Skip to content

Operating a fleet

Fielding one AryaOS box is easy. Keeping a fleet of them healthy over a fire season, an exercise, or a search-and-rescue callout is the day-2 job. This section covers the routine operations: keeping units patched, diagnosing them When something's off, and letting them find each other on the mesh.

Day-2 operations

flowchart LR
    K[Keep updated] --> D[Diagnose]
    D --> M[Monitor]
    M --> K
    K -.-> U[aryaos-update]
    D -.-> S[aryaos-support-bundle]
    M -.-> N[GutCheck discovery]
  • Keep updated - apply patches from the signed snstac repo with one click. Debian security fixes land automatically. The sensor stack is a deliberate, operator-driven decision so you never restart a sensor mid-operation by surprise.
  • Diagnose - when a unit misbehaves in the field, generate a redacted support bundle and attach it to a report instead of trying to describe the problem over the radio.
  • Monitor - every AryaOS box beacons itself on Mesh SA, so any unit is Nearby nodes card shows the rest of the fleet, their roles, health, and a direct admin link.

Operations tasks

  • Updates - Use one-click patching from the signed snstac apt repository. Learn what runs automatically. Updates
  • Support bundles - redacted diagnostics for field reports. Exactly what's collected and redacted. Support bundles
  • SBOM & supply chain - SPDX + CycloneDX for every image build, and the signed-repo trust anchor. SBOM & supply chain
  • Nearby nodes - Mesh SA self-discovery so a fleet finds itself. Nearby nodes
  • Security posture - the hardening every operation rests on. Security posture

Media, config & decommissioning

  • Install media longevity - the write-avoidance tuning that keeps SD/NVMe media alive. On by default, nothing to configure. Install media longevity
  • Back up & restore - snapshot the full config set and migrate it to a replacement box. Back up & restore
  • Factory reset - return a box to its just-flashed state without re-flashing. Factory reset
  • Zeroize - best-effort secure sanitize for decommission or capture. Zeroize

Most of this lives on one page

Software updates, support bundles, the Node-RED password, and nearby nodes are cards on Cockpit > AryaOS Site. You can operate this page with gloves. The pages in this section explain what each card does under the hood.

Rotate the Node-RED password before fielding

Node-RED ships with a publicly known default admin password and its editor Can run code on the device. Rotate it from the Node-RED admin password control on the AryaOS Site page before a unit leaves the bench - see Security posture.

Remote and disconnected operations

Not every unit is within arm's reach:

  • Remote units - reach a fielded box from anywhere over the Tailscale VPN. No port forwarding required.
  • No-network units - administer a box over a Bluetooth PAN link when there's no Wi-Fi or Ethernet.