NFC access-control workloads on Kubernetes running in a factory
We needed an attendance system for factory floor workers. Biometrics (face-recognition / fingerprint) were ruled out by privacy regulations, and off-the-shelf systems were restrictive or expensive. So today we're shipping a DIY NFC access-control MVP to the factory:
| Layer | Hardware/Software |
|---|---|
| Credential | DESFire EV3 NFC tag/card |
| Reader | PN532 + ESP32-S3 (managed with ESPHome) |
| Transport | MQTT (NATS cluster with MQTT support) |
| Control | Go controller - AES session auth, ACL lookup, relay control |
| Records | Postgres for check-in/-out events, synced to a cloud Postgres instance |
| Audit | IP-camera snapshots stored in RustFS S3, synced to a cloud S3 instance |
| Platform | Kubernetes 1.36 with cilium-envoy on an ASRock DeskMini X600 (Ryzen 5 9600X, 16 GB DDR5, 500 GB NVMe) |
| Connectivity | WireGuard tunnel to cloud; workloads can be exposed to the Internet |
The flow is deliberately simple. The ESP32-S3 is a dumb pipe: it forwards raw DESFire frames between the PN532 and MQTT, nothing more. The Go controller does the real work - it runs the AES authentication loop directly with the card, checks the ACL, pulses the relay (fail-secure on deny), and records the event to Postgres in prod (SQLite and file backends also supported). Camera snapshots are captured asynchronously and never block the door.
The hardware is overkill for these workloads, but leaves headroom for NVR and machine-vision experiments.
