Platform
What is actually in the toolbox.
A technology list is only useful if it is honest, so this one is limited to things that have been run in anger — configured, broken, debugged at an unreasonable hour, and documented afterwards. Anything listed as -ready means the architecture accommodates it and it has been trialled, not that it has carried production traffic.
01 Reference architecture
The shape the work builds toward
Six layers. The two that get skipped most often are the access layer — because each service has some login of its own, so it feels covered — and observability, because nothing is visibly broken on the day you would have built it.
-
01 Edge
Nothing listens on the WAN
- Outbound tunnel
- WAF & TLS termination
- Edge cache
- DDoS absorption
-
02 Access
Default deny, one sign-on
- OIDC provider
- MFA enforcement
- Directory & groups
- Reverse proxy
-
03 Services
The things people actually use
- Web & app hosting
- Local LLM inference
- Internal tooling
- File & object storage
-
04 Platform
Where the services run
- Hypervisor cluster
- Containers & VMs
- ZFS storage
- Backup server
- Internal DNS & DHCP
-
05 Network
Segmented, routed, measured
- VLAN segmentation
- Site-to-site mesh
- 802.1X / RADIUS
- Flow visibility
06 Observability
Spans every layer
- Metrics & triggers
- Logs & traces
- Synthetic checks
- Alert routing
- Wall displays
Generic by design. This is the shape of a well-built estate, not a map of any particular one — no real address or hostname appears anywhere on this site.
02 Coverage
Technologies by domain
Grouped the way an estate is built, not the way a CV is written. Each group is a layer of the reference architecture above.
Monitoring & NOC
09- Zabbix 6.x and 7.x — templates, HA, API automation
- Zabbix 7 proxy groups and HA SNMP trap ingestion
- ServiceNow-style ITSM integration — webhooks, CMDB lookup, incident roll-up
- Zabbix backend migration to PostgreSQL and TimescaleDB on a live server
- Prometheus, Grafana, Alertmanager
- OpenTelemetry with Loki, Tempo and Mimir
- LibreNMS, CheckMK, Uptime Kuma
- SNMP v2c and v3, MIB work, trap handling, OID triage at scale
- gNMI streaming telemetry, evaluated against SNMP
Compute & storage
06- Proxmox VE — single node through clustered
- LXC containers and KVM virtual machines
- ZFS — pool design, snapshots, send/recv, scrub policy
- Proxmox Backup Server — retention, verify, prune-permission design
- restic and S3-compatible targets
- NVMe and disk-failure recovery on live pools
Network
06- VLAN segmentation and inter-VLAN policy
- WireGuard multi-site mesh and jump-host access
- DDoS-scrubbed ingress over WireGuard for non-HTTP protocols
- Authoritative DNS, DHCP reservations, reverse zones
- FreeRADIUS, 802.1X, UniFi estates
- Carrier, service-provider and optical transport equipment
Platform & delivery
06- nginx, reverse proxy, TLS automation
- Cloudflare Tunnel and zero-inbound publishing
- Docker, systemd units, service hardening
- Terraform and Ansible for reproducible lab estates
- GitHub and Gitea Actions, self-hosted runners
- Python and Bash automation against REST and JSON-RPC APIs
Identity & security
07- Authelia, OpenLDAP, OIDC and OAuth2 flows
- MFA enforcement and default-deny access policy
- SSH key and API token lifecycle — rotation, scoping, expiry
- External exposure review and port-forward audit
- Suricata IDS tuning, CrowdSec, fail2ban
- Secret scanning — pre-commit, pre-push and server-side pre-receive
- Security event monitoring and log retention
Applications & AI
06- Postfix, Dovecot, Rspamd, Roundcube
- Ollama and Open WebUI on local GPUs
- OpenAI-compatible gateways and provider routing
- Multi-agent tooling — routing, sandboxing, run replay
- Retrieval over internal document sets
- Tauri desktop apps; Flask, Astro, Three.js front ends
03 Non-negotiables
What ships with every build
These are not extras that get cut when a timeline tightens. They are the difference between a system that was delivered and one that can be operated.
Version-controlled configuration
Anything that can be exported is exported, committed, and imported idempotently. Configuration that exists only inside a database cannot be reviewed, diffed or rolled back.
A reversible deploy
Changes stage first and swap atomically, with the previous state kept where it can be swapped straight back. Rollback is one command, not a rebuild.
Secret hygiene
No credentials in application code, no private addresses in anything published, and a scan in CI that fails the build rather than trusting review to catch it.
Runbooks
Written for the person on call at 3am who was not in the room when it was built. Each non-obvious decision carries the reason it was made.
Verified recovery
The restore is performed, the failover is triggered, and the result is written down with a real measured recovery time.
Graceful degradation
A dependency going away removes one capability, not the system. Anything on a wall display keeps its last known-good reading instead of showing a cliff that never happened.