Production Infrastructure: On-Site Factory Services & Secure Remote Access

I built and operate a server infrastructure that runs on-site, inside BESA's factory, managing different steps of the production process.

What runs on-site

This server hosts several independent services (FastAPI-based, behind nginx) covering different production needs: stock/inventory tracking, recipe/product-tree (BOM) management, demand/order tracking, serial number assignment for manufactured units, result logging and statistics for a LoRaWAN module test station, and live tracking of LoRaWAN devices on the production line. An MQTT broker also handles real-time communication with devices on the line, such as serial number assignment.

Bridging production to the cloud

A device coming off the production line needs to be automatically registered with the cloud-based monitoring/control system (WELCO). I wrote a bridge service that talks over MQTT between the factory server and the cloud server: when a device gets a serial number on the line, the bridge adds it to the cloud side automatically, and removes devices that are pulled off the line or decommissioned. This keeps production and the cloud/monitoring side in sync without manual work.

Managing the factory network without exposing it

This server isn't directly reachable from the internet, yet remote access and monitoring are still needed. I solved that with two independent channels:

• WireGuard mesh: the server is part of the same private VPN network as the other sites and the central infrastructure.
• Reverse SSH tunnel: the server keeps a persistent autossh tunnel open to the cloud server and exposes its own service ports through that tunnel, reachable only from the cloud server itself. That way, no inbound port ever needs to be opened on the factory side, while the services remain reachable through the cloud when needed.

Keeping the two channels independent means one path stays up even if the other has an issue.

A minimal illustration

A tiny example capturing the reverse-tunnel idea, unrelated to the real configuration:

autossh -M 0 -N \
  -R 127.0.0.1:7655:127.0.0.1:8000 \
  -i key.pem -p 2222 user@relay-server