OPTAVIM is one of my most ambitious projects to date. The goal: build the information system of a fictional multi-site company, from the firewall all the way to the business applications. It was also a string of firsts for me and my group: my first real Kubernetes cluster set up by hand with kubeadm, my first serious steps on Active Directory and on pfSense. A whole stack to learn, with security as the thread running through it from start to finish.
This article walks through the architecture and shows the components I worked with.
Overview
OPTAVIM is a company spread across several sites, all connected to a central datacenter through encrypted VPN tunnels:
- a head office in Paris, with its 3 domain controllers and dual fiber,
- a strategic branch in Bordeaux, with management and users on two WAN links,
- two classic branches (Rennes and Brest), only user workstations,
- remote workers on roaming access, protected by two-factor authentication.
The datacenter concentrates the firewall, Active Directory, the storage and a Kubernetes cluster that hosts the applications.
The three site types, from the most complex to the simplest:
The network: pfSense and segmentation
This is where we started. The datacenter is split into VLANs, one per function: management, Active Directory, NFS storage, Kubernetes, and an edge zone for the load balancers. The pfSense firewall runs in high availability with CARP, a master node and a slave that sync together.
I learned to think in deny by default: nothing crosses between two VLANs unless a rule explicitly allows it. For remote access, two OpenVPN servers live on the firewall, one for site-to-site links and one for remote work. An SSH bastion acts as the single entry point from outside.
The core: a Kubernetes cluster built with kubeadm
This is the piece I am proudest of. Six nodes: three masters in high availability, three workers. No turnkey distribution, this is kubeadm assembled by hand, which forced me to understand what actually happens inside the cluster, the interactions between its different components: the control plane, the pod network with Calico, certificate issuance with cert-manager paired to the Active Directory certificate authority, and dynamic provisioning of persistent volumes on the NFS servers.
The NFS servers themselves run in high availability, with data replication through DRBD and a virtual IP that fails over when a node dies. The database runs through a MariaDB operator inside the cluster, with Redis for caching. The end-to-end idea is that nothing depends on a single machine.
Identity and security
This is the part that gives the rest its meaning. Active Directory is the single source of accounts: three domain controllers, internal DNS, GPOs to manage the Windows machines, and the certificate authority.
On top of that, Keycloak federates the directory over LDAPS and acts as the single identity provider for the applications, in OIDC or SAML depending on what each one supports. privacyIDEA adds the second factor, with one-time tokens for the remote-work VPN. The result: an employee logs in with their domain account and finds their tools, without juggling passwords, and access is restricted to the department group they belong to.
For monitoring and security, Prometheus and Grafana collect the metrics, and Wazuh acts as the SIEM with its agents deployed on the infrastructure machines. All exposure to the outside goes through HAProxy then Traefik, with TLS certificates and eight internal domain names under *.optavim.corp.
The business applications
At the end of the chain, three applications that simulate the real use of a company: Dolibarr for the ERP, Nextcloud for file storage, and OrangeHRM for human resources. All wired into the SSO, all fed by the accounts and groups in Active Directory. The full flow goes from the user workstation to the firewall, then to HAProxy, to Traefik, and finally to the application, with authentication handled by Keycloak along the way.
What this project gave me
OPTAVIM had me work with a stack I didn't know in depth, sometimes only by name. My first serious Kubernetes cluster with kubeadm, my first steps on Active Directory and pfSense, setting up a full SSO, two-factor authentication, a SIEM. Above all, I understood how these pieces fit together.
The habit I am keeping is to think security from the start rather than as an option bolted on at the end if there's time. Network segmentation, deny by default, central identity, second factor, monitoring: these are not checkboxes, they are layers that reinforce each other. Building OPTAVIM from scratch was the best way to understand that concretely.
What I'd do differently
With hindsight, five things for a v2:
- Move observability and the database out of the application cluster. Today Prometheus/Grafana and the database live in the same cluster as the apps. Isolating them would stop an application incident from taking the monitoring or the data down with it.
- Go GitOps. The cluster is versioned in Git, but deployments are still manual. Wiring up ArgoCD to reconcile the desired state automatically would be the next real step.
- Move volume storage to Longhorn or Ceph. The persistent volumes currently sit on NFS servers replicated with DRBD. NFS is fine for sharing files, but it makes a poor backend for Kubernetes volumes: everything goes through a single pair of servers and their VIP, file locking sits badly with databases that expect block storage, and no volume is replicated on its own. Longhorn (simple to run) or Ceph (more complete) give you distributed block storage, replicated across nodes and provisioned dynamically through CSI.
- Interconnect the sites over IPsec rather than OpenVPN. For the site-to-site links, IPsec would be more standard and more performant than the current OpenVPN. It wasn't possible here for logistical reasons specific to the project, but it would be the default choice on a real infrastructure.
- Move the remote-work VPN to WireGuard. In place of OpenVPN, WireGuard would bring better performance and a simpler configuration, with a far smaller codebase (and so a reduced attack surface).
Stack: Proxmox, pfSense (CARP HA), Active Directory and AD CS, Kubernetes built with kubeadm (Calico, cert-manager), Keycloak, privacyIDEA, OpenVPN, HAProxy, NFS with DRBD, MariaDB operator, Redis, Dolibarr, Nextcloud, OrangeHRM, Prometheus, Grafana, Wazuh.