Stephen Munyi
ZuriNet / Network & connectivity platform

A clear boundary between connectivity and the core.

Managed connectivity connects two different worlds: the network that provides access, and the application that manages subscriptions. My work brought them together while keeping their responsibilities distinct.

My role
Architect & network/platform engineer
Practice
Networking · Cloud · Architecture
Scope
Network management plane deployed

The context

A managed connectivity platform needs to coordinate network configuration, device visibility and subscription operations. Those concerns meet in the same experience, but they do not belong to the same source of truth.

The architectural challenge was to connect the network plane to the wider platform without making a particular management vendor the authority for business records. That boundary matters when services evolve or infrastructure needs to change.

My contribution

  • Deployed the OpenWISP network management plane on AWS EC2 using Ansible, with WireGuard providing secure connectivity.
  • Designed a vendor-independent network interface so consumers work with platform capabilities rather than vendor-specific implementation details.
  • Separated network management, read access to network data and the stateful core that owns subscriptions and related business services.
  • AWS EC2
  • Ansible
  • WireGuard
  • OpenWISP
  • API architecture

The system, in view

  1. Business coreSubscription authority
  2. Integration boundaryVendor-independent API
  3. Network planeConnectivity management
Conceptual integration view. The core owns business state; the interface separates that responsibility from network management. This is not an operational topology.

The important decision

Keep the boundary explicit.

A tightly coupled integration can be quick to assemble, but it makes the rest of the platform depend on the network vendor’s model. I used an adapter-oriented boundary and a defined interface instead. That keeps network-specific behaviour contained and makes the application’s ownership of business state clear.

From design to implementation

The network management plane was deployed with configuration automation and secure access. The wider architecture defines how network information is read and how devices are linked from the core into the network plane.

The deployed plane and the interface design are distinct results. They do not imply that every subscription or commercial workflow in the wider architecture is live.

What the work established

A deployed network management plane with secure connectivity, alongside a defined integration boundary for the wider platform.

The lesson

System boundaries are operational decisions as much as software decisions. Keeping authority in the right place makes an integration easier to reason about without requiring every consumer to understand the infrastructure behind it.