A metal fabrication shop we work with moved its job and spool tracking into a web app hosted in Microsoft Azure. Office staff, the shop floor and management all see the same live status. It works well, with one problem every manufacturer runs into sooner or later: labels.
The labels print on industrial printers on the shop's own network. The app lives in the cloud. A cloud app can't open a connection into a private shop network, and it shouldn't be able to.
The usual answers are the wrong ones
The common fixes are a VPN between the cloud and the shop, or a firewall rule that lets traffic in to the printer. Both work. Both also create a path from the internet into the shop network, one more thing to secure and maintain, and one more thing that breaks when the office internet provider changes something.
Pull, don't push
We turned the direction around. A Raspberry Pi, a small inexpensive computer, sits on the shop network next to the printers and runs a print agent we built. Every few seconds the agent asks the cloud app whether any labels are waiting. When there are, it downloads them, sends them to the right printer and reports back whether each one printed.
Every connection starts from inside the shop and goes out. Nothing ever connects in to the shop network. There is no VPN and no firewall change, and it works on any ordinary internet connection that can already browse the web.
Security in a device on the shop floor
A device in a workshop can be unplugged, carried off or tampered with, so we gave it as little power as possible:
- It can only move labels. The agent has no database access and knows nothing about jobs or customers. It receives print data and passes it to a printer. If it were stolen, that is all it could do.
- Each device has its own key. The key is generated once, shown once and stored only as a hash in the database. If it is lost, we issue a new one; there is no way to recover the old one.
- Revoke, don't delete. Turning off a device marks its key as revoked instead of deleting its record, so the print history stays tied to the device that did the printing.
- Nothing to install. The agent ships with everything it needs to run, so reinstalling the Pi or updating its operating system can't break it.
Why this matters beyond labels
This is a common pattern in manufacturing and warehouse work. Modern software runs in the cloud, but the equipment is on the floor: label printers, scales, scanners and PLCs. The easy fix, opening the network, is usually the wrong one. A small agent that pulls work outbound lets you connect the two without weakening the network your production depends on.
We apply the same thinking in CloudSmart, our labor-tracking product for manufacturers and warehouses, and in the systems integration work we do for plants and shops. If your floor equipment and your software don't talk to each other, let's talk.