Turning Your Robot Vacuum Into a Mesh VPN
autonomy, privacy, & e-wastepublished February 2026
Let's say you're considering buying a robot vacuum. "It'll clean for me and free up my time", even though "your time" is largely just scrolling Instagram reels.
But that's just you being self-deprecating. It really will help your life and keep your apartment clean.
It doesn't just vacuum. It mops hardwood floors too. And works surprisingly well.
You open the box and read aloud the instructions: "Please install our app to continue".
Download the App
You open the app and it prompts you to create an account. You give it your email and the same password you use for every other service. It then asks for your GPS location.
"Whatever"–you say with indifference. "I don't care–who doesn't have my data?"
The app controls the robot. But the app doesn't connect directly to your Robot. When you ask the robot to clean, a command is sent to the company's servers which get routed back to your device.
You can schedule the Robot to run even when you're not home or trigger a clean manually when your plane lands from a trip. Not explicitly necessary, but still this architecture has [somewhat thin] genuine value.
╔══ Your Home WiFi ═╗ ╔══ China ══════════════╗ ║ ║░░ ║ ║░░ ║ ┏━━━━━━━━━━━━━┓ ║░░ ║ ┌┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┐ ║░░ ║ ┃ ┃ ║░░ ║ ┆ ┆ ║░░ ║ ┃ Your iPhone ┃ ──── data ────▶┆ Company Servers ┆ ─────┐ ║ ┃ ┃ ║░░ ║ ┆ ┆ ║░░ │ ║ ┗━━━━━━━━━━━━━┛ ║░░ ║ └┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┄┘ ║░░ │ ║ ║░░ ╚═══════════════════════╝░░ │ ║ ┏━━━━━━━━━━━━━┓ ║░░ ░░░░░░░░░░░░░░░░░░░░░░░░░░ │ ║ ┃ ┃ ║░░ │ ║ ┃ Your Robot ┃◀────────────── commands ────────────────┘ ║ ┃ ┃ ║░░ ║ ┗━━━━━━━━━━━━━┛ ║░░ ╚═══════════════════╝░░ ░░░░░░░░░░░░░░░░░░░░░░
The robot uses LIDAR to map your apartment. If you pull up your iPhone camera, you can see the lidar lasers flashing on your screen. Wicked cool.
You inspect the device and see the robot vacuum also has a camera on the front of it. You open the manual which tells you it's used for "object detection". You test out the feature and it actually works, somewhat. It identifies chairs and cables and avoids them. But you wonder if they're sending pictures back to their servers.
Nothing here seems to be done with an blanketed desire to exploit you, your privacy, and your data. The features that exist have real merit. But you question how much value you are getting for the potential invasion of privacy. And you know that even if the company is acting in earnest, it doesn't mean they can be sure to secure your privacy.
As famously joked, the "S" in IOT1 stands for security. An open, possibly insecure device on your network with a camera attached to it is a mess.
Declouding the Vacuum
You do some googling and find out there is a piece of open source software that can de-cloud your robot. As it would happen, all of the functionality of the device, including the object detection can run directly on the device with no cloud needed. The only distinct advantage of the company app is remote control.
You're giving up an awful lot of security and privacy for what is really a secondary feature at best. So you decide to root your vacuum and install the de-clouded software. Now it never connects to the "cloud".
This is what your network now looks like:
╔══ Your Home WiFi ════╗ ║ ║░░ ║ ┏━━━━━━━━━━━━━┓ ║░░ ║ ┃ ┃ ║░░ ║ ┃ Your iPhone ┃ ║░░ ║ ┃ ┃ ║░░ ║ ┗━━━━━━━━━━━━━┛ ║░░ ║ │ ║░░ ║ │ commands ║░░ ║ ▼ ║░░ ║ ┏━━━━━━━━━━━━┓ ║░░ ║ ┃ ┃ ║░░ ║ ┃ Your Robot ┃ ║░░ ║ ┃ ┃ ║░░ ║ ┗━━━━━━━━━━━━┛ ║░░ ╚══════════════════════╝░░ ░░░░░░░░░░░░░░░░░░░░░░░░░
Rooting your vacuum isn't an easy process to undergo and the point of this article isn't ultimately to encourage you to do this yourself. To add, the creator of this open source software is profoundly opinionated and espouses their beliefs loudly. It's rather fascinating reading through their website and philosophies.
Some of their strong opinions resonate as distinct truths and others are outright hostile. Getting banned from the author's community chat seems to be a rite of passage, as just an earnest intent to participate is enough to get disbarred. But to their credit, the software works and it works well.
At this point, I was content with the solve. This weird little camera roving around my apartment was largely secured. But, we lost access to one feature: remote operation. I don't explicitly need it. Really... who needs to run their vacuum from across the globe? But, I was curious to see how one could solve it, securely and privately of course. So I dug in.
A Mesh-VPN: Your Own Private Cloud
You find your rooted vacuum is just running a simple linux operating system. You can ssh into it and run software on it. It's not super powerful, but it has enough resources to run some light software.
One of those piece of light software is Tailscale: a private mesh-VPN.
The internet is public. Go on any almost computer and type in Google.com and you'll get there. A VPN is not public–it's a private and encrypted network. Only you and you alone2 can access the services on it.
Installing tailscale onto your vacuum means you can connect to it from anywhere in the world. Your private data is not routed through Tailscale's servers3, it just connects your two devices4 and 'tells' you how to communicate between the two. If you don't want to rely on Tailscale-the-company, you can install headscale instead5.
This opens up access from anywhere, privately and securely. And you get a little roving vacuum-VPN that putters around your apartment and acts as a universal gateway back to your home network.
Now your network looks something like this:
╔══ World ══════════════╗ ╔══ Your Home WiFi ════╗ ║ ║░░ ║ ║░░ ║ ┏━━━━━━━━━━━━━┓ ║░░ ║ ┏━━━━━━━━━━━━━┓ ║░░ ║ ┃ ┃ ║░░ ║ ┃ ┃ ║░░ ║ ┃ Your iPhone ┃ ║░░ ║ ┃ Your iPhone ┃ ║░░ ║ ┃ ┃ ║░░ ║ ┃ ┃ ║░░ ║ ┗━━━━━━━━━━━━━┛ ║░░ ║ ┗━━━━━━━━━━━━━┛ ║░░ ║ │ ║░░ ║ │ ║░░ ║ │ ║░░ ║ │ ║░░ ║ ▼ ║░░ ║ ▼ ║░░ ║ ┏━━━━━━━━━━━━━━━┓ ║░░ ║ ┏━━━━━━━━━━━━┓ ║░░ ║ ┃ ┃ ║░░ ║ ┃ ┃ ║░░ ║ ┃ Tailscale VPN ┃ ──────────────────▶┃ Your Robot ┃ ║░░ ║ ┃ ┃ ║░░ ║ ┃ ┃ ║░░ ║ ┗━━━━━━━━━━━━━━━┛ ║░░ ║ ┗━━━━━━━━━━━━┛ ║░░ ╚═══════════════════════╝░░ ╚══════════════════════╝░░ ░░░░░░░░░░░░░░░░░░░░░░░░░░ ░░░░░░░░░░░░░░░░░░░░░░░░░
Autonomy Matters Here
You now have the full suite of functionality with your Robot, but nothing is passed through a random company's nor country's servers. You own your devices. You own your data. You own your functionality.
You might be asking: why?. "I still don't care." This feels like an awful amount of headache. But what happens when the company you paid a one-time fee shuts down their servers in China? Does your robot vacuum just stop working?.
The answer is largely: yes. There are many instances of this happening7. If you care about wastefulness or losing the autonomy to operate the devices you purchased, then you should at least understand this inevitable problem. Hardware that works perfectly fine ends up being put out to pasture for no grand reason. This is e-waste and it's largely a symptom of a lack of business incentive to provide free support forever. Company's rarely design their products with this in mind because planning for this scenario cuts directly against their motives.
So this isn't just a security or privacy concern. This is a basic functionality concern. If you don't want your working devices to one-day become expensive paperweights, it becomes imperative to retain control over them end-to-end.
Other Benefits
I've been running my vacuum this way for over six months and it genuinely works. My floors are kept clean. And rooting my vacuum means that I get to customize it to my liking. So, of course, there was only one thing left to do. When my robot starts a clean, it plays this:
After going through this largely philosophical journey, I thought deeply about what other devices I run on my network. What other clouds do I route my home's devices to? In doing so, I found an old thermostat8 that can be privately hooked up to my mesh VPN, totally secure and controllable from anywhere. It's even more useful than the vacuum. No Google servers. No foreign-country's networks. Just private, operable from anywhere in the world, and will continue to work for the genuine lifetime of the device. Controlling my thermostat remotely helps me keep my heating bill and energy usage down.
This isn't necessarily feasible for the layman to do right now. But everyone should at the very least understand what happens when we add a wi-fi enabled device to our home, what the risks and ramifications are, and what we can do to improve our autonomy, privacy, and security. And maybe, all of our 'smart' devices should work without company-owned-servers, or at the very least, be de-cloudable. But, I wouldn't count on it.