2024–2025 · System design, backend, security and integrations
Device provisioning platform
Registering and configuring devices in batches of a few thousand
A hardware manufacturer needed a system for registering and provisioning its devices, in batches of around 2,000–3,000 at a time. For every device the workflow had to create an application record, an identity and a VPN configuration, which setup automation on the device then picked up.
Problem
Doing that by hand doesn’t work at this batch size. Each device also had to be consistent across the admin application, Authentik and the VPN configuration, without every system keeping its own copy of the device’s state.
Result
Registration handles batches of that size, and every piece of device state has one system that owns it. I don’t have before-and-after measurements, and my part ended in March 2025, so I can’t say how many devices run on the system today.
Decisions and implementation
- Built the central application in Laravel 11 with PostgreSQL and Redis queues. Laravel Horizon shows how provisioning jobs are progressing and which ones failed.
- Added registration for single serial numbers and ranges (for example E000001-E000230), also mixed in one comma-separated list. The application deduplicates the input into one list that an administrator approves.
- Gave each piece of state one owner: Laravel holds the device record and authorisation rules, Authentik handles identity and access, wg-portal and the generated WireGuard configuration cover VPN, and Nginx Proxy Manager covers the proxy layer. No component keeps its own copy of the device state.
- Secured the admin side with Laravel Policies and TOTP MFA with recovery codes, with the option to turn MFA off.
- Exposed a REST API as the only interface for device-side automation. Bash scripts on the device fetch their configuration through it and apply it.
- Delivered the system with Docker Compose and agreed the technical requirements with the manufacturer.
Technologies used
- PHP
- Laravel 11
- PostgreSQL
- Redis
- REST API
- WireGuard
- Authentik
- Docker Compose
- Bash
- Laravel Horizon
Notes from this project
Technical notes related to this project:
Related competencies
Related technology areas:
Related work history: experience.