// hybrid cloud · on-prem · identity · automation

Filip Novak

Junior Systems Engineer

Building production-grade hybrid infrastructure from the ground up — bare-metal hypervisor through Azure cloud, with identity, networking, backup, and observability layers. CCNA certified. AZ-104 in progress.

View lab on GitHub
Hybrid lab topology ON-PREM AZURE Proxmox VE Z440 · Type 1 Hypervisor OPNsense edge FW DC02 AD DS · DNS Raspberry Pi 3 Zabbix · Grafana IPsec / IKEv2 VPN Gateway Basic · RouteBased vNet 10.0.0.0/16 ACA portfolio Azure DNS filipnovak.ch · authoritative Active Planned 172.16.0.0/24 switzerlandnorth

// deployment pipeline

Architecture Build Phases

✓

Phase 1 — Cloud Identity Baseline

filipnovak.ch on Azure DNS · Entra ID domain verified · UPN suffix · M365 tenant

Partial
●

Phase 2 — Cloud Portfolio Deployment

Azure Container Apps · Log Analytics workspace · Bicep IaC · www.filipnovak.ch

In Progress
○

Phase 3 — Standalone Monitoring

Raspberry Pi 3 · Zabbix + Grafana via Docker Compose · Synthetic web checks

Pending
○

Phase 4 — Physical Hypervisor Leap

Proxmox VE on Z440 · OPNsense VM migration · DC02 FSMO transition · Win11 PAW

Pending
○

Phase 5 — Hybrid Bindings & Backups

Entra Connect · Veeam agentless backup · Grafana unified dashboard · P2S OpenVPN

Pending

// deployed components

Infrastructure

Azure Cloud

  • VNet 10.0.0.0/16 — GatewaySubnet + Production
  • VPN Gateway — S2S IPsec/IKEv2 to OPNsense (FQDN peer)
  • Container Apps — portfolio at www.filipnovak.ch
  • Log Analytics workspace — diagnostics layer
  • Azure DNS — filipnovak.ch authoritative zone
  • Key Vault + Container Registry (persistent RG)

On-Premises

  • Proxmox VE — Type 1 hypervisor on HP Z440 workstation
  • OPNsense — edge FW, DDNS client, S2S IKEv2 termination
  • DC02 — Windows Server 2025 Core, AD DS, 5 FSMO roles
  • Veeam B&R — agentless backup via Proxmox API
  • Raspberry Pi 3 — Zabbix + Grafana (Docker Compose)
  • Network 172.16.0.0/24 · internal.filipnovak.ch

Identity Layer

  • 17-OU structure — Corp, Users, Computers, Servers, Groups
  • 6 GPO baseline — audit policy, RDP restriction, hardening
  • Fine-Grained PSO — service accounts, strict lockout
  • Entra ID — filipnovak.ch verified, UPN suffix live
  • Entra Connect — Password Hash Sync (Phase 5)
  • M365 — DMARC + DKIM + SPF configured

Automation & IaC

  • Bicep — modular, idempotent Azure deployments
  • PowerShell — AD lifecycle, GPO backup/restore scripts
  • ShouldProcess + left-filter — all production scripts
  • PSRemoting / SSH — headless server management
  • Incident log — every environment failure formally documented
  • TAGS_REFERENCE taxonomy — searchable lab knowledge base

// technical profile

Skills & Certifications

Active Directory DS Azure VPN Gateway IPsec / IKEv2 Azure Container Apps Bicep IaC PowerShell Proxmox VE OPNsense DNS (Azure + AD) Windows Server 2025 PSRemoting / WinRM GPO Design Entra ID NSG / ASG Zabbix Grafana Docker Veeam B&R RBAC Azure DNS DMARC / SPF / DKIM
Cisco CCNA Certified
Microsoft AZ-104 In Progress