Good article (along with parts 2 and 3). Are there key differences in secure networking constructs (TLS, mTLS, VPN, whitelisted IPs, open ports, etc.) in the options described:
Of those, MQTT should be the only thing you expose to the outside world. Secure it with regular TLS, possibly with mutual auth for your clients if you care about that.
For the others, secure them using the same tech you use to secure your database. Ideally they wouldn't be accessible from the internet at all.
+ inbound to Kafka clusters and Kafka Connect?
+ inbound to Mosquitto MQTT broker?
+ inbound to Telegraf?
+ inbound to influxDB?