A bridge, not a backdoor.

Not a product you buy. The way you plug us in.

When you hire Padmini sysadmins for planned work — an OpenStack upgrade, a Ceph expansion, live kernel patching on production Debian — our engineers need a path into your network. Setu is that path: an automated, multi-tenant IPsec gateway that turns onboarding from a week of meetings into one paste on your router.

You keep design authority over your network. We keep design authority over the tunnel. That split is the whole trick: we issue the addressing, the identities, and the crypto; you review the bundle and paste it. Nothing on our side ever logs into your equipment to set it up.

The same bridge also works in the other direction — carrying your access to services Padmini hosts for you. One path, both directions of work.

You've seen enough diagrams. Here's the terminal.

Your bundle arrives ready to paste. Pick your side of the bridge:

/ip ipsec profile add name=padmini-default-v1 hash-algorithm=sha256 \
    enc-algorithm=aes-256 dh-group=modp2048 lifetime=24h
/ip ipsec peer add name=setu address=setu.padminisys.com \
    exchange-mode=ike2 profile=padmini-default-v1
/ip ipsec proposal add name=padmini-default-v1 auth-algorithms=sha256 \
    enc-algorithms=aes-256-cbc pfs-group=modp2048 lifetime=1h
/ip ipsec identity add peer=setu auth-method=pre-shared-key \
    secret="<delivered-once>" my-id=fqdn:acme.sag.padminisys.com \
    remote-id=fqdn:setu.padminisys.com
/ip ipsec policy add peer=setu tunnel=yes \
    src-address=192.0.2.0/24 dst-address=198.51.100.0/24 \
    proposal=padmini-default-v1

connections {
    padmini {
        version = 2
        local  { auth = psk  id = acme.sag.padminisys.com }
        remote { auth = psk  id = setu.padminisys.com }
        proposals = aes256-sha256-modp2048
        encap = yes
        children {
            padmini {
                local_ts      = 192.0.2.0/24
                remote_ts     = 198.51.100.0/24
                esp_proposals = aes256-sha256-modp2048
                rekey_time    = 1h
                dpd_action    = clear
            }
        }
    }
}

$ swanctl --list-sas
padmini: #1, ESTABLISHED, IKEv2, natt
  local  'acme.sag.padminisys.com' @ 203.0.113.10[4500]
  remote 'setu.padminisys.com'     @ 203.0.113.1[4500]
  AES_CBC-256/HMAC_SHA2_256_128/MODP_2048
  established 47s ago, rekeying in 23h
    padmini: #1, INSTALLED, TUNNEL, ESP:AES_CBC-256/HMAC_SHA2_256_128
      192.0.2.0/24 === 198.51.100.0/24

If it doesn't say ESTABLISHED, we're already looking at it — tunnel state is exported read-only to our monitoring the moment you dial in.

Nothing automated ever touches your devices.

• Keys are handled like keys. Pre-shared keys are 256-bit, generated server-side, and delivered exactly once through an OTP-gated one-time link. A SHA-256 fingerprint is read back on the ceremony call. PSKs never appear in email, chat, Git, CI logs, or tickets — ours or yours.
• Our side is fenced. Tunnel traffic lands behind a default-drop transit firewall. Tenants are isolated from each other. Only the scoped path you agreed to is open, and return traffic is restricted to established flows.
• Changes travel one road. On our side, every tunnel configuration change moves through version control, automated validation, and a named human approval before anything is applied. There is no side door for "quick fixes."
• Everything is attributable. Git history, job history, IPAM changelog, and the event log line up into one audit chain. If you ask "who did what, when," the answer exists.