1

The PIs are all imaged off the same SD card. The only difference is the Mac Address / CPU ID. I monitor them with a python script that pings my webserver on a regular basis to upload data.

The problem is, its one-way communication and sometimes the units stop responding and I have to go out in the field and plug in a keyboard. Half the time, if I could just SSH in, I could fix it from home.

Remote services are too expensive once you start getting into 10+ units. This should be simple but I can't seem to wrap my head around it. Should I create a Bastion host that all the units log in to? would that even allow me to tunnel in?

Do I need to set up some kind of SSH hub?

This is a bit on the DevOps edge of my knowledge, which is mostly system design and app development.

Improve this question
1

1 Answer 1

Reset to default
3

In a general, you can use some kind of VPN where they connect at boot and maintain this connection (it's cheap), so even if you don't have an option to have a direct connection to your devices, you may connect to them over the VPN. Then use the VPN server as a jump host.

Depending on your preference and policy, you probably can even install the VPN service on the same machine which hosts your web server.

WireGuard will do and it is easy to setup for this use case. OpenVPN could be used too. The configuration is simplest one in both cases, you don't need fancy things like default route via VPN and the like.

I have Raspberry Pi's which I can access that way, though not 50 of them.

Improve this answer
3
  • What if they are all behind firewalls?
    – Seamus
    Jan 19 at 9:18
  • 1
    We only need from the firewall that it permits to establish this channel. And then, when the channel is established, firewalls are essentially bypassed through it. If they can access your web server, why won't they be able to access your VPN server? In the extreme case, even all they have is only an access to your server's port 443 TCP (with everything else is blocked), you still can use tools like sslh to make both web service and OpenVPN accessible through this single port. (WireGuard won't work over TCP.)
    – Nikita Kipriyanov
    Jan 19 at 10:13
  • 2
    @NikitaKipriyanov I think the information from your comment should be added to the answer.
    – Bodo
    Jan 19 at 21:04

Not the answer you're looking for? Browse other questions tagged or ask your own question.