Hermetry doesn’t care, it only sees a TLS connection on 8883 (or HTTPS on 443). Ethernet or WiFi is invisible to it.
For one board I’d get an Olimex ESP32-POE-ISO. I have three in a greenhouse. Isolated PoE, Ethernet on board, works with the normal ESP32 Arduino core. On ESP32 the Ethernet goes through the same network stack as WiFi, so WiFiClientSecure and PubSubClient work unchanged:
#include <ETH.h>
#include <WiFiClientSecure.h>
#include <PubSubClient.h>
WiFiClientSecure net;
PubSubClient mqtt(net);
void setup() {
ETH.begin(); // ESP32-POE-ISO defaults
while (!ETH.linkUp()) delay(200);
net.setCACert(ROOT_CA); // public CA, broker host has a public cert
mqtt.setServer(BROKER_HOST, 8883); // host NAME, not IP (SNI)
}
void loop() {
if (!mqtt.connected()) mqtt.connect("barn-01", ACCESS_TOKEN, NULL);
mqtt.loop();
// every 60 s:
// mqtt.publish("v1/telemetry", "{"temperature":7.4,"humidity":81}");
}
Token is the username, password empty. PubSubClient only publishes QoS 0, which Hermetry accepts. Steps for the token are in Connect your first device.
And on the non-ISO version don’t power it from USB and PoE at the same time, I lost a laptop USB port that way.

