2026 FINISHED

OPTAVIM

Full information system of a fictional multi-site company (head office, branches and remote workers linked to a central datacenter), built from scratch from the pfSense firewall to the business apps: a hand-built kubeadm Kubernetes cluster, Active Directory, Keycloak SSO and 2FA. Security thought through from the start.

KUBERNETESMULTI-SITEADSSOMFASIEMHA

Read the writeup

STACK

ProxmoxpfSense (CARP HA)Active Directory + AD CSKubernetes (kubeadm)Calicocert-managerKeycloakprivacyIDEAOpenVPNHAProxyTraefikNFS (DRBD)MariaDB OperatorRedisDolibarrNextcloudOrangeHRMPrometheusGrafanaWazuh

HIGHLIGHTS

Datacenter split into VLANs (management, AD, NFS, Kubernetes, edge), pfSense firewall in HA with CARP, deny-by-default everywhere. Remote access through two OpenVPN servers (site-to-site and telework) with an SSH bastion as the single entry point.
Kubernetes cluster assembled by hand with kubeadm: 3 masters in HA, 3 workers, Calico pod network, certificates via cert-manager paired with the AD CS authority, persistent volumes provisioned dynamically on NFS servers replicated with DRBD and a failover VIP.
Database through a MariaDB Operator in the cluster and Redis for caching. Three business apps wired into the SSO: Dolibarr (ERP), Nextcloud (files) and OrangeHRM (HR).
Active Directory as the single source of accounts (3 controllers, DNS, GPOs, AD CS). Keycloak federates the directory over LDAPS as the single identity provider (OIDC/SAML), privacyIDEA adds 2FA on the telework VPN.
Exposure through HAProxy then Traefik, TLS and eight internal domains under *.optavim.corp. Monitoring with Prometheus + Grafana and a Wazuh SIEM with agents across the infrastructure.