BEZALEL.ONE
← Work

The part nobody sees, holding up everything they do.

Everything you see on a Sunday stands on something you don't: the network underneath. We build it like it has to work every single week - so one glitchy device can't take the service down, and help can reach it from anywhere. Quiet, sturdy, and out of sight.Under the consoles and the wall is a real production network - not a consumer router and a prayer. It's segmented so one misbehaving device can't take the room down, reachable from anywhere without a single open port, and visible down to every box on it. This is the floor the rest of the system stands on.

CORE - L3 MANAGED SWITCH VLAN routing · QoS · redundant uplinks
VideoVLAN 10
Carbonite · MiniMEs
RED cameras
Resi · HyperDeck
Brompton · NDI
● load 14% · isolated
AudioVLAN 20
Yamaha DM7
Dante / network audio
Shure ULXD
stage boxes
● clocked · redundant
ControlVLAN 30
ETC Hog 4
ProPresenter
Stream Deck host
relay + fire daemons
● low latency
ManagementVLAN 99
Lyntec power
UPS
switch mgmt
health collectors
● read-only polling
Stylized reference topology - segments and device names representative, addressing anonymized.
SECURE REMOTE ACCESS - ZERO OPEN PORTS
Technician, anywhere
browser or SSH
Cloudflare Access
identity · OTP · policy
Outbound-only tunnel
no inbound ports
The production LAN
reachable · never exposed

Built like it has to work every week.

The network is segmented by job - video, audio, control and management each on their own VLAN, so a chatty camera or a firmware update can't flood the console or drop a stream. Quality-of-service protects the traffic that can't wait, and the layout is documented, not tribal knowledge in one person's head.

Remote access runs the modern way: an outbound-only tunnel to Cloudflare with Access policies in front, so a technician can reach the rig from home without a single port forwarded, no VPN to babysit, and every session tied to an identity. The management VLAN is where the health layer lives - reading everything, writing nothing - so the same foundation that keeps the rig safe also lets it be watched.

THE FOUNDATION
Managed switching VLANs · QoS
Cloudflare Tunnel outbound-only
Cloudflare Access identity · OTP
Managed power Lyntec · UPS
Read-only visibility every box on the rig
Nobody applauds the network. That's how you know it worked.
Photo · placeholder - swap for the real network rack / patch panel
← Signal flow Next: Health & monitoring →
ALL CAPABILITIES
The platform Custom control Cue synchronization Routing & compositing Signal flow Infrastructure Health & monitoring

Got a rig no volunteer can run?

Start a conversation