Linux
Debian, Ubuntu, Alpine. systemd, journald, the whole ritual.
node online · DE
Jordan
I build and run infrastructure — the unglamorous layer everything else stands on. Four Proxmox nodes, a MikroTik-routed segmented network, and a written design for all of it before a single cable moved.
- uptime
- 0%
- pve nodes
- 0
- segments
- 0
- years
- 0
01
briefing
Anyone can get infrastructure running. The harder part is being able to explain, a year later, why it is built the way it is.
I'm an IT Specialist for System Integration, which mostly means I care about the layer nobody thanks you for — addressing, segmentation, certificates, the boring plumbing that only becomes interesting when it breaks.
Before this network moved a single cable it existed as a seventeen-page design document: addressing scheme, naming convention, firewall policy, migration order. That is the part I actually enjoy. Building it afterwards is just following your own instructions.
The lab is where I get to be wrong cheaply. Everything here has been broken deliberately at least once, which is the only reliable way I know to find out what a design does under pressure.
- roleIT Specialist for System Integration
- focusInfrastructure · Networking · Automation
- basedGermany
- statusnot looking
02
stack
Hover a cell. Everything here is something I actually run.
Proxmox VE
Four nodes across a cluster and a standalone host. VMs and LXC.
MikroTik
RouterOS 7 on an RB4011. Routing, DHCP, firewalling, inter-segment policy.
VLAN design
Six segments, addressing derived from the tag. Rules summarise instead of enumerate.
Ansible
Config as code. If it isn't in a playbook, it didn't happen.
Docker
Compose stacks managed through Dockge, split across two hosts.
Traefik
Two instances — one for internal routing, one fronting the DMZ. Automatic TLS.
TrueNAS
Virtualised. ZFS backing store with scheduled snapshots and replication.
WireGuard
Remote access without a single inbound port open.
Monitoring
Metrics and alerting. Knowing before anyone else notices.
Backups
3-2-1 with tested restores. An untested backup is a rumour.
Hardening
Least privilege, key-only auth, patch discipline, no exceptions.
03
the rack
Click a unit to pull it out.
cluster
standalone
network
04
the network
Select a node — the path it depends on lights up, everything else falls away.
segments
| segment | role |
|---|---|
| internal servers | services that never face the internet |
| dmz | everything published outward, isolated from the rest |
| clients | default access for wired and wireless endpoints |
| smarthome | IoT, with no route to anything it doesn't need |
| guest | internet only, no lateral reach |
| management | hypervisors, switch, access points |
rules this design follows
- The tag defines the address. Segment ID maps straight onto the subnet — no lookup table, ever.
- One /16 per site. Firewall rules summarise instead of enumerating.
- Endpoints are never configured. Segment assignment happens on switch ports and access points, never on the client.
- Segmentation is enforced at the router. The switch does layer 2 only.
- Placement and exposure are separate. Which segment a service sits in is routing; whether it is reachable from the internet is publishing.
05
builds
No public repos — the infrastructure is the portfolio. These are drafts; correct them.
Flat → segmented
draftMigrated a flat home network to six routed segments with policy enforced centrally. Written as a design document first, so the migration order was a checklist rather than a guess.
Four-node Proxmox
draftThree clustered nodes for anything that benefits from quorum, plus a fourth kept deliberately outside it as a separate fate domain.
Split ingress
draftTwo Dockge hosts, each with its own Traefik — one routing internally, one fronting the DMZ. Nothing published shares a proxy with anything private.
06
console
Real shell, fake machine. Type help.