The problem
Small sites have the same tickets as big ones and no one on staff to take them. The person who can fix things lives somewhere else. Every remote-access tool wants a port opened, software on each machine, or a monthly bill per seat, and the first time the router gets replaced it all stops working. Meanwhile nobody knows the printer went down until Sunday morning.
What I built
A Raspberry Pi flashed from a five-command runbook. Plugged in, it works out which network it is on, joins the client's private network, and announces that LAN as a route that is approved automatically. Then it scans the LAN, puts a row for every device on a status page, and buzzes a phone: new network, this many devices. From then on the box watches the site and the people the client names can reach the devices they are granted.
What changed
Card to reachable in under three minutes, measured. Plug-and-play discovery proven on four different networks. A full first visit rehearsed end to end on my own LAN before any client saw it, and two boxes built: one for a church pilot, one for my former employer. The whole kit is under a hundred dollars of hardware. It started as a Twingate box I shipped to relatives, and the Tailscale version replaced it for client sites.
What sits where
The box is the only new thing on the client's network. It dials out to the private network, which is how a phone or a laptop anywhere reaches the site without a single port being opened. A grant is one line in an admin console the client controls; remove the line and the access is gone.
Left: the site, exactly as it was, plus one box. Middle: a private network the client owns. Right: the people the client names, wherever they are.
What the box will and won't do
- It sees who is there, not what is inside. Discovery asks each device on the LAN whether it answers and what kind of thing it is. Reaching into a machine to use it is a separate grant, to a named person, that shows up in a log.
- The client owns the network. Each site's private network is created under an account the client holds, and I am invited in as an administrator. If they want me gone, it is one click on their side. Free at this scale.
- The box belongs to the network, not to a person. Nodes are tagged so they don't vanish when an account is removed, the box's key never expires, it updates itself, and a hardware watchdog reboots it if it hangs. A second imaged card in a drawer turns a dead SD card into a phone-call fix.
- It keeps watching without the internet. The monitoring runs on the box. When a site loses its connection the box keeps checking the LAN and reports the moment the outside world is back.
- Two sites with the same subnet don't collide. Every home router hands out the same addresses. Each site gets its own address mapping on the private network, designed in on day one rather than discovered at site four.
- Paper before plug. A one-page authorization from whoever owns the site, credentials in a per-client password-manager collection rather than my own vault, and the break-glass envelope, even for a church that isn't paying.
The first visit
The runbook is written for one visit, and it was rehearsed on my own network before any client saw it. Most of the time goes to naming things and to the one-time touch each managed machine needs.
Green dots are the box working by itself. Purple dots are the visit's real work: names, one-time touches, and proof from outside the building.
How it gets built
Every box is flashed from the same recipe. A small script writes the first-boot configuration, the OS image goes onto the card, two files are dropped on it, and the card goes in the Pi. The first boot creates the user, installs the private-network client and the monitoring container, turns on the hardware watchdog, moves logs into RAM so the card lasts, sets updates to apply themselves with an early-morning reboot, and joins the network with a key that was prepared in the client's admin console before the flash. Moving the box to a different network re-announces the new one; there is nothing to reconfigure. The private-network key is scrubbed off the card after the first login.
The first version of this, for family networks, ran a different connector and needed a one-gigabyte Pi at minimum. The current fleet runs on the cheapest Pi 5, because the private-network client idles in a few dozen megabytes, and the monitoring is the heavier tenant.
Where it stands
In build, with the plumbing proven and the product still being shaped. Two boxes exist: one rehearsed the full first visit on my own network and now also serves a couple of small sites of mine, the other is built for a church pilot and waiting on the visit. After the pilot: a retainer for my former employer's office, then a paid version with a flat price per site. The next feature is self-healing, the box power-cycling a wedged router or access point through a smart plug and only paging a human when that didn't work, which is the same pattern that already keeps my homelab up. Client-branded status pages are queued behind it.
The name is piGate. The site names in the drawings are made up, and no client is named on this page.
Stack
All open, established tools. Nothing here depends on me staying involved, which is the first thing a client should ask.
Built in conversation
Same method as everything on this site. The route-approval trick, the discovery service, the first-visit runbook, and the list of gotchas that bite six months later (key expiry, card death, the wrong network profile on Windows) all came out of dialogue with Claude, then were proven on real hardware one flash at a time.
The philosophy, the homelab it grew out of, or what I'm building right now.