TECHNET / Projects

Work we're proud of — and still run.

Thirteen builds across networking, cloud, email, backup, domains and software. Client details are anonymised; every result below is something we measured or verified.

Network · Cloud

Hybrid mesh that beats carrier-grade NAT

Connecting a satellite-internet site to a cloud fleet with no public IP and no port-forwarding.

10+ nodes meshed0 inbound ports

Challenge · Solution · Outcome

Challenge: A Starlink link behind CGNAT made direct remote access impossible and unreliable.
Solution: Tailscale mesh with a subnet router for the site LAN, plus a self-hosted DERP relay and a public jump host as deliberate fallbacks.
Outcome: Everything reachable from anywhere; during a mesh outage the jump-host path kept fleet automation running.

Network

Router offload to a virtual firewall

Re-platforming a home/SME gateway onto OPNsense with VLAN isolation and a safe rollback.

3 VLANsClean cutover

Challenge · Solution · Outcome

Challenge: An overloaded consumer router was the single point of failure; a torrent-heavy host shared the trusted LAN.
Solution: OPNsense VM with Kea DHCP, 802.1Q core switch, a VPN-forced VLAN with kill-switch for the downloader, and the old router demoted to WAN transit.
Outcome: Staged cutover with documented rollback; untrusted traffic now isolated and forced through the VPN.

Own-domain business email, fully authenticated

Mailcow on the cloud with DNSSEC and strict mail authentication — delivered in a single working session.

SPF · DKIM · DMARC pass6 mailboxes

Challenge · Solution · Outcome

Challenge: Cloud providers block outbound port 25, so self-hosted mail silently fails to send.
Solution: Inbound direct; outbound through an authenticated cloud email relay with matching SPF/DKIM, MTA-STS and TLS-RPT, auto-discovery for Outlook and phones.
Outcome: Verified delivery to Gmail and Outlook with all authentication checks passing and a clean spam score.

Backup

Ransomware-resistant backup chain

Append-only repositories, per-system logins, off-site and home copies, and alarms for stale backups.

3 copiesRestore-tested

Challenge · Solution · Outcome

Challenge: Critical systems (mail, password vault, logs) had little or no independent backup.
Solution: restic to an append-only REST server with private repos, server-side retention, a home mirror and an encrypted config bundle.
Outcome: A routine check caught a backup server that had stopped after a patch reboot; we fixed it and added a self-healing timer so it can't recur silently.

Monitoring

Monitoring that monitors itself

Prometheus, Loki and Grafana across servers, networks and power — with audits for silent failure.

9+ scrape targets30-day log retention

Challenge · Solution · Outcome

Challenge: Dashboards looked fine while the collector had quietly been running on an empty config for days.
Solution: Root-caused container/volume drift, restored the real data directory and added verification steps to every review.
Outcome: Full history recovered; log-ingestion and scrape outages now surface within one sweep.

Cloud

Private cloud storage — six major upgrades, zero loss

Nextcloud with a hard-capped data volume, phone photo backup and a verified-safe upgrade path.

v28 → v340 data loss

Challenge · Solution · Outcome

Challenge: End-of-life server version; upgrades must go one major version at a time.
Solution: Quiesced, verified off-box backup first; six sequential hops with a health check after each.
Outcome: Live phone sync resumed on the newest release with data intact and log rotation fixed.

Software

Quotation & invoicing platform

Quotes, invoices, delivery notes and statements — PDF layouts matched to each client's own format.

Client-specific templatesNightly backups

Challenge · Solution · Outcome

Challenge: Generic tools couldn't reproduce regional client document formats.
Solution: Templated PDF engine with per-client layouts, a redesigned interface and locked-down document generation.
Outcome: Replica-accurate documents produced in seconds, with a private-network-only admin surface.

Software · Pilot

Kenyan statutory payroll & self-service

Payroll runs with statutory deductions and an employee portal where staff view their own payslips.

PAYE · NSSF · SHIF · Housing Levy

Challenge · Solution · Outcome

Challenge: Payroll rules change often and errors are costly.
Solution: Rules kept as data, admin authentication and national-ID based employee login, running on a private network.
Outcome: In pilot with test data while controls and public-exposure security review are completed.

Network · Support

Remote-site operations over a private overlay

Managing a Windows Server, Active Directory and Hyper-V estate at a coastal client site with no VPN appliance.

ZeroTier overlayContinuous performance watch

Challenge · Solution · Outcome

Challenge: Sluggish file server and VMs; the only path in was a software overlay.
Solution: Scripted, read-only performance baselining of host and guests over the overlay.
Outcome: Evidence-based tuning conversations instead of guesswork.

Network · Compliance

Tax-register (ETR) connectivity diagnosis

A fiscal device couldn't reach the revenue authority — we proved where the fault actually was.

Root cause isolated

Challenge · Solution · Outcome

Challenge: Repeated "can't connect" errors and pressure to swap hardware.
Solution: Layered tests from the LAN outward showed the local network was healthy and the fault sat at the authority's own edge.
Outcome: No pointless replacements; the client had clear evidence for escalation.

Email · Collaboration

Google Workspace deployments

Business email, calendars, shared drives and meetings on your own domain — set up securely and migrated without drama.

SPF · DKIM · DMARC configured2-step verification

Challenge · Solution · Outcome

Challenge: Teams on free webmail or ageing mail hosting, with no shared calendars or storage and poor deliverability.
Solution: Domain verification, MX and authentication records, organisational units, groups and shared drives, enforced 2-step verification, and staged mailbox migration.
Outcome: Professional mail and collaboration live on the client's domain, with security defaults switched on from day one.

Consultant setting up services on a laptop

Domains · DNS

Domains & DNS with Namecheap

Registration, DNS records, transfers and renewals handled properly — so email and websites keep working.

DNS records verifiedRegistrar lock & renewals

Challenge · Solution · Outcome

Challenge: Domains spread across accounts, records that nobody understands, and renewals that lapse.
Solution: Consolidated registrar accounts, clean DNS (web, mail, verification records), registrar lock and renewal tracking — plus nameserver moves and DNSSEC where appropriate.
Outcome: One documented source of truth for every domain, and far fewer "why is email down?" surprises.

Web design

technetguy.site

A TECHNET web-design project — the visual language that shaped this site.

Visit technetguy.site ↗

Anatomy of a backup chain

Copies that can't be deleted by whoever got in.

Each system holds only the credentials for its own repository, and cannot delete or rewrite history. A scheduled check flags any repository not refreshed in 36 hours.

Have a project in mind?

Bring us the messy, cross-discipline problem. That's where we're most useful.

Start a conversation