Platform Architecture

Fleetera uses an edge-to-cloud architecture where lightweight gateways at customer sites acquire data from industrial equipment and stream it to a centralized cloud platform.

High-level overview

┌─────────────────────────────────────────────────┐
│                   CLOUD PLATFORM                │
│                                                 │
│  ┌─────────────┐  ┌──────────────────────────┐  │
│  │ Management  │  │    Backend Services       │  │
│  │     UI      │  │  (Asset, Tenant, Bridge)  │  │
│  │  (Next.js)  │  │       (NestJS)            │  │
│  └──────┬──────┘  └────────────┬─────────────┘  │
│         │                      │                │
│         └──────────┬───────────┘                │
│                    ▼                            │
│         ┌──────────────────┐                    │
│         │   PostgreSQL     │                    │
│         │   (CloudNativePG)│                    │
│         └──────────────────┘                    │
└────────────────────┬────────────────────────────┘
                     │
                     │  Secure VPN tunnel
                     │  (WireGuard VPN)
                     │
┌────────────────────▼────────────────────────────┐
│              EDGE GATEWAY (per site)            │
│                                                 │
│  ┌─────────────────────────────────────────┐    │
│  │     Fleetera Config Agent               │    │
│  │     (polls cloud for config changes)    │    │
│  └──────────────────┬──────────────────────┘    │
│                     ▼                           │
│  ┌─────────────────────────────────────────┐    │
│  │     Fleetera Edge                       │    │
│  │     (device services, core data)        │    │
│  └──────────────────┬──────────────────────┘    │
│                     ▼                           │
│            Physical Equipment                   │
│     (Motors, Pumps, Sensors, PLCs, ...)         │
└─────────────────────────────────────────────────┘

Cloud components

Management UI

The web-based management interface where you configure your sites, assets, connectors, and deployments. Built with Next.js and React, it provides:

• Interactive site and asset hierarchy management
• Connector configuration and data model browsing
• Variable binding with AI assistance
• Edge deployment management and monitoring
• Real-time sync status tracking

Backend services

The cloud runs several API services:

• Asset Service — manages sites, assets, templates, variables, connectors, bindings, deployments, and device shadows
• Tenant Service — handles organization management, user authentication, and access control
• OPC UA Bridge — a centralized proxy that connects to remote OPC UA servers for address space discovery and data model crawling

Database

All platform data is stored in a PostgreSQL cluster managed by CloudNativePG (a Kubernetes-native operator). Each tenant's data is logically isolated using tenant IDs.

API Gateway

An API gateway (KrakenD) handles routing, JWT validation, rate limiting, and CORS for all API traffic.

Edge components

Config agent

A lightweight Go application that runs on the edge gateway. It continuously polls the cloud for configuration changes using the device shadow pattern:

1. Checks the deployment shadow for pending changes (every 30 seconds)
2. Downloads the new configuration bundle when changes are detected
3. Applies the configuration to Fleetera Edge core services
4. Reports success or failure back to the cloud
5. Sends periodic heartbeats to indicate the gateway is healthy (every 60 seconds)

Fleetera Edge

Fleetera Edge is the IoT edge runtime that handles the actual communication with physical devices. It provides:

• Device services — protocol-specific drivers (OPC UA, Modbus, MQTT, BACnet)
• Core data — local data collection and buffering
• Core metadata — device profile and device configuration management
• Core command — device command execution

The config agent manages Fleetera Edge by creating and updating device profiles and device configurations based on the configuration pushed from the cloud.

Communication

Cloud-to-edge connectivity

Communication between the cloud platform and edge gateways uses a WireGuard-based VPN mesh network. This provides:

• Encrypted tunnels — all traffic between cloud and edge is encrypted end-to-end
• NAT traversal — works behind firewalls and NATs without port forwarding
• Stable addressing — each edge gateway gets a stable private VPN IP address
• Zero configuration networking — no VPN server infrastructure to manage

Data flow

Configuration flow (cloud → edge):

Management UI → Asset Service → Device Shadow
                                    ↓
                             Config Agent (polls)
                                    ↓
                            Edge core-metadata
                                    ↓
                            Device Services

Telemetry flow (edge → cloud):

Physical Equipment → Edge Device Services
                          ↓
                     Edge Core Data
                          ↓
                     Data Platform (Kafka → Flink → ClickHouse)

OPC UA Bridge

The OPC UA Bridge is a centralized service running in the cloud that handles OPC UA address space discovery. When you need to browse a remote OPC UA server's data model:

1. The Management UI sends a crawl request to the Asset Service
2. The Asset Service delegates to the OPC UA Bridge
3. The Bridge connects to the OPC UA server via the VPN mesh
4. The Bridge crawls the address space and uploads the result to object storage
5. The result is available for browsing in the Management UI

This centralized approach means you don't need OPC UA client libraries on the edge gateway itself.

Infrastructure

The cloud platform runs on Kubernetes (K3s) on Hetzner Cloud, with:

• Ingress — Traefik for HTTP/HTTPS routing
• TLS — cert-manager with Let's Encrypt for automatic certificate management
• Storage — Longhorn distributed storage
• Secrets — External Secrets Operator syncing from AWS Secrets Manager
• CI/CD — GitHub Actions with self-hosted runners on the cluster

Edge gateways run Docker containers on standard Linux servers, provisioned via Terraform.

Next steps