Built, documented, and handed over.

Networking

Network design, build and remediation.

Switching, routing, wireless and firewall work across Cisco, Aruba, Fortinet and Palo Alto. That includes VLAN and segmentation design, site-to-site VPNs, guest and staff separation, and cleaning up a flat network that grew without a plan.

• Greenfield office and multi-site network design
• Firewall policy review and hardening
• Wireless coverage and roaming
• VLAN segmentation for compliance scopes
• Topology documentation that matches reality

Systems & Proxmox

Servers, virtualization and backups.

Linux and Windows administration, plus the full Proxmox stack — VE for compute, Backup Server for deduplicated encrypted backups, and Mail Gateway for filtering in front of whatever you already run. Backups are configured with a restore tested, because an untested backup is a rumor.

• Proxmox VE clusters with HA, quorum and live migration
• ZFS replication, Ceph, LVM-thin and shared storage design
• Proxmox Backup Server with deduplication and scheduled verify jobs
• Proxmox Mail Gateway in front of mailcow, Exchange or a hosted provider
• VMware to Proxmox migration — inventory, conversion, staged cutover
• Linux and Windows server hardening
• Identity, file sharing and access control
• Patching and lifecycle management

Full Proxmox capability →

Mail

Self-hosted mail that lands in the inbox.

Per-seat mail licensing adds up quickly. A properly configured self-hosted stack — mailcow or Postfix and Dovecot — costs a fraction of that, provided someone does the deliverability work: SPF, DKIM, DMARC, PTR and domain reputation.

• mailcow or Postfix/Dovecot deployment
• SPF, DKIM and DMARC configuration
• Deliverability troubleshooting and reputation repair
• Migration from Google Workspace or Microsoft 365
• TLS, relays and abuse handling

Automation & observability

Networks that describe themselves.

Ansible for configuration management so devices match a source of truth, and Zabbix with Grafana for monitoring that produces signal rather than a wall of alerts nobody reads.

• Ansible playbooks for network and server fleets
• Zabbix, Grafana and meaningful thresholds
• Change tracking and configuration drift detection
• On-call alerting that respects the hour

Security

Closing gaps before someone else finds them.

Endpoint protection, least-privilege access, patch discipline and segmentation — the unglamorous work that determines whether an incident is an inconvenience or an event.

• CrowdStrike Falcon deployment and tuning
• Least-privilege access review
• Segmentation for healthcare and financial data
• Patch and vulnerability management
• HIPAA-aligned configuration