John Ghlen Dealdo

What this project covers

• Designed a two-bridge Proxmox layout with a WAN bridge and isolated private management bridge.
• Placed OPNsense between external ingress and private administration paths.
• Deployed a two-node OPNsense HA pair with CARP virtual IPs (VIPs) on both the LAN and WAN so gateway and firewall failover stays transparent to clients.
• Built a dedicated isolated sync bridge for XMLRPC configuration sync and pfsync state synchronization, kept off the data paths to reduce blast radius and keep HA control traffic in its own fault domain.
• Kept WireGuard as the private administrative access path through the HA design.
• Handled firewalling on the OPNsense pair with policy governing ingress and inter-zone paths.
• Sequenced baseline capture, rollback prep, VPN validation, cutover, and post-cutover handover.

Compact schema

Sequence

1. Approve topology

   Confirm bridge roles, address ownership, private subnet boundaries, and the VPN-first operator path.

2. Capture baseline

   Record interfaces, routes, hostname behavior, access model, TLS state, and rollback requirements.

3. Build network base

   Create WAN and private bridges, deploy OPNsense, enable private LAN services, and validate a test VM.

4. Stand up HA pair

   Deploy the second OPNsense node, add the isolated XMLRPC and pfsync sync bridge, and validate CARP failover across LAN and WAN VIPs.

5. Validate VPN entry

   Enable WireGuard, test external admin access, and keep the original management path until the private route works.

6. Cut over management

   Move hypervisor administration to the private bridge and confirm the old exposed path is closed.

7. Harden and hand over

   Document final access, certificate behavior, validation evidence, and recovery procedures.

Stack

What this project covers

• Deployed a monolithic Zabbix server with the server, database, and web frontend on one node as the monitoring control point.
• Rolled out Zabbix Agent 2 to 8 client servers using an Ansible playbook for repeatable, uniform installation and registration.
• Standardized host and agent configuration so monitoring coverage is consistent and easy to extend to new hosts.

Compact schema

Sequence

1. Stand up Zabbix

   Deploy the monolithic Zabbix server with the server, database, and web frontend on one node.

2. Define agent rollout

   Create the Ansible path for repeatable Zabbix Agent 2 installation and configuration.

3. Roll out Agent 2

   Use Ansible to install and configure Zabbix Agent 2 across the 8 client servers.

4. Verify monitoring

   Onboard the hosts into Zabbix and confirm that the fleet reports into monitoring consistently.

Stack

What this project covers

• Split Terraform into `network`, `image-factory`, and `workloads` states to control blast radius and review scope.
• Defined a four-zone platform model with Proxmox Linux bridges at L2 and OPNsense as the routing and policy control plane.
• Published a Terraform-to-Ansible handoff contract and validation-only GitHub Actions pipeline instead of mixing deployment logic into CI.

Compact schema

Sequence

1. Establish platform contracts

   Document architecture, scope, ADRs, naming, and lifecycle ownership before expanding implementation.

2. Build image factory

   Use Packer to produce the reusable Debian-based image and template contract for downstream platform layers.

3. Split infrastructure states

   Separate shared network fabric, template lifecycle, and workload provisioning into independent Terraform roots.

4. Provision zoned workloads

   Model admin, edge, application, and data workloads against the OPNsense-backed four-zone network contract.

5. Hand off to configuration

   Publish an Ansible-ready inventory output and keep CI focused on validation, formatting, and syntax safety.

Stack

What this project covers

• Built a Python CLI for internal audit workflows with typed configuration and scanner orchestration.
• Used Docker Compose to run supporting security and chaos-testing services.
• Added tests, linting, typing, and pre-commit checks to keep the toolkit maintainable.

Compact schema

Sequence

1. Model audit workflows

   Define CLI commands, configuration, and output formats before adding scanners.

2. Attach tool adapters

   Wrap security tools behind consistent interfaces for repeatable execution.

3. Run local lab services

   Use Compose-managed services for scanner and chaos-testing workflows.

4. Enforce quality gates

   Use tests, linting, typing, and pre-commit checks to catch toolchain drift.

Stack