Operational knowledge, kept explicit.
Current runbooks, troubleshooting records and architecture notes. Legacy material is marked rather than silently presented as current practice.
Picasso Viewer and Ez3D2009 on TrueNAS: centralized CBCT storage pilot (Part 1)
Field report: CBCT/DICOM on ZFS and SMB, SHA-256 verification of 1,939 files, three Windows 11 clients, and intermittent Ez3D2009 ProjectFile errors investigated with Process Monitor.
Veyon and unstable RDP: troubleshooting Interception, UpperFilters and GPO deployment
A Windows Veyon 4.11.3–4.11.4 case study: intermittent RDP black screens, Interception filter drivers, UpperFilters, safe removal and a controlled GPO deployment pilot.
Safe production rollout of an IPAM auditor: pinned release, systemd rollback and next-day verification
A practical RouterOS–NetBox IPAM auditor migration without interrupting monitoring: pinned GitHub commit, 121 offline tests, shadow metrics, systemd drop-in and scheduled-run validation.
RouterOS and NetBox: read-only IPAM drift detection with SSH and API
A practical RouterOS 7 versus NetBox 4.7 IPAM audit: exact VLAN, prefix and interface/IP comparison, least-privilege SSH, read-only API access and reviewed IPsec exceptions.
Monitoring a RouterOS–NetBox IPAM audit with systemd and Prometheus
A production-focused pattern for IPAM drift monitoring: atomic Node Exporter textfile metrics, systemd timers, PromQL alerts and Alertmanager routing verification.
Proxmox QEMU/LXC inventory in NetBox: vNIC import and daily drift monitoring
A production case study of QEMU/LXC discovery with Python, guarded NetBox 4.7 VMInterface/MAC import, systemd scheduling and Zabbix 7.0 guest drift monitoring.
Proxmox–NetBox drift detection with systemd, HTTPS API and Zabbix 7.0
A verified daily read-only audit of Proxmox hosts against NetBox 4.7 with a trusted CA, API v2 token, systemd timer, sanitized Zabbix metrics and four triggers.
Inventorying nine Proxmox VE nodes in NetBox 4.7: DMI, MAC addresses and network topology
Production case study: read-only collection of nine Proxmox hosts and 362 interfaces, safe enrichment of existing NetBox devices, and a verified idempotent dry-run.
Immich on TrueNAS SCALE: Android photo backup, HTTPS and ZFS
Production-style homelab deployment of Immich with TrueNAS SCALE 25.10, ZFS RAIDZ2, MikroTik split DNS, Nginx TLS and PostgreSQL backups.
VixWin Platinum 3.6.3 via GPO: preparing HKCU before the first launch
Active Directory case study: roaming user profiles, VixWin registry initialization, NAS-backed image database, logon scripts, PowerShell, and GPO filtering.
Automated software deployment and updates with GPO: PowerShell, MSI and SHA256 using 7-Zip
A production case study of rolling out 7-Zip 26.04 with Group Policy Preferences, scheduled tasks, SYSVOL, manifest.json, SHA256 verification and PowerShell.
Safe Windows 10/11 Appx cleanup through GPO: user logon, Audit/Enforce and SystemApps guards
A user-GPO case study of exact-name Appx cleanup, PowerShell Audit/Enforce modes, protected packages, OneDrive safeguards and source evolution v1.0–v1.4.
Veyon from Windows WORKGROUP to Active Directory clients: authentication, troubleshooting and GPO deployment
A Veyon 4.11.3 case study: a non-domain Windows Master, matching local credentials, Security 4625, access-control rules, DNS redirection and PowerShell/GPO deployment v1.3.
PostgreSQL 17 Maintenance for 1C: XID Age, VACUUM, and Autovacuum
Production case study: Postgres Pro 1C 17.10, XID age warnings, targeted maintenance of 18 databases, and database-level freeze statistics.
Veyon on Ubuntu with Active Directory authentication without domain join
A Veyon Master 4.11.3 case study integrating Ubuntu 24.04 with Kerberos/PAM and LDAPS without joining Linux to Active Directory.
Correlating Windows DNS and MikroTik IPFIX: domains and traffic volume in Grafana
A practical monitoring architecture where Windows AD DNS provides domain context, MikroTik IPFIX provides traffic volume, Loki stores events, and Grafana brings the data together.
Renaming an Active Directory domain in production: a practical case
A production-oriented Active Directory domain rename case using rendom and gpfixup, covering DNS, SYSVOL, GPOs, SPNs, certificates, NAS integration and post-migration validation.
Migrating multi-site IPsec IKEv2 tunnels from pfSense to MikroTik RouterOS 7
A production case study for moving a four-site policy-based IPsec topology from pfSense to MikroTik with staged cutovers, FQDN peers, validation, and rollback.
1C:Enterprise 8 + Postgres Pro 1C + Apache on AlmaLinux
A production-backed deployment baseline for 1C:Enterprise 8.3.27, Postgres Pro 1C 17 and Apache 2.4 on AlmaLinux 9, including service layout, web publication, monitoring and rollback boundaries.
Ansible control node for production Linux patching
A production-backed Ansible setup for mass-updating AlmaLinux servers, with role-based inventory, raw DNF workflow, kernel-change detection and a safer roadmap for staged maintenance.
Mailcow: safely finding and removing a malicious message from all mailboxes
An incident-response runbook for identifying a suspicious message across Mailcow/Dovecot mailboxes, validating the exact match, expunging it safely and verifying the result.
1C:Enterprise monitoring with node_exporter textfile collector, Prometheus and Grafana
A production-backed 1C:Enterprise 8 monitoring pattern using a systemd timer, a custom shell collector, node_exporter textfile metrics, Prometheus and Grafana.
Asterisk 13 monitoring with node_exporter textfile metrics, Prometheus and Grafana
A production-backed legacy Asterisk 13 monitoring pattern using a systemd timer, a custom CLI collector, node_exporter textfile metrics, Prometheus and Grafana.
Blackbox monitoring with HTTP, TCP, ICMP and TLS probes
A production-backed Blackbox Exporter pattern for endpoint readiness, TCP reachability, ICMP canaries, TLS verification and certificate-expiry alerting.
Infrastructure observability architecture: Prometheus, Grafana, Loki, Zabbix and Wazuh
A production-backed operating model for combining metrics, availability checks, logs and security telemetry across Linux, Windows, virtualization, storage, databases, telephony and network infrastructure.
Linux host monitoring with node_exporter, Prometheus file_sd and alert rules
A production-backed Linux monitoring pattern using node_exporter 1.12.1, Prometheus file-based service discovery, recording rules and layered host alerts.
PostgreSQL / Postgres Pro monitoring with Prometheus and postgres_exporter
A production-backed monitoring pattern for PostgreSQL and Postgres Pro using postgres_exporter, Prometheus and Grafana, with database-native metrics separated from generic Linux monitoring.
Network monitoring with SNMP Exporter and Prometheus
Production-backed SNMP monitoring architecture for MikroTik and Zyxel devices using snmp_exporter 0.30.1 and Prometheus file-based discovery.
Wazuh SCA: validating scans and rolling out custom hardening policies
A production-oriented workflow for verifying Wazuh Security Configuration Assessment, adding custom policies safely and validating results without broadening endpoint attack surface unnecessarily.
Windows Server monitoring with windows_exporter and Prometheus
A production-backed Windows Server monitoring pattern using windows_exporter 0.31.8, Prometheus file-based discovery, recording rules and alerting.
SSH login alerts via XMPP with sendxmpp and verified TLS
A production-oriented pattern for sending SSH login notifications to a self-hosted XMPP server without Telegram, embedded credentials or disabled TLS verification.
Proxmox Backup Server: backup policy, exclusions, verification and restore testing
A production-oriented framework for defining PBS backup coverage, retention, prune and GC jobs, verification, restore drills and explicitly accepted exclusions.
Asterisk 22 source deployment on AlmaLinux 9 with verified downloads and controlled activation
A reproducible Asterisk 22 source-build workflow for AlmaLinux 9 with pinned release checksums, bundled pjproject, dedicated service account and opt-in systemd activation.
Diagnosing deferred Mailcow delivery: local firewall or remote MX refusal?
A short evidence-driven workflow for distinguishing local SMTP connectivity problems from selective refusal by a remote mail server.
Monitoring Proxmox VE with Prometheus using API tokens and a trusted CA
A production-oriented pattern for collecting Proxmox metrics without disabling TLS verification or using a full administrator account.
MikroTik RouterOS 7: multi-WAN policy routing with per-VLAN failover
A production-oriented pattern for steering different VLANs through preferred uplinks while preserving controlled failover and verifiable egress behavior.
Proxmox VE: rolling kernel maintenance with one-boot fallback
A production-oriented runbook for changing the kernel across a multi-node Proxmox VE cluster while preserving quorum, evacuating workloads and retaining a fast rollback path.
Proxmox VE: collecting evidence before rebooting a frozen Windows VM
A production incident-response runbook for preserving host, QEMU, task and storage evidence before resetting an unresponsive Windows guest.
Migrating Ceph authentication keys to aes256k without losing cluster access
A staged operational approach to rotating Ceph service and client keys while preserving quorum and administrative access.
Windows Server 2025: two-DC Active Directory with DNS and restricted RDP
A production-oriented pattern for deploying two Active Directory domain controllers with AD-integrated DNS, secure dynamic updates and GPO-based RDP access boundaries.