Who it is for
Businesses with several sites, equipment in other locations, or AI work that has to stay on their own hardware.
Home / Capabilities / Networking & Infrastructure
Capability 05
Private networks and servers that stay up and stay closed
For businesses with more than one site, remote equipment or AI they want to keep in-house. Your systems should be reachable by you and nobody else, so we connect them privately and host them where they fit best.
Who this is for, and what you get
The problem
Reaching a remote site often means opening it to the internet, and every opening is something outsiders can find and try.
What you get
A private network, servers or cloud hosting set up and documented, with health checks, recovery steps and a guide for running it.
What we build
What this covers
Zero-trust networking
Private Tailscale networks connect people, devices and servers without opening ports (doors) to the internet.
Self-hosted AI servers
Graphics-card (GPU) machines running speech and language AI on site, so data stays in the building and replies do not wait on a distant server.
Containerized deployments
Docker packs software into sealed bundles that can be rebuilt and moved reliably.
Cloud hosting
Fly.io machines for each customer workspace, and Netlify for websites and small server functions.
Remote site support
Diagnose, update and maintain systems in another country without exposing the site’s network.
Monitoring and recovery
Health checks, watchdogs (programs that spot a stuck service) and ways to undo a bad update, so failures are noticed and reversible.
Sample architecture
How it fits together
Devices reach the GPU server over the site network. Support connects privately.
The diagram, step by step
Follow one request at a site
Picture a sample visitor attraction with kiosks and staff tablets. Each dot in the diagram is a part of its setup. The switches above let you turn parts off, and the sentence under the diagram explains what happens next. It is a simulation, not a real network.
-
Devices ask for something
- What happens
- A kiosk, robot or staff device needs an answer. Each type sits in its own segment, a separate group on the network. A “flat” network, as in the opening scene’s switch, puts everything in one group.
- Who does it
- The devices on site.
- Why it matters
- Turn off the kiosk switch: the kiosks stop, and the rest keeps running.
-
The site network carries it
- What happens
- The request travels over the local network inside the building.
- Who does it
- The site network.
- Why it matters
- Local traffic does not need to leave the building at all.
-
The on-site server does the work
- What happens
- A GPU server, a computer built for heavy AI work, handles the request in the building.
- Who does it
- The GPU server, running AI models locally.
- Why it matters
- Answers do not travel to a distant data centre and back, and the data stays on site.
-
Docker keeps the software tidy
- What happens
- Each program runs in a sealed bundle called a container, with a written recipe for rebuilding it.
- Who does it
- Docker services on the site server.
- Why it matters
- If the software needs rebuilding, the recipe is already written down.
-
Tailscale connects it privately
- What happens
- Tailscale links approved devices and people into a private “mesh”. Each one must prove who it is before it can reach anything. That is what “zero-trust” means.
- Who does it
- Tailscale, using the rules we set up.
- Why it matters
- The site stays reachable to you, with no public door for outsiders to find.
-
The cloud handles what fits better
- What happens
- Some work runs on rented cloud servers: Fly.io for hosted services, and Netlify for websites and small functions.
- Who does it
- Fly.io and Netlify.
- Why it matters
- Lighter work does not need hardware on site. Try “AI in cloud” above to compare.
-
Engineers support it remotely
- What happens
- Support staff connect over the private network to diagnose and update systems, even from another country.
- Who does it
- Engineers on the private network.
- Why it matters
- Many problems can be looked at without anyone travelling or opening the site to the internet.
Turn off the “Internet link” switch to see the idea behind on-site hosting: the site keeps working on its own server while the outside connection is down. We settle what must keep working offline during the survey.
Zero-trust networking
Nothing to find from the outside
Private Tailscale networks connect people, devices and servers without opening ports (doors) to the internet.
Outside scan
0ports answering
Devices connect to each other over the mesh. A scan from the internet gets no reply.
How to read this demo
What the two settings show
Each square stands for a port, which is a numbered door a computer can answer on. The moving highlight is an outside scan, like the automated tools that sweep the internet. The numbers are illustrative, not a measurement of a real network.
-
Public ports
- What happens
- Some doors are open to the whole internet, so each one answers when a scan reaches it.
- Who does it
- Anyone on the internet can knock.
- Why it matters
- Every open door is something outsiders can find, probe and try to break into.
-
Private mesh
- What happens
- Devices talk to each other inside the private network, so nothing has to answer the public internet.
- Who does it
- Tailscale carries the traffic between approved devices.
- Why it matters
- The same scan gets no reply, and your people still reach everything they need.
Process
How the work runs, step by step
- 01
Survey
We list your sites, devices and connections, and what must keep working if the internet does not.
- Who does it
- Our team, with the people on site.
- What you get
- The plan starts from what you really have.
- 02
Design
We decide the network layout, who can reach what, and what runs on site versus in the cloud.
- Who does it
- Our team, with you signing off.
- What you get
- You agree a clear diagram and access rules before anything changes.
- 03
Deploy
We install the servers, software packages and private networking, and write it all down.
- Who does it
- Our team.
- What you get
- The setup is documented, not stored in one person’s head.
- 04
Hand over
We put monitoring, recovery steps and remote support in place before we step back.
- Who does it
- Our team, handing over to yours.
- What you get
- When something fails, someone is told and the steps to recover are written down.
The stack
Tools we run in production
We pick for your system. These are what we work with most in this area.
You do not need to know these names. In plain terms: Tailscale and Cloudflare Tunnel make private connections, Docker packages software, nginx directs web traffic, Linux runs the servers, Ollama and LiveKit run local AI and live voice, Fly.io and Netlify are cloud hosts, and a Raspberry Pi is a small low-cost computer.
- Tailscale
- Cloudflare Tunnel
- Docker
- Docker Compose
- nginx
- Linux
- Ollama
- LiveKit
- Fly.io
- Netlify
- Raspberry Pi
Deliverables
What you get
- Network and access diagram
- Configured private network
- Server or cloud deployment
- Backup and undo procedure
- Monitoring and health checks
- Operations guide
Related work
Where we have built this
Live entertainment and visitor attractions
EDROM RoboPark
Giant robot characters that hear, see and answer guests in four languages, with safe controls for movement and one screen to run the park.
AI software
InfiniBot
An AI operating system for a business: one always-on hub connecting 18 chat channels, background helpers, shared memory and 46 plugins, hosted privately or on your own computer.
Voice AI
Robovoice
A voice agent platform where speech recognition, the AI model and the voice can each run in the cloud or on your own hardware, with a desktop app for local calls.
FAQ
Common questions
What is a zero-trust private network?
A network where each device proves who it is before it can reach anything, instead of trusting everything inside an office. We use Tailscale so devices connect privately without public ports.
Should we self-host AI or use the cloud?
It depends on speed, privacy and cost. RoboPark runs almost everything on one computer at the park because every network hop adds delay. Lighter workloads usually fit the cloud better.
Do you install physical network equipment?
Tell us what your site needs and we will scope it. Our focus is the private network, servers and software layer.
Can you support a site in another country?
Yes. We maintain production systems in another country remotely, over private networking, without opening the site network to the internet.
Talk to us about networking & infrastructure
Answer a few questions and send them to us. We will tell you what we would build, and what you do not need.