Projects4▸
project
The Living Portfolio
Why this site exists, what it is for, and how it is designed, built and deployed, shown live as a demonstration of how I work.
project
The NetState Lab Network in progress
A firewall between a LAN and a DMZ, on one PC. Five phases: see what crosses the wire, a legacy port knock, fix the leaks, modern remote access, traffic shaping.
project
agent-lab in progress
Local AI models running on my own hardware inside The NetState Lab Network, with a first agent that watches the network read-only and reports what it sees.
project
agent-workflow in progress
A junior admin team of local AI agents, each with one job, that finds problems, explains them and routes them to the right person. The agents change nothing; a person decides every action.
Stories19▸
A full teardown to swap one part
A field repair that went deep: a full teardown to reach and swap a single failed part.
A site-to-site VPN, tested offline before it went live
Connected two sites with an IPsec tunnel on a Cisco router, built and tested offline before it went live.
A zero-downtime server refresh
New ESXi host, RAID 10, fresh VMs, domain-controller cutover by promote/demote, backups test-restored before anything old was retired.
Automating student account provisioning
Scripting student account creation so running the network didn't eat the time I needed for teaching.
Azure foundations for Dynamics 365 migrations
The Azure infrastructure behind Dynamics 365 migrations at Thinkmax, a fresh foundation built per client.
Dropped calls, found in the firewall logs
The network side of a municipal VoIP rollout: a dedicated voice VLAN, WatchGuard rules, and a fault found in the logs.
Four hours down, one bad cable
Racks built and rebuilt to a method, cables cut to length, tagged, and documented, so any fault traces end to end.
Getting signal into a metal building
Got network signal into a metal concrete-plant building where running cable wasn't an option, with a wireless bridge.
Hiding my services behind a port knock planned
How I took RDP and SSH off the internet and hid them behind a knock of invalid TCP flags, and used it as my real remote access.
In-house reporting instead of $300-an-hour consulting
Made the case to build the Controller's reporting in-house with PHP and SQL instead of paying $300 an hour.
Keeping the streaming, fixing the network
Hunted a mystery slowdown to streaming eating the bandwidth, then fixed it with QoS instead of more pipe.
Proving WEP wasn't protecting us
Rather than just flag it, I proved our WEP wireless was crackable to make the case for replacing it.
Ransomware, first thing in the morning
A newly onboarded client, a call at 8 a.m. that the files were encrypted. Contained, traced, recovered from the night-before backup, then I closed the holes that let it in.
Running Sage without handing out admin
An app that demanded local admin, students who couldn't have it. I monitored exactly what it needed and granted only that by Group Policy.
Teaching networking by building it
A three-lab progression I built on my own evenings so students learned networking by building it.
The escalation point for Windows XP
The Level 3 R&D escalation desk for Windows XP on a Microsoft contract, the end of the line for the hard cases.
Turning config tracking into handover documentation
Turning the configuration log I kept through each migration into clean client handover documentation.
When an expired certificate took the VPN down
A site-to-site VPN dropped with nothing misconfigured; the certificate behind it had quietly expired.
Working with the site's IT, not passing the puck
When a Xerox fault turns out to be the network, out of scope, I work with the site's IT instead of passing the puck.
Documents7▸
documents
agent-lab: setup and guardrails planned
How the local models are set up in the lab, what the monitor is allowed to see, and how its read-only access is enforced and logged.
documents
agent-workflow: roles, approvals and orchestration planned
What each agent is allowed to see and do, how work passes between them, how approval works for any change, how every step is logged, and what the agents must never touch.
documents
Backup & recovery plan
A ransomware-ready backup and recovery plan for a single work and lab host, built entirely on free tools, with a side-by-side of what changes in a production environment.
documents
Domain, Azure & email setup planned
How netstatedata.ca is set up end to end: the M365 tenant, DNS, email, and the hybrid cloud and local domain.
documents
Passwordless logins for a kindergarten class
A teacher logging a class of twenty-one five-year-olds in by hand, every session. I worked it end to end and wrote it up: policy first, then identity, devices, and the people, a proposal they could act on.
documents
The NetState Lab Network: design and runbook planned
The lab's topology, firewall policy, knock design and how to run every exercise, with the elevated permissions it needs and why.
documents
The Site Development Process
How a change to this site goes from an idea to production: the local loop, drafts, version control, the build check, versioned releases, rollback, and the guardrails around a public repository.
Scripts2▸
scripts
PowerShell Claude API toolkit
Call the Claude API from PowerShell with the key kept in KeePass, never on disk or on the command line.
scripts
The NetState Lab Network: routing check
Five pass/fail checks that prove traffic between the LAN and the DMZ crosses the firewall, and only the firewall.
Containers2▸
containers
The NetState Lab Network (Docker Compose) planned
The whole lab in one Compose file: the network (a firewall, two clients and a server) by default, and the AI agents from agent-lab and agent-workflow when you ask for them.
containers
This site itself (Hugo + Azure)
The site you're reading, packaged to run in any web server: a Hugo build served by nginx in a container. Open source, build it and run it yourself.