Fleet automation
Every franchise location ran its own signage player on its own consumer internet connection. We put the fleet on a Tailscale mesh and drove it with Ansible, so content, patching and provisioning stopped needing anyone on site.
Multi-location franchise · Canada, multi-province · anonymised at the client's request
The situation
Signage players were scattered across franchise locations nationwide, each behind a different consumer ISP, each behind NAT, none with a static address.
Reaching a player meant a site visit, or talking a franchisee through unplugging something over the phone. Neither scales, and franchisees are running a business, not a helpdesk.
Content changes, OS patching and the occasional wedged player all queued up behind that same problem, so screens drifted out of date and out of compliance with brand standards.
Opening a location meant configuring hardware by hand and hoping it matched the last one.
The work
Tailscale puts every player on one flat, authenticated network without port forwarding, static IPs, or asking a franchisee to touch their router. Nothing is exposed to the public internet, and the connection works the same on every ISP in the country.
A franchise network is not one company. Access rules scope each player so head office can reach everything, and no location can reach another — the segmentation matters as much as the connectivity.
Playbooks handle provisioning, content deployment, OS and player patching, and restarts. The work is declarative and version-controlled, so the fleet converges on a known state instead of drifting into as many configurations as there are sites.
Opening a location is now image the player, join the tailnet, run the playbook. No specialist on site, no per-location snowflake, and the result is identical to every other location by construction.
The outcome
Most of this work starts the same way — finding out what is actually running before anyone proposes a fix.
