Platform
What is actually in the toolbox.
A technology list is only useful if it is honest, so this one is limited to things that have been run in anger — configured, broken, debugged at an unreasonable hour, and documented afterwards. Anything listed as -ready means the architecture accommodates it and it has been trialled, not that it has carried production traffic.
Reference architecture
The shape the work builds toward
Six layers. The two that get skipped most often are the access layer — because each service has some login of its own, so it feels covered — and observability, because nothing is visibly broken on the day you would have built it.
Edge
Nothing listens on the WAN
Access
Default deny, one sign-on
Services
The things people actually use
Platform
Where the services run
Network
Segmented, routed, measured
Observability
Spans every layer above
Generic by design. This is the shape of a well-built estate, not a map of any particular one — no addresses, hostnames or counts appear anywhere on this site.
Coverage
Technologies by domain
Monitoring & observability
- Zabbix 6.x and 7.x — templates, HA, API automation
- Prometheus, Grafana, Alertmanager
- OpenTelemetry with Loki, Tempo and Mimir
- LibreNMS, CheckMK, Uptime Kuma
- SNMP v2c and v3, MIB work, trap handling
Compute & storage
- Proxmox VE — single node through clustered
- LXC containers and KVM virtual machines
- ZFS — pool design, snapshots, send/recv, scrub policy
- Proxmox Backup Server, restic, S3-compatible targets
- NVMe and disk-failure recovery on live pools
Network
- VLAN segmentation and inter-VLAN policy
- WireGuard multi-site mesh and jump-host access
- Authoritative DNS, DHCP reservations, reverse zones
- FreeRADIUS, 802.1X, UniFi estates
- Carrier, service-provider and optical transport equipment
Platform & delivery
- nginx, reverse proxy, TLS automation
- Cloudflare Tunnel and zero-inbound publishing
- Docker, systemd units, service hardening
- GitHub and Gitea Actions, self-hosted runners
- Python and Bash automation against REST and JSON-RPC APIs
Identity & security
- Authelia, OpenLDAP, OIDC and OAuth2 flows
- MFA enforcement and default-deny access policy
- Vaultwarden and credential lifecycle
- Security event monitoring and log retention
- Secret scanning and pre-publication review
Applications & AI
- Postfix, Dovecot, Rspamd, Roundcube
- Ollama and Open WebUI on local GPUs
- OpenAI-compatible gateways and provider routing
- Retrieval over internal document sets
- Flask, Astro, Three.js for operational front ends
Non-negotiables
What ships with every build
These are not extras that get cut when a timeline tightens. They are the difference between a system that was delivered and one that can be operated.
Version-controlled configuration
Anything that can be exported is exported, committed, and imported idempotently. Configuration that exists only inside a database cannot be reviewed, diffed or rolled back.
A reversible deploy
Changes stage first and swap atomically, with the previous state kept where it can be swapped straight back. Rollback is one command, not a rebuild.
Secret hygiene
No credentials in application code, no private addresses in anything published, and a scan in CI that fails the build rather than trusting review to catch it.
Runbooks
Written for the person on call at 3am who was not in the room when it was built. Each non-obvious decision carries the reason it was made.
Verified recovery
The restore is performed, the failover is triggered, and the result is written down with a real measured recovery time.
Graceful degradation
A dependency going away removes one capability, not the system. Anything on a wall display keeps its last known-good reading instead of showing a cliff that never happened.