Project Objective
Design and implement a secure, fully integrated IT service platform for a fictional software development company (Company XYZ) with offices in Los Angeles and Singapore. The solution centralizes authentication, provides unified access via a corporate portal, and delivers essential enterprise services including collaboration, helpdesk, monitoring, and endpoint management.
Value Proposition
Demonstrates ability to architect and integrate complex systems to solve real business problems, transitioning from technician to IT architect capabilities.
Architecture Overview
Platform Architecture
Core Identity
Two Windows Server 2019 Domain Controllers (cg5dc1, cg5dc2) forming the capsg5.local forest with redundant authentication services.
Security Perimeter
pfSense firewall with Snort IDS/IPS for intrusion detection and prevention, plus site-to-site VPN capability for multi-office connectivity.
Unified Access Layer
Docker-based Nginx Proxy Manager and Homer dashboard serving as the corporate portal (portal.capsg5.local) with one-click access to all services.
Enterprise PKI
Internal Root Certificate Authority using AD Certificate Services for trusted SSL certificates across all internal services.
Integrated Service Stack
Zimbra Collaboration Suite
Email, Calendar, FilesFull collaboration platform deployed on Ubuntu with LDAP authentication and auto-provisioning for seamless user onboarding.
- SMTP/IMAP email services
- Shared calendaring
- Briefcase file sharing
- AD/LDAP SSO integration
Zabbix Monitoring
Infrastructure MonitoringEnterprise monitoring with MySQL backend, AD authentication, and real-time alerting via Telegram for proactive issue resolution.
- Server & network monitoring
- Custom alert thresholds
- Telegram notifications
- AD/LDAP authentication
Zammad Helpdesk
IT Service ManagementProfessional ticketing system with Elasticsearch for fast search, integrated with AD/LDAP for automatic user synchronization.
- Ticket management
- Email integration
- Knowledge base
- LDAP user sync
Headwind MDM
Mobile Device ManagementAndroid enterprise device management with LDAP authentication and policy enforcement for corporate mobile devices.
- Device enrollment
- Policy enforcement
- App management
- LDAP authentication
Key Achievements
Core Infrastructure & Authentication
- Provisioned redundant AD environment with structured OU hierarchy
- Configured pfSense with firewall rules, Snort IDS/IPS, and LDAP authentication
- Established standardized naming convention and IP schema across all services
Enterprise Service Deployment & Integration
- Zimbra: Deployed on Ubuntu with LDAP auth and auto-provisioning
- Zammad: Installed with Elasticsearch, integrated AD/LDAP for user sync
- Zabbix: Configured with MySQL, AD authentication, Telegram alerting
- Headwind MDM: Deployed enterprise trial with LDAP auth and policy enforcement
Unified Portal & Secure Access
- Deployed containerized gateway (NPM + Homer) with restart policies
- Built internal PKI with AD CS and SAN certificates for all services
- Configured SSL termination with trusted CA-signed certificates
- Created branded Homer dashboard (Company XYZ IT Portal) with service grouping
Cross-Service Integration
- Achieved true SSO across six different technology stacks using LDAP binds to AD
- Implemented defense-in-depth: perimeter security, endpoint management, monitoring, centralized identity
- Ensured all internal web communication secured with HTTPS using enterprise PKI
Project Gallery
Technical Highlights
Enterprise SSO
Achieved Single Sign-On across six different technology stacks (Windows, Linux, Docker) using LDAP binds to Active Directory.
Internal PKI
Built enterprise Certificate Authority using AD CS to eliminate browser certificate trust warnings across all internal services.
Containerized Gateway
Docker-based service gateway with Nginx Proxy Manager for resilience, easy management, and rapid service deployment.
Technologies Used
Virtualization & OS
Core Infrastructure
Security
Enterprise Services
DevOps & Delivery
Project Deliverables
- Production-grade integrated IT platform transforming siloed services into cohesive ecosystem
- Single secure portal (portal.capsg5.local) with one-click SSO access to all tools
- Centralized AD management for all users and services
- Automated monitoring and alerting (Zabbix + Telegram) for proactive issue resolution
- Layered security model combining network, endpoint, encryption, and identity governance
- Containerized, modular gateway designed for easy scaling and high availability
- Comprehensive "Build Book" documentation for deployment and extension
My Contribution
As a key contributor in a team of 5, I was responsible for the design and integration of the monitoring system (Zabbix with Telegram alerting) and the Docker-based unified gateway (Nginx Proxy Manager + Homer dashboard). This included configuring LDAP authentication, setting up SSL termination with enterprise PKI certificates, and ensuring service resilience through proper container orchestration.
