K.I.S.S.

Keep It Simple, Stupid. Remote HF stations have a habit of growing into something nobody can maintain and nobody dares reboot. This one did not, and the reason is that we kept taking things out.

Everything at the ranch

This is the complete inventory of the Graford site. Not a simplified diagram of it — the whole thing.

What is deliberately not there

Most of the engineering in this project went into things we decided we did not need. Every item below is something we have seen on other remote setups, considered, and left out:

• ×No PC on site. No shack computer, no NUC, no mini-ITX box quietly filling its disk a long drive away. A Pi 3B+ is the most powerful thing at Graford, and it does four small jobs.
• ×No LAN-over-WAN bridge. We do not stretch a broadcast domain across the internet so the radio can pretend it is in the lounge room. Layer 2 does not enjoy being tunnelled, and it fails in ways that are very hard to read from the other end.
• ×No VPN mesh. No ZeroTier, no Tailscale. See below.
• ×No managed switch, no VLANs. There are four devices. Segmenting four devices is a hobby, not a requirement.
• ×No inbound ports, anywhere. Starlink is behind carrier-grade NAT and we never fought it. The Pi dials out; nothing dials in.

Does stripping it out hurt? No.

The obvious objection to all of the above is that the simple version must perform worse. It does not.

In practice the station behaves essentially as though it were local. Not “usable”, not “good enough for a rag-chew” — it feels like the radio is in the room. The band noise arrives when it should, the waterfall moves when it should, and the receiver responds to a tuning knob without the lag that makes remote operation tiring.

Comfortable CW at 38 WPM, so far. That is the real benchmark, and nothing else we could measure matters as much.

CW is the hardest test a remote station can be given. Every other mode forgives a few tens of milliseconds; Morse does not, because the timing is the signal. If sent and received characters stay clean at 38 words per minute over seventy miles of Starlink, a WireGuard tunnel and a data centre in Dallas, then the path is not the limiting factor — the operator is. That is exactly where the limit belongs.

All the complexity lives in Fort Worth

Simplicity at the remote site does not mean going without. It means putting every moving part at the end where somebody is standing, where a reboot takes ten seconds and costs nothing.

Ed operates with any combination of:

• A Windows PC running SmartSDR — FlexRadio’s own client.
• A Mac running SmartSDR for macOS, the excellent third-party client by Marcus Roskosch, DL8MRE.
• A Maestro C console, with the CW key plugged straight into it — knobs, a real display, and a paddle, for when a mouse is not a radio.

More recently he has been running the Maestro in Smart Control mode, which has become the everyday way in.

He also runs N1MM for logging and contesting — locally, in Fort Worth, on his own desk. This is worth stating plainly because it is where a lot of remote builds go wrong: the logger does not need to live at the remote site. Nothing does. Put the software where the operator is, and the far end stays four boxes and a switch.

Why an exit node, and not a mesh VPN

The obvious answer to “how do I reach a site behind CGNAT” is a mesh overlay — ZeroTier or Tailscale. Both are genuinely clever, both install in about four minutes, and both are the reason a lot of remote stations are harder to run than they look.

They seem easy. In our experience they often are not, and they bring problems of their own.

The trouble is that a mesh puts a second, invisible routing policy on every machine it touches, and you do not own it. When it works, it is magic. When it does not, you are debugging somebody else’s daemon, somebody else’s route priorities and somebody else’s coordination servers — from the wrong side of the planet. We have had exactly that on this project: a tailnet whose IPv4 routes were silently swallowed by a full-tunnel WireGuard configuration on the same Pi, leaving a host that reported itself perfectly online and could not be reached at all.

So ALAMO does the boring thing instead. The Pi holds one plain WireGuard tunnel out to a machine we control — the exit node, a small virtual server in the Vultr data centre in Dallas. It has a fixed public address, it terminates the tunnel, and it serves these pages. That is all it does.

It costs literally a few dollars a month, and it is worth every cent. In exchange we get one routing policy, written by us, in a file we can read; a public address that never changes; somewhere to put the web pages that is not at the mercy of the site’s uplink; and a single, obvious place to look when something breaks.

This is what RS1 is

Plenty of FlexRadio remote installations are the opposite of this — a rack at the far end, a PC to run the radio, a bridge to make the network lie about geography, and a mesh VPN over the top to hold it together. They work, often very well, for the person who built them.

RS1 is deliberately the other thing. The design goal was never capability; it was the number of parts that can fail while you are eight thousand miles away and asleep. Four boxes, one tunnel, one server you rent.

If it can be removed and the station still works, it gets removed. That is the whole method.

More about the design, and where it is going as an open-source project, in chapter 08 of the story.