Infrastructure

Infrastructure is only as useful as its connections. A reliable hypervisor with fragmented identity, or a well-segmented network where services cannot authenticate against each other correctly, produces an environment that is hard to operate regardless of the quality of its individual components.

We work across the full stack — from bare-metal hypervisors and storage pools through to the identity federation, storage protocols, and API integrations that make heterogeneous systems behave as a coherent whole. On-premise and hybrid environments designed for reliability from the ground up, not patched together reactively.

Virtualisation

We run Proxmox VE as our primary hypervisor — a mature KVM-based platform with a clean REST API, native LXC container support, and straightforward cluster management. Virtual machines handle workloads that need full isolation or a custom kernel; LXC containers cover everything else — lightweight, booting in under a second, trivial to snapshot and restore.

• Proxmox VE — cluster setup, node management, HA configuration, live migration
• KVM virtual machines — Windows Server, Linux VMs, GPU passthrough for compute workloads
• LXC containers — service isolation without the overhead of a full VM; ideal for self-hosted services
• Podman on Linux — rootless containers for application workloads on VPS hosts; no daemon, no root requirement

Storage

Storage design matters more than most teams realise — until something fails. We use TrueNAS for shared storage, with ZFS providing end-to-end checksumming, inline compression, and snapshot-based replication. ZFS pools are configured with appropriate redundancy: RAIDZ2 for bulk storage, mirrored vdevs for latency-sensitive databases.

• TrueNAS SCALE — ZFS pool design, dataset layout, quota policies, scheduled replication tasks
• ZFS snapshots and replication — automated periodic snapshots, incremental off-site replication to a second location
• NFS and SMB shares — network shares with Active Directory authentication or local user access
• S3-compatible object storage — MinIO or compatible backends for application-layer object access

Networking

A flat network with a single VLAN becomes a liability as infrastructure grows. We design segmented networks from the outset — server VLAN, management VLAN, IoT isolation, guest networks — using pfSense as the perimeter firewall and routing core. Managed switches carry 802.1Q trunks; every VLAN boundary has explicit firewall rules.

• pfSense — stateful firewall rules, NAT, traffic shaping, VLAN trunking on 802.1Q
• WireGuard VPN — site-to-site tunnels, remote access, homelab-to-VPS connectivity over encrypted channels
• NGINX reverse proxy — TLS termination, virtual hosting, upstream health checks, rate limiting
• VLAN segmentation — managed switch configuration, inter-VLAN routing policies, ACL design

Identity and Integration

Most technical debt lives at the boundaries between systems — the places where one application assumes something about another that is not documented, enforced, or even visible. We work at exactly these boundaries: connecting identity providers, storage protocols, and APIs so that heterogeneous environments behave as a coherent whole.

• LDAP and Active Directory — Samba 4 AD on Linux as the central directory; Kerberos realm, directory schema design, group-based access policy
• OIDC/OAuth2 and Authentik — self-hosted OIDC provider with LDAP outpost, SAML support, and Forward Auth; one login that serves the entire environment
• NGINX Forward Auth — per-application SSO without modifying the application; integrations for Forgejo, Nextcloud, Grafana, Proxmox, and others
• Storage protocol integration — NFSv4 with Kerberos; AD-integrated SMB shares; TrueNAS dataset connections to Proxmox and container hosts; S3 client integration
• API and event integration — REST API bridges between internal services, webhook receivers with retry and deduplication, lightweight event routing, data transformation between systems with incompatible schemas

Automation

Infrastructure configured by hand drifts. We treat configuration as code: services are defined declaratively, deployments are reproducible, and every change flows through a pipeline. For homelab and small-team environments, Forgejo with a self-hosted runner delivers a complete CI/CD pipeline with no cloud dependency — the same pipeline that builds and deploys this site.

• Infrastructure-as-code — declarative service definitions, idempotent deployment scripts, version-controlled configuration
• Forgejo CI/CD — self-hosted pipelines for build, test, and deploy; no GitHub, no external CI service
• Monitoring and alerting — Prometheus metrics, Grafana dashboards, log aggregation, uptime and latency alerting
• Runbooks and documentation — network diagrams, recovery procedures, architecture decision records for every significant choice

Who this is for

Teams running mixed environments: bare-metal servers alongside a VPS or two, with containers for modern workloads. Self-hosters who want proper SSO across their tools rather than a password manager full of individual accounts. Small businesses who want the reliability of enterprise infrastructure without the enterprise price tag.

If your current setup is a collection of servers with no documented topology, manual deployments, and no tested recovery plan — that is exactly the kind of situation we start from.