      - RABBITMQ_DEFAULT_USER=$MQTT_USERNAME
+      - RABBITMQ_DEFAULT_PASS=$MQTT_PASSWORD
+    command: sh -c "rabbitmq-plugins enable rabbitmq_mqtt && rabbitmq-server"
+
 volumes:
   influxdb3_data:
+  rabbitmq_data:
 
 secrets:
   admin-token:
diff --git a/db/traefik.yml b/db/traefik.yml
index 3a41358..437d41b 100644
--- a/db/traefik.yml
+++ b/db/traefik.yml
@@ -19,6 +19,13 @@ http:
         certResolver: letsencrypt
       # middlewares:
       #   - oidc-auth-pi-db@file
+    pi-mqtt-management:
+      rule: "Host(`mqtt.e.kb28.ch`)"
+      entryPoints:
+        - websecure
+      service: pi-mqtt-management
+      tls:
+        certResolver: letsencrypt
 
   services:
     pi-db:
@@ -26,3 +33,24 @@ http:
         servers:
           - url: "http://192.168.42.211:8093"
         passHostHeader: true
+    pi-mqtt-management:
+      loadBalancer:
+        servers:
+          - url: "http://192.168.42.211:15672"
+        passHostHeader: true
+
+tcp:
+  routers:
+    pi-mqtt:
+      rule: "HostSNI(`mqtt.e.kb28.ch`)"
+      entryPoints:
+        - "mqttsecure"
+      service: pi-mqtt
+      tls:
+        certResolver: "letsencrypt"
+
+  services:
+    pi-mqtt:
+      loadBalancer:
+        servers:
+          - address: "192.168.42.211:8883"