At ShitOps, growth and workplace analytics asked for one thing: when someone walks from the espresso bar to the platform war room, their web session should follow them without asking a question. Our legacy system exported Bluetooth Data from beacons and Cookies from the browser into a shared spreadsheet every Tuesday. That was not going to scale to our new three-floor headquarters. We needed a privacy-preserving, audit-grade, real-time cookie continuity layer that we could run ourselves. This is how we built it.

Our beacons emit Bluetooth Data every 200 ms. The web app writes a first-party Cookie on every session. Correlating those two streams used to require raw identifiers, which made security and legal unhappy. We also needed a defensible audit trail because the workplace experience team wanted to prove that every match was computed correctly and never tampered with. The answer was an event-driven provenance mesh anchored on Mac Mini edge nodes, homomorphic encryption, and an immutable ledger.

flowchart TD A[Bluetooth Beacons] -->|Bluetooth Data| B[Mac Mini Edge Collector] B -->|Encrypted BLE events| C[Homomorphic Encryption Sidecar] C -->|Ciphertext| D[Self-Hosted NATS JetStream] D --> E[Temporal Workflow] E --> F[WebAssembly Cookie Normalizer] F --> G[Immutable Ledger Append Service] G --> H[(Append-Only Ledger)] H --> I[GraphQL Provenance API] I --> J[Envoy and OPA Gateway] J --> K[Growth Dashboard] E --> L[OpenTelemetry Collector] L --> M[ClickHouse] B --> N[SPIFFE/SPIRE Identity] N --> D N --> G

The mesh separates collection, matching, and proof. Mac Minis collect Bluetooth Data at the edge, homomorphic encryption protects Cookies and beacon vectors in flight, and the immutable ledger records every match commitment for audit replay.

Mac Mini Edge Collectors

We standardized on three Mac Minis per floor. Each runs NixOS, k3s, and a Rust BLE collector that publishes over mTLS. The collector performs local deduplication and wraps every Bluetooth Data burst in a BFV homomorphic encryption envelope before it leaves the device. Mac Minis are small, quiet, and available, which makes them perfect for edge inference in a closet. Each node also runs an eBPF sidecar that tags packets with SPIFFE identity and ships metrics to the local OpenTelemetry collector.

The browser receives a short-lived Cookie from our self-hosted identity service. A WebAssembly module turns the Cookie into an encrypted feature vector. The Mac Mini side encrypts the latest Bluetooth Data proximity vector with the same public key. A Temporal workflow calls an OpenFHE service to compute a homomorphic dot product. Only the analytics key can decrypt the final score, so raw Cookies and raw Bluetooth Data never coexist in plaintext. We rotate keys hourly with a ceremony orchestrated by Vault and cosign, and every key rotation is itself appended to the immutable ledger.

Self Hosting and the Immutable Ledger

Everything runs on infrastructure we own: Mac Minis, switches, and a very serious UPS. We self hosting the control plane with Crossplane and Argo CD. Every match result is appended to an immutable ledger backed by a Merkle Mountain Range. The ledger stores ciphertext commitments, not identities, and is replicated across three Mac Minis. Because the ledger is append-only, auditors can replay any cookie continuity decision without trusting a dashboard. We also keep a Kafka topic for ledger side effects that no one has needed yet, but it is there for future scale.

Deployment and Policy

We use Terraform to describe the fleet, Crossplane to reconcile it, Dagger to build the WebAssembly modules, and OPA to enforce that no service can query the ledger without a SPIFFE identity. Envoy fronts all APIs. A GraphQL gateway exposes only signed provenance queries. The whole system is declared in Git; if a Mac Mini reboots, it comes back with the same immutable ledger offset and a fresh homomorphic encryption key share. Cilium gives us zero-trust networking between collectors and the ledger append service.

Observability

OpenTelemetry traces flow from the BLE collector through Temporal and into ClickHouse. We alert if homomorphic matching latency exceeds 1200 ms, if ledger append lag exceeds two blocks, or if a Mac Mini fan spins above 5000 RPM. Grafana dashboards show cookie continuity SLOs per floor. We also emit a synthetic Cookie every minute to prove the full encryption and ledger path is healthy.

Results

We reduced the median cookie-to-beacon match from a weekly spreadsheet ritual to 870 ms. The immutable ledger now contains every cryptographic commitment, and our self hosting footprint is only forty-two Mac Minis. Legal loves that Cookies are never stored in plaintext. The growth team loves that the coffee queue dashboard updates live. Most importantly, we built a platform that is auditable, privacy-preserving, and ready for the next office move.