Executive Summary
In most industrial operations today, when a motor fails or a process drifts out of spec, the failure is discovered after the fact. Power generation, HVAC, physical security systems, and building management infrastructure run continuously across plants, distribution centers, utility installations, and remote sites. These systems are, in the vast majority of cases, decades old, proprietary, and entirely unmonitored at scale. There is no unified visibility layer. There is no early warning. There is no way for central operations teams to understand the operational state of distributed OT infrastructure without dispatching personnel.
This white paper describes an architecture that changes that. Portainer provides a containerized workload management plane capable of running on the smallest OT gateway hardware. Xiid’s Terniion provides deterministic, outbound-only secure connectivity that makes OT devices non-addressable from the public internet while maintaining continuous, encrypted telemetry back to a self-hosted central operations plane.
The stack is self-hosted end-to-end. There is no SaaS control plane. There is no external infrastructure dependency. Every component runs on hardware the operator controls, in facilities the operator controls.
Because OT environments are heterogeneous, this paper describes the architecture in three layers: a generic technical foundation that applies to every deployment, a set of deployment patterns matched to common industrial scenarios, and a set of worked examples showing how the same building blocks address very different operational realities.