7–8 CAMPUSES SD-WAN · PROXMOX VE CLUSTER · 5-LAYER DMZ · 100 TB WORKSPACE

Enterprise Multi-Campus SD-WAN, Proxmox Cloud & Security Architecture

Unifying 7–8 campuses across multiple cities in Moldova via MikroTik WireGuard SD-WAN, replacing heavy legacy monitoring/helpdesk stacks with ultra-fast Python/SQLite WAL daemons, and governing a 100 TB Google Workspace ecosystem.

978ms → 23.6ms

Helpdesk TTFB Speedup (41x)

199ms → 13.3ms

HR & IAM Portal TTFB (15x)

~12 MB RAM

SQLite 3 WAL Total Footprint

~7 ms RTT

Inter-City WireGuard SD-WAN Latency

// PROXMOX VE CONSOLIDATION (CT 100 – CT 106)

On-Premise Proxmox VE Virtualization Core & LXC Topology

CT 100

MeshCentral RMM

Remote fleet management (RMM) for 31 Smartboards & 48+ lab PCs across 7 campuses

Node.js · WebSockets · Agent RMM

CT 103

Helpdesk Mini v2.2 + Live NOC v3.0 + Ansible

Custom Zero-IOPS Python + SQLite WAL engines replacing GLPI/Zabbix (~12 MB RAM, 23.6 ms TTFB — 41x faster) + Ansible DR vault

Python 3 · SQLite WAL · Ansible · 12 MB RAM

CT 104

Nginx WAF + Proxy Cache + FreeRADIUS 802.1X

SSL termination, custom WAF (5 req/s rate limit, 444 exploit drop), micro-caching & FreeRADIUS 802.1X Wi-Fi auth

Nginx · WAF · FreeRADIUS · Fail2Ban

CT 105

1C:Enterprise 8.3.25 Cluster + Postgres Pro 1C 16

64-bit 1C:Enterprise 8.3 application server cluster + Postgres Pro 1C v16 for retail & accounting ERP

Ubuntu LTS · 1C 8.3.25 · Postgres Pro 16

CT 106

EduStaff HR, Digital CV & Google Workspace IAM

HR & Google Workspace IAM platform for 619 accounts & 239 faculty profiles (~27 MB RAM, 13.3 ms TTFB — 15x faster)

Next.js 14 · SQLite/JSON · Google OAuth 2.0

// 5-LAYER LOGICAL DMZ & IMMUTABLE DISASTER RECOVERY

5-Layer Defense-in-Depth DMZ & Root-Immutable Backups (chattr +i)

Layer 1

MikroTik Core DMZ-ISOLATION

Hardware router firewall rules block any lateral movement from public-facing DMZ containers into internal campus LANs or AD/1C servers.

Layer 2

Proxmox Host iptables Shield (dmz-shield.service)

Hypervisor-level systemd iptables unit enforces strict L2/L3 isolation between LXC containers on the bridge.

Layer 3

Nginx WAF & Micro-Cache (CT 104)

Enforces 5 req/s login rate limiting, instant HTTP 444 connection drop on .env/.git/wp-admin probes, and edge proxy caching.

Layer 4

Fail2Ban IDS + Zero-Noise Telegram NOC

Automated IP banning on brute-force attempts with strict 3-Strike Anti-Flap alerting to the executive Telegram NOC channel.

Layer 5

Immutable Nightly Backups (chattr +i) & Ansible DR

At 02:00 AM Ansible pulls .backup/.rsc configs from all 6 branch MikroTiks; at 03:15 AM SQL dumps are locked with Linux chattr +i (undeletable even by root).

MikroTik RouterOS v7 & WireGuard SD-WAN

Core Hub & Branches: MikroTik CRS418-8P-8G-2S+ (10G SFP+ uplinks) core router paired with RB4011/RB3011 nodes across 7 campuses.
CAPsMAN Wi-Fi 6 & FreeRADIUS 802.1X: 65+ access points with seamless roaming and Active Directory LDAPS (:636) authentication.
Strict VLAN Segmentation: Isolated VLANs for Administration, Accounting (1C), Informatics Labs, IP CCTV, and Guest Wi-Fi.

100 TB Google Workspace & Cloud Hybrid

100 TB Pooled Storage & OU Governance: Centralized GAM/Admin SDK quota enforcement across 619 staff and thousands of student accounts.
Zero-Space Auto-Purge Architecture: Helpdesk ticket attachments are automatically purged from disk upon resolution while preserving permanent branch KPI metrics.
Multi-Cloud Deployment: Google Cloud Run (LuminaMath), Railway/Neon (GM-App), Caddy Wildcard S3/MinIO (OmniCheck), and On-Premise Proxmox VE.