Unified IT Infrastructure for a 10-Branch Retail Group

Overview

For years, the Maryana Group ran on decentralized, unsynchronized desktop databases and expensive hardware VPNs (Sophos, Cyberoam) that dropped connections regularly. Ten-plus retail and distribution branches across two countries, a fragmented security model, no centralized identity management. Every new branch opening meant shipping hardware and manual configuration.

I led a multi-year modernization initiative, and the sequencing I’d defend is identity first, ERP second, network last: centralized all core financial ERPs onto a hardened Windows Server 2019 Remote Desktop Services (RDS) deployment, replaced the hardware VPNs with a Zero Trust mesh network (Tailscale), then added full observability with Prometheus and Grafana once there was something stable to watch.

The results were measurable. Roughly $2,500/year in proprietary hardware support and licensing effectively eliminated. Cross-branch reconciliation 30% faster. The central Tally Prime ERP at near-100% uptime under Active Directory RBAC.

---

1. The Problem

The constraint that shaped everything was operational, not technical: every new branch multiplied toil. Hardware VPN appliances had to be shipped, given static IPs, and nursed through IPsec tunnel drops. Financial data lived in separate local databases synced by unreliable batch scripts, so cross-border reporting was stale by construction. There was no central identity. Access control was per-machine folklore.

The design requirement was therefore a network where a new branch is a software install, not a hardware shipment, plus a single source of truth for both identity and financial data.

---

2. Architecture

Hand-authored topology of this estate: every node traces to the architecture table and transcripts above, and the 2025 Twingate cutover note marks what changed after.

---

3. Implementation

The work landed in three waves. 2019–2020, identity and centralization: deployed the primary Domain Controller, enforced Group Policies (password complexity, screen-lock timeouts, USB mass-storage restrictions), and replaced isolated desktop shares with a centralized DFS governed by AD security groups.

2021–2022, the ERP migration. The highest-risk phase. The old architecture synced separate local databases via batch scripts; the new one streams Tally Prime from a dedicated Windows Server 2019 RDS host via RemoteApp. Custom session-timeout policies manage concurrent Tally Virtual User licenses through peak hours.

Live active Tally Prime streaming sessions managed via the RDS Server Manager console.

2023, the Zero Trust pivot. Site-to-site IPsec on Cyberoam/Sophos boxes gave way to a Tailscale mesh: Tailscale ACLs replaced blind LAN trust, and new branches onboard with a software install instead of a hardware shipment.

The data artifact is the session log above: the backup-cleanup run log (14-day rolling retention, 14 dumps kept) and a Prometheus scrape showing 10/10 mesh targets up.

Automation: PowerShell backup retention

A centralized server generates centralized backups. PowerShell scripts run via Windows Task Scheduler to enforce a 14-day rolling retention policy without third-party GUI software:

$TargetFolder = "D:\Encrypted_Backups\TallyPrime_Daily_Dumps"
$RetentionDays = 14
$ThresholdDate = (Get-Date).AddDays(-$RetentionDays)
$OldFiles = Get-ChildItem $TargetFolder -Recurse |
           Where-Object { $_.LastWriteTime -lt $ThresholdDate }
foreach ($File in $OldFiles) {
    Try {
        $LogEntry = "$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') | DELETED: $($File.FullName) | Size: $($File.Length / 1MB) MB"
        Write-Output $LogEntry | Out-File "C:\Admin_Logs\BackupCleanup.log" -Append
        Remove-Item $File.FullName -Force -ErrorAction Stop
    } Catch {
        Write-Error "Failed to delete $($File.Name): $_" | Out-File "C:\Admin_Logs\Backup_Errors.log" -Append
    }
}

The snippet above is the real retention logic; the log lines it produces are what the transcript captures.

The custom Grafana dashboard tracking sub-millisecond latency and UDP packet health across the international branch network.

---

4. Operations

What breaks, what it costs, how it’s watched:

• Breaks: tunnel latency and packet loss across the international mesh, with Grafana webhook alerts firing when thresholds exceed; RDS session exhaustion at peak hours is handled by the connection-broker timeout policies.
• Costs: Tailscale on commodity hardware replaced annual firewall licensing (the ~$2,500/year saving); Prometheus/Grafana are open source on an existing Linux host; the whole observability layer costs effectively nothing beyond the box it runs on.
• Watched: Prometheus scrapes every node. The timeline of this transformation (2019 centralization → 2021 ERP migration → 2023 Zero Trust) is itself tracked in dateRange, with Grafana as the day-to-day proof the mesh is healthy.

---

5. Results

• Cost: roughly $2,500/year in proprietary hardware support and licensing effectively eliminated.
• Speed: cross-branch financial reconciliation 30% faster with synchronized central data.
• Reliability: near-100% uptime for the central Tally Prime ERP under AD RBAC.

Figures as of 2024. Dollar and percentage figures are owner-reported estimates from the migration period — flagged UNVERIFIED pending owner confirmation. The ~$2,500/yr above is the VPN-hardware saving (Cyberoam licensing eliminated) — distinct from the droplet-vs-physical-server saving in 5 lessons from 10 years.

Coda (2024–25): the Tailscale mesh this case ends on was later replaced by Twingate ZTNA after Omani DPI pressure fingerprinted and dropped WireGuard handshakes — the full cutover story is the RDS migration case, narrated in Tailscale Blocked?. The architecture above is therefore the phase-1 record, not the current estate.

What I’d check first

If I walked into a group running the old estate today, the first thing I’d look at is the batch scripts syncing the branch databases, because that’s where the reconciliation pain lives. Stale cross-border reporting, leadership flying blind. Second: the VPN appliances, and how many branches have gone dark this quarter while someone nurses an IPsec tunnel back up. The fix stack from this case still holds (AD plus Group Policy, RDS RemoteApp for Tally Prime, a mesh with ACLs, Prometheus proving it’s all alive), though I’d budget differently now: the ~$2,500/year hardware saving was real, but the compounding win was each layer deleting one category of manual work for good.

---

What I’d Do Differently

One design regret: the mesh shipped without a second export path for Prometheus data. If the monitoring host itself lost the tunnel, history had a gap exactly when forensics needed it most. A store-and-forward buffer (or a cloud remote-write replica) would have closed that blind spot.

One scope regret: the Onyx-to-Tally migration ran as a big-bang cutover per branch. A parallel-run window, old and new ERPs accepting reads while writes went to one, would have de-risked the highest-stakes weekends of the program.

“A new branch should be a software install, not a hardware shipment.”