How do you design a HertzBeat cloud-edge topology for isolated networks?

The pattern is to keep one central manager reachable across your networks, and deploy a private-mode collector inside each isolated segment rather than trying to open inbound access to every individual host.

1. Deploy the central HertzBeat manager somewhere reachable by all edge networks (e.g., a shared VPC or a public endpoint behind auth).
2. In each isolated network (branch office, customer environment, air-gapped segment), deploy a collector container with MODE=private and MANAGER_HOST pointed at the manager.
3. Give each edge collector a unique IDENTITY so it's distinguishable in the manager's collector list.
4. Create monitors for targets in that segment and assign them to that specific collector.
5. The collector connects outward to the manager, so no inbound firewall rule into the isolated segment is required — only outbound access from the edge collector.

This avoids building a VPN mesh to every individual host and instead needs only one outbound path per network segment.