I think this is a very good option. I am not a software person. C++ or Python is not in my head. I don't think I can make a dumb terminal or a web browser out of it.

 

Hello,

The terminal i saw was at albert hein, a large supermarket and hema a large store.
At albert hein they even can show where a product is on the shelves on that terminal.

Bertus

The terminal is almost certainly talking to the server, not the tag, in that case. Otherwise, every terminal would have to have the entire database for the store located on it, which would be a nightmare to manage. Move a single item and now you have to update the database on every terminal. Instead, have a single database server that is the sole repository (backed up, of course) for the information. Anytime that information is accessed, is it through that repository so that everyone is always accessing the same information.

 

Hello,

The terminals will talk to the server.
There also will be user levels on the terminals.
Some can make changes in the database, others may only have a kind of read only option.

Bertus

 

Hello,

The terminals will talk to the server.
There also will be user levels on the terminals.
Some can make changes in the database, others may only have a kind of read only option.

Bertus

Sure, that's classic database management. Although it may not be the terminals that have a level assigned to them as opposed to the person using the terminal. Just like the cash registers at most stores, the currently signed in cashier can do somethings, but other things require a manager override.

 

Choosing a centralized system architecture is absolutely the right security choice for this scale. In an environment with a dozen or more network nodes, managing individual access lists, routing keys, or decentralized mesh keys on every single endpoint quickly creates a massive attack surface.
By shifting to a centralized hub, you transform your CYD panels into "dumb terminals" (thin clients). They no longer function as exposed standalone web servers; instead, they simply authenticate to one secure central machine that dictates what they are allowed to see and do.


The Secure Architecture Layout

[ Remote Node ] (Phone or PC) <---( HTTPS / VPN )---> [ Secure Central Hub ] (Firewall / Auth) ->CYD Panels
|
(Secured Local IoT Wi-Fi Network)
|
v
[ CYD Panel #1 ] to [ CYD Panel #n ]

To implement this philosophy securely, your architecture should shift away from ESPUI and utilize the following components:

1. The Core: Home Assistant, Node-RED, or a Custom Server

• Instead of running 12 web servers on 12 microcontrollers, you run one robust server (on a Raspberry Pi, mini PC, or local server).
• Security Control: You only need to maintain firewalls, SSL/TLS certificates, and user authentication (like multi-factor authentication) on one device. Your phone or PC connects strictly to this central machine.

2. The Communication Layer: Secure MQTT (MQTTS)

• Instead of the CYDs accepting incoming connections (which requires opening ports on each device), the CYDs outbound connect to a central MQTT Broker (like Mosquitto) running on your server.
• Security Control: You disable anonymous access on the broker. Each individual CYD is provisioned with its own unique username and complex password. You can use standard Access Control Lists (ACLs) to ensure CYD #5 can only read/write to its own specific data paths and cannot interfere with CYD #9.

3. The CYD Firmware: ESPHome

• Because you want centralized control, ESPHome is highly recommended over ESPUI.
• ESPHome doesn't expose an interactive configuration web page on the device itself. Instead, it compiles a lean, locked-down firmware.
• It communicates natively with Home Assistant using an encrypted API (using a pre-shared static cryptographic key). If a bad actor physically pulls a CYD off the wall, they only get a single text key that gives access to that specific terminal—not a gateway into your entire mesh.

4. Network Isolation (VLANs)

• To truly lock down what goes "in and out," you can place all dozen CYD boards onto a dedicated IoT Wi-Fi network (VLAN) at the router level.
• You configure your router's firewall rules so that devices on the IoT VLAN are completely blocked from accessing the broader internet, and are strictly only allowed to talk to the IP address of your central hub.

 

CYD is pretty easy to get up and running using ESPHome, then passing data to/from Home Assistant. If you already use it.
There is an online configuration to get a nice display working quickly.
Tailoring it to your own tastes is another learning curve.

 

I have wondered about those. Walmart buys them by the store-full so they can't be that expensive. AliExpress has e-ink displays, but they're not yet down to AliExpress "cheap" where I'll buy a handful just to play.

I believe Washington State is talking about banning them – concerns about "demand pricing" and the price being displayed not being the price you actually pay. In my experience – with one local hardware store in particular – is that paper shelf price tags are the bigger issue. Something rings up at a higher price than the shelf tag, and when challenged the response is "The price has been changed in the system, the tags haven't been changed yet." Yes, I'm the guy who will argue until they honor the price on the shelf under threat of calling the attorney general. Yes, thank you, I do live in a woke blue state with strong consumer protection laws.

I do believe that electronic shelf labels are a good idea, but prices should only be updated when a store is closed. The price displayed when I pick an item should be the price I pay (or less).

[No, stop ranting about store "e-coupons" that only show up after you hit the pay button.]

Re pricing discrepancy between displayed and system price. I am from Australia and our consumer laws, which all companies have to abide by, say that the displayed price is the one you have to pay, even if the system is different.
Our consumer watchdog is very vigilent policing these matters and fines companies (like supermarkets) millions of $ when they consistently breach these laws.

 

Re pricing discrepancy between displayed and system price. I am from Australia and our consumer laws, which all companies have to abide by, say that the displayed price is the one you have to pay, even if the system is different.
Our consumer watchdog is very vigilent policing these matters and fines companies (like supermarkets) millions of $ when they consistently breach these laws.

So, in Australia, you're saying that if the displayed price is $AUS 12 and the system price is $AUS 10, that the company is required by law to charge the customer $AUS 12 instead of the lower price in the system?

I definitely prefer our law (in Colorado) which requires merchants to honor the lowest advertised price, whether it's on the shelf, on a poster, on a sign out front, or in an ad.

 

The problem with displayed price vs actual price is that you have to be paying attention. If you're purchasing a large number of items, you may not notice the discrepancy.

Along the same vein, I hate store "club cards" where the reward price isn't shown until the bill is totaled. Suddenly, a long list of discounts pops up, and it's hard to tell if everything is correct.

 

The problem with displayed price vs actual price is that you have to be paying attention. If you're purchasing a large number of items, you may not notice the discrepancy.

Of course you have to be paying attention. What's the alternative? At the end of the day, by placing an item in my cart, I'm agreeing to pay the advertised price. I'm the one with the vested interest in confirming that that's the price I actually ended up paying. That's the case whether I'm buying an box of cereal at the grocery store, a TV at a big box store, a DVD from an online retailer, a car at a dealership, a house, or paying my daughter's school bill.

Along the same vein, I hate store "club cards" where the reward price isn't shown until the bill is totaled. Suddenly, a long list of discounts pops up, and it's hard to tell if everything is correct.

I couldn't agree more. I've hated them since they first came in and they have gotten nothing but more annoying. When Safeway first came out with theirs, the claim that they touted was, "No more scouring for coupons, the savings are already in the card." They didn't have "member prices", the claim was simply that they would automatically apply manufacturers coupons. At first, that's what they did. Okay, fine. Then they started having member prices, which really meant that you had to have the card in order to pay the regular price and were charged extra if you didn't have it. Then they had their flyers with special offers that you didn't get even if you had the card. So you had to scour the flyer to see what coupons were their and present them at the register (unless you installed their app and explicitly loaded them to your account, which still required you to scour the flyers). I refuse to install their app, so I had to pick up their flyer every time I went into the store. Then they added yet another layer, making their "digital-only" coupons that you couldn't just present the flyer and get the advertised price, you HAD to use their app to get it.