IT Support Engineer – Active Directory, Microsoft 365 and identity.
in IT since 2008
I keep Windows environments working for the people who depend on them: accounts and access, Microsoft 365, endpoints, and the second-level problems that do not have an obvious answer. I have worked in IT since 2008, first supporting international organisations operating in difficult conditions in Afghanistan, and now in enterprise IT in Germany.
Alongside that I run a home laboratory that behaves less like a hobby and more like a small production environment: two Proxmox nodes running around twenty machines, kept standalone on purpose, a Windows Server 2025 Active Directory domain, pfSense and UniFi handling routing, firewalling, switching and VLANs, TrueNAS and ZFS storage replicated to a second NAS, Proxmox Backup Server, and Prometheus and Grafana watching all of it. I am currently building a Microsoft Configuration Manager site there, working through client management, distribution points, software updates, PXE and Windows 11 deployment end to end.
That is where the guides come from. Each one describes something I have built and finished myself, written down properly so the next person does not have to work it out twice.
nothing exposed inbound
stalereported 12 h ago·as JSON
No sample in the last 45 minutes, so these numbers are the last known ones rather than current.
Pushed out by a signed agent every quarter hour. Nothing on this site can reach into the network, and nothing here is an address.
Built the way a small production environment is built: nothing exposed inbound, identity in front of anything that writes, and a copy of the data somewhere that cannot be reached from the machine holding the original. Select a box to read what it does.
Select a box in the diagram to read what it does.
A domestic cable line with a changing address. Nothing is port-forwarded to it, which is the single decision the rest of this diagram is built around.
Every public request lands here first, never on a home address. The same zone is also an internal Active Directory domain, which needs a delegation to keep both halves resolving.
Identity is settled before a request reaches any code. The site verifies the resulting token independently rather than trusting the header, so a misconfigured policy cannot quietly open the editor.
The pages you are reading. Server-rendered at the edge, content in a SQL database, images in object storage, no server to patch.
Internal services are published by a connector that dials out. There is no inbound rule anywhere on the router, so there is no inbound rule to get wrong.
The LAN edge. Separate VLANs for trusted devices, IoT and guests, and every DNS query on the network is forced through the filtering resolvers, whatever a device has configured.
A small container that holds the tunnel open from the inside. If it stops, published services disappear from the internet and nothing else changes.
Eight 2.5G ports and a single 10G uplink, which makes "what deserves the 10G port" a real decision: the hypervisor or the storage it reads from.
Filters for the whole network over encrypted upstreams and forwards the Active Directory zone to the domain controllers, so domain members and phones both resolve correctly. A second copy runs on the other node.
The main node, carrying the lab itself. Memory, not CPU, is the limit -- it was twice overcommitted until the guests were right-sized and page sharing was turned back on.
Active Directory and the authoritative internal DNS. Right-sized from 16 GB to 6 GB once its real committed memory turned out to be under 5 GB.
The family cloud with Euro-Office for documents, in one VM with Docker Compose and published through the tunnel. It replaced OneDrive, behind strong passwords and two-factor sign-in.
Home automation, including Matter and Thread devices -- the reason IoT gets its own VLAN and the reason multicast between VLANs had to be understood properly.
A Configuration Manager site built alongside the domain to practise collections, application deployment, patching and bare-metal Windows deployment.
A small second node for everything that has to keep running while the main one is down for maintenance. Standalone on purpose: a two-node cluster loses quorum the moment either node stops.
A second domain controller on the other node, so sign-ins and internal DNS survive the main node being down.
A copy of the filtering resolver, kept in sync with the first, and handed out alongside it -- so DNS keeps working when either one, or the node under it, stops.
Deduplicated nightly backups of every guest on both nodes, stored on the primary NAS. It lives on the second node so a broken main node never takes its own backups with it.
Prometheus scrapes both nodes, the NAS, the network and the backups into its time-series database; Grafana draws it. The dashboards are what turned the swap problem from a feeling into a number.
Uptime Kuma checks every service each minute, sends phone alerts, and gives the family a page of green and red -- with an outside check watching the watcher.
One page with the health and temperature of every disk in the house, fed by both NAS units, so a failing drive is a warning rather than a surprise.
The pool everything else depends on: media, photos, and the backup datastore. Migrated off the vendor OS with rsync, keeping ownership and timestamps intact, so nothing had to be re-indexed afterwards.
A second box that reaches out and pulls. A pull model means ransomware on the primary cannot reach the copy, because the copy holds the only credentials.
Battery backup reporting over the network so more than one machine can shut down cleanly.
22 published
Walkthroughs of work that is finished and running, written so the commands can be copied and run.
A family cloud with online Word, Excel and PowerPoint editing: a Debian 13 cloud-image VM, Nextcloud, PostgreSQL, Redis and Euro-Office in Docker Compose, published through a Cloudflare Tunnel with no open ports, plus the three pitfalls that cost the most time.
A safe way to update Immich on TrueNAS: read the release notes, take snapshots, and update with one script.
Add a second domain controller on Proxmox, set up DNS on both, and check that Active Directory copies between them.
See the last backup of every VM and container, find guests with no backup, and know when storage will be full.
Record internet outages, ping and speed tests, and get an alert when your internet is down or slow.
runs in your browser
Each calculator runs entirely in your browser. Nothing is submitted and nothing is stored.
How much of a pool you actually get to use, once parity, the TB-to-TiB conversion and the 80% fill line have taken their share.
How long the batteries hold at a given load, and whether that is long enough for everything to shut down cleanly.
Network, broadcast, usable range, mask and wildcard for any IPv4 prefix — including the /31 and /32 cases most calculators get wrong.
Add up what the guests are allowed to take, subtract what the host and ARC need, and find out before the swapping starts.
since 2008
2024 – present
Avaso Technology Solutions
Enterprise IT support across Germany: user accounts and permissions, Microsoft 365 and Okta administration, IT asset management, and second-level incidents resolved alongside the infrastructure, network and security teams.
present
Home laboratory, self-directed, Stuttgart
A Proxmox cluster of around twenty virtual machines and containers: a Windows Server 2025 Active Directory domain, pfSense routing and firewalling, UniFi switching and VLANs, TrueNAS SCALE and ZFS storage with scheduled replication to a second NAS, Proxmox Backup Server, and a Prometheus and Grafana monitoring stack. Currently building a Microsoft Configuration Manager site covering client management, distribution points, software updates, PXE and Windows 11 deployment.
2016 – 2021
GIZ GmbH, Samangan
IT operations and end-user support for a provincial office, combined with radio communications keeping the office reachable when other links were not dependable.
2010 – 2016
GIZ GmbH, Kunduz
Windows workstations, accounts and access control, backups and updates, network and internet services, hardware lifecycle and software licensing. Coordinated the IT side of the move from the Kunduz office to Samangan.
2008 – 2010
Medical Emergency Relief International (Merlin), Kunduz
IT operations, end-user support, data protection and backups for a medical relief mission, with documentation, user training and vendor coordination.
8 areas
Questions about a guide, or about the lab? LinkedIn is where to find me.