Product · Deployment reference
Three ways to run it, one product.
Three server types and five common plant layouts. Start with the layout closest to yours: each one shows which server goes at which level, how many you need, how they connect, and what you trade.
01 Pick your situation
Five layouts our customers draw most. Each page shows the layout on the plant levels, from the PLCs (L1) to the cloud (L5): which server goes where, how many, and what you trade.
- Servers
- 1 machine per plant
- Highly available
- No. A crash restarts in 5 seconds.
- Servers
- 1 per line, plus 3 for the hub
- Highly available
- The hub, yes. Each edge, no.
- Servers
- 1 or 3 machines for every site
- Highly available
- With Tier 3, yes.
- Servers
- 1 per plant, plus Fleet Manager
- Highly available
- No.
- Servers
- 1 per line, 1 per plant, 3 for the group
- Highly available
- The group hub, yes.
02 The servers
Every layout is built from these four. Tier describes the shape, not the location: any tier can run at a factory, in your data centre or in a cloud.
| Server | Machines | Each machine | Runs on | High availability | Usually sits at |
|---|---|---|---|---|---|
| Tier 1One program with everything inside: connectors, pipelines, namespace, broker, historian | 1 | 8 vCPU · 16 GB RAM · 200 GB SSD | Windows, macOS or Linux, as a native service | No. Restarts itself 5 seconds after a crash. | L3, next to the line |
| Tier 2One server running K3s, with TimescaleDB, EMQX and Prometheus beside MaestroHub. Manages many sites. | 1 | 16 vCPU · 24 GB RAM · 500 GB SSD | Linux with K3s | No | L3.5, the plant DMZ, or central (L4) |
| Tier 3A three-node Kubernetes cluster, each module in its own replicated service. Manages many sites. | 3 | 16 vCPU · 24 GB RAM · 500 GB SSD | Any Kubernetes 1.26 or later | Yes, at the application tier | L3.5, the plant DMZ, or central (L4) |
| Fleet ManagerOptional. One view of several separate deployments: health, licences, sign-in settings. | 1 | 8 vCPU · 8 GB RAM · 100 GB | K3s, single node | No. Servers keep their licence for 7 days without it. | Central (L4 or L5), reachable over HTTPS |
One Tier 2 or Tier 3 deployment manages many sites natively, with the Enterprise licence. Fleet Manager is only for when you run several separate deployments.
A vCPU is one hardware thread. Most server processors run two threads on each physical core, so 8 vCPU is 4 physical cores with two threads each. The Tier 1 specification is the 8 vCPU machine in our published benchmark: Context Engine with its embedded MQTT broker and embedded time-series database, measured on 19 October 2026 with MaestroHub 3.0.
What "high availability" covers on Tier 3
Tier 3 provides application-tier high availability only. The infrastructure underneath is the customer's responsibility.
MaestroHub handles
- Pod replication across the three Kubernetes nodes
- TimescaleDB primary and replicas, with automatic failover
- EMQX cluster: the broker survives a node loss
- NATS cluster: internal messaging keeps quorum
- Elasticsearch index replicas, distributed
You handle
- Multi-zone or multi-region placement of nodes
- Redundant network, load balancer and DNS
- Storage availability (no single SAN behind three nodes)
- Power redundancy and data centre operations
- OS patching, node replacement, Kubernetes upgrades
03 Where they go and how they connect
Every role on one drawing. Select a connection to light it up.
04 How many servers
What you install for each layout. Count your lines and plants.
| Layout | How many | What | Where |
|---|---|---|---|
| 01 Line-side edge | 1 | MaestroHub, Tier 1 | L3, next to the line |
| 02 Edge plus DMZ hub | 1 per line | MaestroHub, Tier 1 edge | L3, at the line |
| 3 | MaestroHub, Tier 3 hub | L3.5, the plant DMZ | |
| 03 One hub, many sites | 1 or 3 | MaestroHub, Tier 2 (about 1 to 10 sites) or Tier 3 | L4: your data centre, a cloud, or one factory |
| 0 | Nothing at the sites | Sites keep their SCADA or OPC UA servers | |
| 04 Independent plants | 1 per plant | MaestroHub, Tier 1 (small plant) or Tier 2 (large plant) | L3 or L3.5, in the plant |
| 1 | Fleet Manager, optional | L4 or L5, reachable over HTTPS | |
| 05 Three-layer namespace | 1 per line | MaestroHub, Tier 1 edge | L3, at the line |
| 1 per plant | MaestroHub, Tier 2 site hub | L3.5, the plant DMZ | |
| 3 | MaestroHub, Tier 3 group hub | L4, your data centre | |
| 1 | Fleet Manager, optional | L5 |
05 Trade-offs, side by side
The layouts mix: a large plant can run layout 2 while light sites join a central hub, all watched from one Fleet Manager.
| 01 Line-side edge | 02 Edge plus DMZ hub | 03 One hub, many sites | 04 Independent plants | 05 Three-layer namespace | |
|---|---|---|---|---|---|
| Servers | 1 machine per plant | 1 per line, plus 3 for the hub | 1 or 3 machines for every site | 1 per plant, plus Fleet Manager | 1 per line, 1 per plant, 3 for the group |
| Survives a server failure | No. A crash restarts in 5 seconds. | The hub, yes. Each edge, no. | With Tier 3, yes. | No. | The group hub, yes. |
| Keeps running without the WAN | Yes | Yes | No | Yes | Yes, at every layer |
| Connections into OT | None | None | Only for sources the hub polls | None | None |
| One namespace across plants | No | No | Yes | No | Yes |
06 Supported platforms
Operating systems and runtime requirements per tier. All three tiers run on amd64 and arm64: no proprietary OS, no vendor-locked hardware.
Tier 1, native install
- Windows
- 10, 11, Server 2016 / 2019 / 2022
- macOS
- 12 and later, Intel and Apple Silicon
- Linux
- Ubuntu 20.04+, Debian 11+, RHEL 8+
- Docker
- amd64 and arm64 images
Runs as a native service. No container runtime required.
Tier 2, K3s
- Host OS
- Ubuntu 20.04+, Debian 11+, RHEL 8+
- K3s
- 1.26+ (bundled installer)
- Helm
- 3.x
- Storage
- Local-path provisioner by default, or any K3s-compatible storage class
K3s is installed and managed by MaestroHub. No separate Kubernetes expertise needed.
Tier 3, Kubernetes
- Kubernetes
- 1.26+: EKS, AKS, GKE, or on-premises (Rancher, OpenShift, vanilla)
- Helm
- 3.x
- Ingress
- nginx, traefik, or any standard ingress controller
- Storage
- A StorageClass with dynamic provisioning; block storage recommended
Works on any conformant Kubernetes, cloud-managed or on-premises.
07 Which tier do you need?
Answer two questions.
08 What is inside each tier
The same architecture at a different scale.
Swipe sideways to see every column
| Component | Tier 1 | Tier 2 | Tier 3 |
|---|---|---|---|
| Deploymenthow it runs | Native service | K3s, single node | Kubernetes, three nodes |
| Packaginginstaller format | Binary and installer | Helm chart | Helm chart |
| Metadata databaseconfiguration and relational | Embedded | PostgreSQL | PostgreSQL |
| Time-series databasetelemetry storage | Embedded (Pebble) | TimescaleDB | TimescaleDB |
| MQTT brokerdevice messaging | Embedded | EMQX | EMQX cluster |
| Internal messagingservice-to-service bus | In-process | In-process | NATS cluster |
| Search and logsfull-text search | PostgreSQL (built in) | Elasticsearch | |
| Monitoringmetrics and alerts | Built in | Prometheus | Prometheus |
| High availabilityapplication tier only; infrastructure availability is the customer's responsibility | Application-tier | ||
| Docker requiredruntime dependency | No | No (uses K3s) | No (uses Kubernetes) |
09 Questions
What procurement and operations teams ask first.
OperationsCan we start with Tier 1 and move to Tier 2 or 3 later?
Yes. All three tiers share the same configuration model. From Tier 1 to 2: install K3s on the same machine and import the embedded data into PostgreSQL. From Tier 2 to 3: add cluster nodes and switch the backends to TimescaleDB and Elasticsearch, automated by migration tooling. Plan one to two days of migration services per upgrade.
LicenseWhich connectors and protocols are included?
The licence includes the standard MaestroHub connector library: common industrial protocols such as OPC UA, Modbus, MQTT, REST, S7, EtherNet/IP, BACnet, file and CSV, and others. There is no per-connector or per-protocol metering. Specialised industry connectors or advanced modules, if they apply to your use case, are confirmed in the commercial agreement.
OperationsWith one central instance, who pays for infrastructure and data transit?
MaestroHub is software you deploy, not a hosted service. The central instance's infrastructure is owned and paid for by the customer, wherever it lives. Hosted in a cloud, you pay the provider for nodes, storage and egress, and egress is the main cost that grows with each site. Hosted on premises or at a factory, there are no cloud bills, only hardware and your own network, which is often the lowest total cost when you already own data centre capacity.
ServicesWhat does implementation involve, for the first site and for each one after?
The first site covers architecture sizing, network and security integration, connector configuration, training and acceptance: typically two to eight weeks of professional services, depending on protocol mix and integration depth. Each further site under a central instance is configuration only, often done by your own team after first-site training. With local deployments, each new local MaestroHub repeats a slimmer version of the first-site setup. Detailed scoping yields a fixed-bid quote.
ServicesWhat is the support model?
Standard Enterprise support includes ticketing and knowledge base access. The premium tier adds 24/7 Slack support. Maintenance releases and security patches are included in all tiers.
OperationsHow often are upgrades released, and what downtime do they need?
MaestroHub follows a quarterly minor-release cadence with monthly security patches. Tier 3 uses rolling Helm upgrades: pods restart one after another and the service continues. Tier 2 is a single-node restart, typically under five minutes. Tier 1 is a native service restart, under a minute per site. Upgrades are customer-controlled: you choose when to apply them.
StrategyIf MaestroHub is acquired or goes out of business, what protects us?
MaestroHub stores all customer data in open, documented formats: PostgreSQL and TimescaleDB rows, MQTT messages, YAML and JSON configuration. You can export data at any time with standard database tooling, and configurations can be versioned in Git. Source code escrow is available through the commercial agreement. You always own your data, your configurations and your hardware.
OperationsCan Tier 2 or Tier 3 be deployed at a factory site instead of Tier 1?
Yes. Tiers describe deployment shape, not location. Tier 1 is the lightest option and is typical for a factory that needs local control at one site. But any tier can be placed at a factory site: if the site needs multi-site management on premises, or application-tier high availability of its own, install Tier 2 or Tier 3 there. The reverse holds too: Tier 2 and Tier 3 can live at a factory, in your data centre, or in a cloud.
OperationsIs Fleet Manager required for multi-site or multi-plant deployments?
No, Fleet Manager is optional. Multi-site management is handled natively by a single Tier 2 or Tier 3 instance. Fleet Manager becomes relevant only when you have several separate MaestroHub deployments and want one place for monitoring, licensing and shared sign-in settings across all of them. We recommend it once you have two or more deployments, but you can skip it if you run a single instance.
Planning your deployment?
Tell us about your sites, systems and deployment goals. Our team can help you understand the available editions and coordinate the next steps for implementation planning.