A large retail chain ran its infrastructure out of spreadsheets nobody reconciled. I built the inventory on NetBox: ~2,400 sites, ~8,900 devices. Twelve systemd timers pull from the source systems, reconcile, write back, check quality. Network discovery lands in a separate branch. I merge that one by hand. Automation deletes nothing. That's a rule, not a setting. GitLab CI on the repo, 841 green tests.

Exchange can't do a second factor the way we needed. And nobody was going to let me near its internals. So ANGIE went in front of OWA and the Outlook clients, and 2FA moved into Keycloak behind a provider I wrote. Exchange itself I never touched. Not one line. It runs in production. All corporate mail goes through it.

Four sites, two countries. Empty field at the start. I stood up AD, Exchange with a DAG across sites, mail through PMG with HAProxy and SNI routing. Routing itself on WireGuard + GRE + OSPF over MikroTik RouterOS 7. Certificates issue and reach Exchange on their own. Message tracking good enough to take an incident apart. BookStack so the whole thing is written down. Built it solo, start to finish.

Windows and macOS clients for corporate access, plus the policy panel behind them. The server signs policy with ECDSA P-256, the client checks it with an embedded key. Update trust is pinned to the issuing CA, not a thumbprint. Pin the thumbprint and one reissue kills updates fleet-wide. I keep machine data and the user profile apart. Panel login is a domain account, over Kerberos. Tests went from 31 to 175. All in production.

Certificates went out by hand, so sometimes they didn't go out at all. I stood up an internal CA. The intermediate is signed by the corporate Windows CA, so nobody had to roll out a new root. ACME issues 60-day certs and renews them itself. Onboarding a service is one command plus a reload hook. Skip the hook and the renewed cert never reaches the daemon. Where ACME can't reach, a panel. Linux only in production so far.

Reports sat in GitLab Pages, access handed out by hand. I wrote a gateway: sign-in through the corporate OIDC, then a group check before every report. GitLab itself never faces outward. The cookie was the fiddly part. A full group list blows the 4 KB limit, and the user got an endless redirect. Now it holds only groups that intersect the access map. The unit of permission is now the report type. 73 tests, written alongside.

Fleet of about 4,600 machines. The legacy management server was off limits, so the new one went up beside it, production never stopped. The catalog updates itself: pulls vendor versions, checks signature and hash, supersedes the build, ships it on. 24 apps, most already in production. For VDI I wrote a portal. It clears stuck input by saving and resuming the machine. The user keeps their sessions, and I don't get the call.

Seven domains, roughly 23,000 active accounts, and policies different people had been editing for decades. I wrote 17 PowerShell scripts: find the broken ones, restore Security Filtering after a mass downgrade to Authenticated Users, clear out dead NetLogon ACEs. Every run starts with a pre-flight, then three phases, with a backup and a rollback path at each step. Hundreds of GPOs. Not one blind change.

Seven domains, roughly 23,000 active accounts, Windows Server 2008 in production, replication whenever it felt like it. I moved the forest onto a current version, one structure. Roles went out across three sites. Objects from several domains came into one. Replication became predictable. That was the whole point.

Zabbix with proxies in remote networks, Grafana dashboards for diagnostics. Routine went into scripts and Docker. Geography came later. Addresses were already in the inventory, coordinates came over with the built-in sync. No code of my own. About 2,000 store maps. Then I cleared the open-ended suppressions: far more than needed, and outages were quietly waiting them out. Coverage is complete, some points only to city level.

Several offices and two data centers, each living on its own. I pulled them into one managed perimeter over site-to-site IPSec. Links to the data centers I rebuilt on MikroTik and OpenVPN, and moved some hardware. The internet bill dropped by roughly two thirds.

Consolidated virtualization on VMware. Converted the Hyper-V machines over, stood up vCenter 7, and a fault-tolerant cluster on about 15 physical nodes with it. Ran a vCloud Director cloud alongside.

Backup across three sites. Full Veeam coverage for the VMs, network device configs copy themselves. The recovery plan is written down and kept where people will find it. I checked it by restoring. Not by a tick in a report.

An agent you ask about infrastructure in plain words. LLM with tool-calling over MCP servers for inventory and monitoring, answers in a bot. I ran 15 test questions, checking each answer against the database. Six held up. Not the model: narrow query schema, no honest counting, step limits choking it. All tool layer. That's where it got fixed. The catalog is resent every iteration, so I halved it. In production. No demand yet.

I carry a complex system alone, so I built three agents around me: a strategist, a knowledge-base keeper, a developer in the IDE. They talk over an MCP Memory Server. On a second pass I added adversarial review of my own diff: several independent lenses, then two skeptics tearing each finding apart. Two runs, 13 of 38 and 14 of 32 survived. "Confirmed" here means nobody could refute it. There's no outside check.

Ran the corporate PBX and a hosted virtual PBX, and cut the phone bill along the way. Stats went into BI through a Python export. Calls went to GPT-4 for review. The report lands with the manager, right in the CRM.