Platform Architecture

Fleetera uses an edge-to-cloud architecture where lightweight gateways at customer sites acquire data from industrial equipment and stream it to a centralized cloud platform.

High-level overview

┌─────────────────────────────────────────────────┐
│                   CLOUD PLATFORM                │
│                                                 │
│  ┌─────────────┐  ┌──────────────────────────┐  │
│  │ Management  │  │    Backend Services       │  │
│  │     UI      │  │   (Asset, Tenant, Auth)   │  │
│  │  (Next.js)  │  │       (NestJS)            │  │
│  └──────┬──────┘  └────────────┬─────────────┘  │
│         │                      │                │
│         └──────────┬───────────┘                │
│                    ▼                            │
│         ┌──────────────────┐                    │
│         │   PostgreSQL     │                    │
│         │   (CloudNativePG)│                    │
│         └──────────────────┘                    │
└────────────────────┬────────────────────────────┘
                     │
                     │  Secure VPN tunnel
                     │  (WireGuard VPN)
                     │
┌────────────────────▼────────────────────────────┐
│              EDGE GATEWAY (per site)            │
│                                                 │
│  ┌─────────────────────────────────────────┐    │
│  │     Fleetera Edge Runtime               │    │
│  │     (config sync, protocol drivers,     │    │
│  │      store-and-forward buffering)       │    │
│  └──────────────────┬──────────────────────┘    │
│                     ▼                           │
│            Physical Equipment                   │
│     (Motors, Pumps, Sensors, PLCs, ...)         │
└─────────────────────────────────────────────────┘

Cloud components

Management UI

The web-based management interface where you configure your sites, assets, connectors, and deployments. Built with Next.js and React, it provides:

• Interactive site and asset hierarchy management
• Connector configuration and data model browsing
• Variable binding with AI assistance
• Edge deployment management and monitoring
• Real-time sync status tracking

Backend services

The cloud runs several API services:

• Asset Service — manages sites, assets, templates, variables, connectors, bindings, deployments, device shadows, and data models
• Tenant Service — handles organization and user management and access control
• Authentication Service — handles sign-in, registration, and session tokens

Additional services power telemetry reads, alerting, KPI computation, and command dispatch.

Database

Configuration and metadata — sites, assets, connectors, deployments, users — are stored in PostgreSQL. Each tenant's data is logically isolated using tenant IDs.

Data platform

Telemetry takes a separate path built for volume: readings arrive on Kafka, are processed by stream jobs, and land in ClickHouse for fast time-series queries, with long-term history tiered to object storage. Dashboards, KPIs, and alert evaluation read from this data platform rather than from PostgreSQL.

API host

Edge devices reach the cloud through one API host, which sends each request to the service that handles it and applies rate limits. Each service checks the caller's credentials itself.

Edge components

Fleetera Edge Runtime

The Fleetera Edge Runtime is a single lightweight service that handles everything the gateway does:

• Built-in protocol drivers — OPC UA, Modbus, MQTT, and REST drivers that talk directly to your equipment
• Configuration sync — the runtime polls the cloud for configuration changes (every 30 seconds), applies them to its in-process drivers, and reports the applied version back
• Store-and-forward buffering — telemetry lands in a two-tier local buffer (in-memory for normal operation, on-disk for outages) and is forwarded once connectivity is restored, so interruptions lose no data
• Heartbeats — sent to the cloud every 60 seconds to indicate the gateway is healthy
• Command execution — value writes from Fleet Control over OPC UA and Modbus, and OPC UA method calls without input arguments, are executed through the same protocol drivers

Two companion containers run alongside it: an Edge Crawler for on-site OPC UA address space discovery, and a Watchtower auto-updater that keeps the gateway's containers current.

Communication

Cloud-to-edge connectivity

Communication between the cloud platform and edge gateways uses a WireGuard-based VPN mesh network. This provides:

• Encrypted tunnels — all traffic between cloud and edge is encrypted end-to-end
• NAT traversal — works behind firewalls and NATs without port forwarding
• Stable addressing — each edge gateway gets a stable private VPN IP address
• Zero configuration networking — no VPN server infrastructure to manage

Data flow

Configuration flow (cloud → edge):

Management UI → Asset Service → Desired configuration
                                    ↓
                        Edge Runtime (polls every 30s)
                                    ↓
                        In-process protocol drivers

Telemetry flow (edge → cloud):

Physical Equipment → Edge Runtime protocol drivers
                          ↓
                 Store-and-forward buffer
                          ↓
                     Data Platform (Kafka → Flink → ClickHouse)

OPC UA discovery

OPC UA address space discovery runs on the edge gateway itself, using the edge crawler — a lightweight discovery container included with the gateway. When you need to browse an OPC UA server's data model:

1. You start a discovery crawl from the connector's Data Model tab in the Management UI
2. The Asset Service creates a crawl job for the site's gateway
3. The edge crawler on the gateway picks up the job and connects to the OPC UA server over the local network
4. The crawler traverses the address space, reports progress, and uploads the result to object storage
5. The Asset Service turns the result into a versioned data model you can browse in the Management UI

Because discovery runs at the site, the OPC UA server only needs to be reachable from the gateway — it never has to be exposed to the cloud.

Infrastructure

The cloud platform runs on Kubernetes, with:

• Ingress — Traefik for HTTP/HTTPS routing
• TLS — cert-manager with Let's Encrypt for automatic certificate management
• Storage — Longhorn distributed storage
• Secrets — External Secrets Operator syncing from AWS Secrets Manager
• CI/CD — GitHub Actions with self-hosted runners on the cluster

Edge gateways run Docker containers on standard Linux servers that you provide, set up with a single install command generated by the platform — see Hardware Requirements.

Next steps