Every control-system deployment starts with "the room owns its config". That is fine for one room. It is a maintenance disaster for forty, because the config is now in forty places, in forty slightly different versions, with no history.
The fix is boring and reliable: one PostgreSQL database, one schema per tenant or site (site_a.rooms, site_b.rooms), and a thin service that the processors pull their configuration from at boot. Schema-qualified layouts give you tenant isolation without separate databases, search_path keeps the application code identical across sites, and pg_dump --schema gives you a per-site backup for free.
What it costs: a network dependency at boot (mitigated by caching the last-good config on the processor), one more service to run, and a team that has to learn to write migrations instead of editing files. What it buys: a single audit trail, a single place to roll out a change, and the ability to answer "which rooms are still on firmware 3.2?" with a SELECT.
The same database then becomes the natural home for the things nobody planned for — the asset inventory, the preventive-maintenance schedule, the help-desk integration. Once the spine exists, everything attaches to it.