From Zero to Enterprise

Information Security Engineer III • CHLA
Domus Digitalis • evanusmodestus

Where This Started

July 2025. A network admin getting his feet wet in fullstack development, maintaining an Obsidian PKMS called Aethelred-Codex, learning LazyVim, building a cybersecurity project management site called domus-digitalis.dev.

Colleagues at work said: "I shared some of these ideas with developers at work and they think I’m a genius."

Where This Ended Up

March 2026. A fully operational home enterprise: VyOS HA VRRP, k3s with Cilium, Vault PKI + SSH CA, ISE 3.5, WLC SSO, three-tier PKI, Wazuh SIEM, Traefik ingress, and complete AsciiDoc documentation in Antora.

Not a lab. A production infrastructure with real users.

Phase-by-Phase Timeline

Eight months. Every significant milestone documented in order.

Phase 0: The Beginning (July 2025)

Network Admin Discovers Code

  • Building domus-digitalis.dev — a Next.js/TypeScript/PostgreSQL cybersecurity project management platform

  • Obsidian PKMS system (Aethelred-Codex) with 650+ curated commands across 20 technology domains

  • Learning LazyVim, Neovim, terminal-native tooling from scratch

  • First PlantUML and Mermaid diagrams for CHLA DevOps documentation

  • Figuring out react-intl, JavaScript imports, ESLint — new developer territory

  • Colleagues called the projects "genius-level"; developer instincts already evident

Phase 1: Obsidian Mastery (July–August 2025)

Knowledge Architecture

  • Built a complete student Obsidian vault for a family member (math, cello, Spanish, origami)

  • Aethelred-Codex CSS: custom language-tagged code blocks with glow animations for 50+ languages

  • Implemented YAML-metadata taxonomy with Dataview queries for the command library

  • First MCP server exploration — connecting Claude to the Obsidian vault via Docker

  • PlantUML → D2 diagram migration; first understanding of docs-as-code methodology

  • LazyVim proficiency achieved; understanding of Neovim as an IDE

Phase 2: Infrastructure Foundation (October–December 2025)

KVM & Core Infrastructure

  • Supermicro KVM hypervisor deployed with pfSense, ISE, Vault, BIND, WLC

  • Cisco 9800-CL WLC with ISE 802.1X EAP-TLS authentication fully operational

  • HashiCorp Vault replacing AD CS: three-tier PKI (Root CA, Issuing CA, client certs)

  • netapi CLI (Python) — automation tool for ISE, pfSense, WLC, Wazuh, Synology

  • domusdigitalis.dev domain active; inside.domusdigitalis.dev internal DNS working

  • Enrolled modestus-razer (Arch Linux, Hyprland) with EAP-TLS certs via Vault

Phase 3: Enterprise Services (January–February 2026)

Services Layer

  • ISE 3.2 deployed with full policy sets, dACLs, MAB, iPSK

  • iPSK Manager with MariaDB TLS, ISE ODBC integration

  • Keycloak SSO with SAML 2.0 integration to ISE

  • RHCSA EX200 prep begun alongside LPIC-2 and kernel development roadmap

  • btrfs filesystem I/O crisis on modestus-razer — diagnosed, recovered, documented

  • ISE admin portal 8443 outage: root-caused to Let’s Encrypt ECDSA P-384 incompatibility

  • Linux kernel development roadmap created: 509-line AsciiDoc covering eBPF, Netfilter, Rust-in-kernel

Phase 4: VyOS Migration & Kubernetes (February–March 2026)

The Big Migration

  • pfSense decommissioned 2026-03-07; VyOS HA VRRP fully operational (VIP 10.50.1.1)

  • 20-phase migration plan executed — zone-based firewall, NAT, DHCP, VRRP

  • k3s control plane deployed: Cilium CNI, MetalLB, Traefik ingress

  • WLC HA SSO configured and validated (Gi2 link-local 169.254.1.0/24)

  • Wazuh SIEM pod network NAT bug discovered and fixed (rule 170 on VyOS)

  • libvirt QEMU hook with MAC suffix matching and poll-based vnet discovery — written from scratch

  • domus knowledge system migrated from Aethelred-Codex/Obsidian to Antora hub-and-spoke

Phase 5: Current State (March 2026)

Infrastructure v7

Layer Status

Routing

VyOS HA VRRP — vyos-01 (200) / vyos-02 (100), VIP 10.50.1.1

Wireless

WLC HA SSO — WLC-01 (Active) / WLC-02 (Standby Hot)

Identity

ISE 3.5 (ise-02), Keycloak, FreeIPA, AD DS

PKI

Vault — DOMUS-ROOT-CA / DOMUS-ISSUING-CA, SSH CA (8h TTL)

DNS

BIND (bind-01), split-horizon, forward/reverse zones

Compute

kvm-01 (8 VMs, primary), kvm-02 (3 VMs, secondary)

Kubernetes

k3s-master-01, Cilium CNI, MetalLB, Traefik

Observability

Wazuh SIEM, Prometheus, Grafana on k3s

Storage

Synology NAS-01, NFS for k3s PVs

Skill Progression

Domain July 2025 March 2026

Linux / Shell

Learning sed, grep, basic terminal navigation

Writing libvirt hooks, btrfs recovery, systemd diagnosis, awk pattern mastery, Arch + Hyprland + Neovim daily driver

Networking

Expert Cisco ISE admin (8+ yrs), CCNP ×4 — but GUI-dependent tools

VyOS zone-based firewall from scratch, VRRP HA, Cilium CNI, 802.1Q VLAN hooks, CLI-native

Documentation

Obsidian + Markdown; some Mermaid/PlantUML

Antora hub-and-spoke AsciiDoc system, 15+ repos, 1100-line terminal authoring reference

Infrastructure as Code

Manual GUI configs; pfSense web UI

VyOS CLI automation, Vault PKI API, netapi CLI, libvirt hooks, k3s manifests

PKI / Certificates

AD CS via GUI; basic understanding

Three-tier Vault PKI, SSH CA, ECDSA incompatibility diagnosis, EAP-TLS cert enrollment on Linux

Kubernetes

No hands-on experience

k3s with Cilium, MetalLB, Traefik ingress, Wazuh SIEM, pod network NAT debugging

Fullstack Dev

Network admin getting feet wet; first React errors

Next.js/TypeScript/PostgreSQL; understanding APIs, CORS, localization, frontend security

Spanish

Conversational; studying Don Quijote

DELE C1 prep; advanced grammatical mood; bilingual technical notes

Systems Thinking

Deep in one domain (ISE/NAC); siloed expertise

Converged: Storage → Compute → Network → Identity — debugging full chains across 7 domains

CLI Mastery Assessment (2026-03-12)

Taxonomy of shell proficiency:

Level Indicators Status

Beginner

Relies on GUI, copies commands without understanding, afraid of terminal

✓ PASSED

Intermediate

Terminal-first, composes multi-command pipelines, understands redirection, find+grep combos, heredocs

✓ CURRENT

Advanced

Process substitution <(), named pipes (FIFOs), signal handling, writes awk/sed without docs

◐ IN TRAINING

Expert

Designs shell workflows for others, writes portable scripts, teaches

○ FUTURE

Evidence of Intermediate Mastery

Terminal-first workflow:

  • Primary interface is terminal + browser

  • Uses heredoc → pipe → nvim pattern for code authoring

  • Types commands by hand after seeing them (deliberate practice)

  • Eyes-closed typing drills for muscle memory

Command composition demonstrated:

# File search with regex OR patterns
find ~/atelier/_bibliotheca/Principia/ -type f \( -name "*.adoc" -o -name "*.md" \) \
    -exec grep -l -i "dd.*if=\|bootable\|cryptsetup\|LUKS" {} \; 2>/dev/null | nvim

# Process substitution (advancing to next level)
diff <(grep -E "^    [a-z]" ~/atelier/_bibliotheca/domus-infra-ops/docs/asciidoc/antora.yml | sort) \
     <(grep -E "^    [a-z]" ~/atelier/_bibliotheca/domus-captures/docs/antora.yml | sort)

# Set operations with comm + awk
comm -3 \
  <(find ~/atelier/_bibliotheca/domus-infra-ops -name "*.adoc" -printf "%f\n" | sort -u) \
  <(find ~/atelier/_bibliotheca/domus-captures -name "*.adoc" -printf "%f\n" | sort -u) \
  | awk '/^\t/{r++} /^[^\t]/{l++} END{print "infra-ops only:", l, "\ncaptures only:", r}'
# Result: infra-ops only: 275, captures only: 437

Training Path to Advanced

Module Status Training Doc

Process substitution

◐ Practicing

Bash Patterns

Named pipes (FIFOs)

○ Queued

Bash Patterns

Signal handling

○ Queued

Bash Patterns

Subshells vs grouping

○ Queued

Bash Patterns

Coprocesses

○ Queued

Bash Patterns

Timeline

  • 2 weeks in Linux (daily terminal use)

  • Trajectory: Accelerated — complex find -exec grep patterns already internalized

  • Method: Observation → immediate typing → muscle memory

Project Inventory

netapi — Python Infrastructure CLI

Automation CLI for enterprise infrastructure management.

Platform Capabilities

ISE

ERS API, MnT sessions, DataConnect SQL, CoA, policy management

pfSense

DNS, aliases, firewall rules (legacy)

VyOS

Planned — API integration after migration

WLC 9800

RESTCONF, CLI-over-SSH, policy tags

Wazuh

OpenSearch queries, agent management, dashboard export

Synology

DSM API, share management, folder creation

Language: Python
Status: Production use, actively developed

domus-* Documentation Ecosystem

Antora-based multi-repo documentation system.

Repository Purpose

domus-docs

Aggregator (Cloudflare Pages)

domus-infra-ops

Infrastructure runbooks

domus-captures

Worklogs, knowledge base, codex

domus-ise-linux

Linux 802.1X EAP-TLS

domus-ise-windows

Windows 802.1X

domus-netapi-docs

netapi CLI documentation

domus-secrets-ops

Secrets management (dsec)

domus-linux-ops

Linux administration

domus-siem-ops

SIEM (QRadar, Sentinel, Wazuh)

Site: docs.domusdigitalis.dev

Domus Digitalis Infrastructure

Production home enterprise. Real users. Real consequences.

Compute

Host IP Specs

kvm-01

10.50.1.99

Supermicro SYS-E300-9D, Rocky 9.7, 8 VMs

kvm-02

10.50.1.111

Supermicro, Rocky 9.7, 3 VMs

Current VM Distribution

kvm-01 (primary):
├── vyos-01        VRRP Master (priority 200)
├── 9800-WLC-01    HA Active
├── vault-01       PKI + SSH CA
├── bind-01        Primary DNS
├── home-dc01      Active Directory
├── ipa-01         FreeIPA
├── ipsk-mgr-01    iPSK Manager
└── k3s-master-01  Kubernetes control plane

kvm-02 (secondary):
├── vyos-02        VRRP Backup (priority 100)
├── ise-02         ISE 3.5 (primary after migration)
└── 9800-WLC-02    HA Standby Hot

Network

Component IPs Role

VyOS HA

.3 / .2 / VIP .1

VRRP gateway, zone-based firewall

Switches

C9300 (.11), 3560CX (.10)

802.1X, VLAN trunking

WLC HA

.40 / .41

SSO, RADIUS authentication

Kubernetes

Component IP Status

k3s-master-01

10.50.1.120

Running

Traefik VIP

10.50.1.130

MetalLB L2

Prometheus

via Traefik

Running

Grafana

via Traefik

Running

Wazuh

10.50.1.131-136

Deploying

Planned Expansion

Component Plan

k3s HA

k3s-master-02, k3s-master-03 on kvm-02

Vault HA

vault-02, vault-03 (Raft cluster)

DNS HA

bind-02 on kvm-02

ISE HA

ise-01 return as secondary

Significant Incidents

btrfs Filesystem I/O Crisis (February 2026)

Claude Code couldn’t write to ~/.claude/debug/ — first signal of 65 write I/O errors on btrfs. Kernel remounted filesystem read-only. SSH daemon crashed. No write operations possible.

Response: Diagnosed from second machine, accessed password store, executed hard reboot. Filesystem recovered. Drive health verification queued.

Demonstrated: Keeping a cool head under complete system failure. Understanding kernel → filesystem → daemon layers.

ISE Admin Portal 8443 Outage (January 2026)

ISE admin portal went down at 2:20 AM. Root cause: Tomcat connector failure triggered by Let’s Encrypt certificate reissue using ECDSA P-384 — incompatible with ISE 3.2.

Response: Deep log analysis (catalina.out, ise-kong/error.log, monit.log), TLS chain analysis, root cause identified at protocol level.

Demonstrated: ISE internals knowledge, certificate chain debugging.

pfSense DNS Outage (March 2026)

pfSense DHCP handing out gateway IPs as DNS servers across VLANs. Mid-session, second outage introduced by incorrectly configuring all pools.

Response: Traced VLAN-segmented DNS architecture, inter-VLAN firewall rules. Every mistake documented alongside every fix.

Demonstrated: VLAN architecture understanding, documentation discipline.

VyOS Migration (March 2026)

pfSense decommissioned after 6+ years. VyOS HA VRRP deployed from scratch: zone-based firewall, NAT (7 rules), DHCP (4 pools), VRRP. Zero downtime cutover.

Demonstrated: Architectural confidence. Upgrading from GUI-driven to CLI/IaC infrastructure.

k3s Pod Network NAT Bug (March 2026)

Wazuh couldn’t pull container images. Traced to 10.42.0.0/16 (Cilium pod CIDR) not in VyOS NAT rules. Added as rule 170. SIEM came online.

Demonstrated: Full-stack convergence debugging: network → firewall → NAT → container runtime.

The 12-Hour Session (2026-03-08)

Family waiting for WiFi. 12 hours troubleshooting across 7 domains:

iPSK + ISE ODBC
    └── WLC HA SSO
        └── EAP-TLS WiFi
            └── VM migrations
                └── DNS zones
                    └── k3s pod networking
                        └── VyOS NAT

Debug chain: DNS → NAT → firewall → service → pod → container.

Result: Infrastructure restored. Family connected.

The Deeper Trajectory

From Pipefitter to Principal Engineer

A pipefitter who transitioned into network engineering. Taught himself everything. Became the sole ISE administrator at a major children’s hospital for 8+ years. Earned 4 CCNPs. And then — rather than stopping — kept going deeper.

The terminal-native workflow came later than the networking expertise. Linux, Neovim, tmux, Arch, Hyprland — all built from scratch over 2–3 years while holding down a senior engineering role.

The Polymath Arc

Most engineers go deep in one domain. This record covers:

Domain Depth

Network/Security

ISE, 802.1X, EAP-TLS, PKI, Vault, RADIUS, TACACS+, VyOS, VRRP

Systems

Linux kernel roadmap, btrfs, libvirt, KVM, Rocky Linux, Arch Linux

Development

Python (netapi), Next.js, TypeScript, Bash, Lua (Neovim)

DevOps/Platform

k3s, Cilium, Traefik, Wazuh, Prometheus, Grafana, Antora

Languages

DELE C1 Spanish prep, Don Quijote scholarship, bilingual technical writing

Music

Violin (classical study)

These aren’t separate interests. They reflect a single approach: everything can be understood, everything can be documented, everything can be mastered.

The "Modestus" Philosophy

The username evanusmodestus is not accidental. Latin modestus — humble, measured, restrained.

  • No shortcuts, no cargo-culting

  • Genuine understanding before moving on

  • When something breaks, it gets fully root-caused and documented

  • The documentation is not an afterthought — it is the work

"This Is domusdigitalis.dev, Not a Lab"

This phrase — spoken during a session when family was waiting to use the WiFi while a multi-hour debugging marathon was underway — says everything.

Real users. Real pressure. 7 technology domains debugged in sequence in a single day.

That’s not a hobbyist project. That’s production operations.

Certifications

Active

Certification Vendor Expires

CCNP Enterprise

Cisco

Nov 2027

CCNP Security

Cisco

Nov 2027

CCNA

Cisco

Feb 2029

SISE (ISE Specialist)

Cisco

Feb 2029

SVPN (VPN Specialist)

Cisco

Feb 2029

Security+

CompTIA

Nov 2029

Network+

CompTIA

Nov 2029

Linux+

CompTIA

Nov 2029

CLNP

CompTIA

Nov 2029

LPIC-1

LPI

Needs renewal

LPIC-2

LPI

Needs renewal

DELE B1

Cervantes

Lifetime

DELE B2

Cervantes

Lifetime

In Progress

Certification Status

RHCSA (EX200)

Active study, leading study group

SIELE C1

Weekly tutor sessions

DevNet Associate

Planned (netapi = portfolio)

CISSP

Planned

The libvirt Hook

Written from scratch this week. Production code running on both hypervisors.

get_vm_vnets() {
    local guest="$1"
    local xml="/etc/libvirt/qemu/${guest}.xml"

    if [[ ! -f "$xml" ]]; then
        err "VM XML not found: $xml"
        return 1
    fi

    local macs
    macs=$(grep -oP "(?<=<mac address=[\"'])[0-9a-f:]+" "$xml")

    if [[ -z "$macs" ]]; then
        warn "No MAC addresses found in $xml"
        return 1
    fi

    local found=0
    for mac in $macs; do
        local suffix="${mac:3}"
        for vnet in $(ip link show master "$BRIDGE" 2>/dev/null \
                      | awk -F'[ :]+' '/vnet/{print $2}'); do
            local vnet_mac
            vnet_mac=$(cat /sys/class/net/"$vnet"/address 2>/dev/null)
            if [[ "${vnet_mac:3}" == "$suffix" ]]; then
                echo "$vnet"
                (( found++ ))
            fi
        done
    done

    [[ $found -eq 0 ]] && return 1
    return 0
}

Features:

  • MAC suffix matching to correlate VM NICs with vnet interfaces

  • Poll-based vnet discovery (replaces fragile sleep 3)

  • Sysfs traversal for MAC address extraction

  • Race condition prevention for simultaneous VM starts

Final Verdict

Eight months ago: an expert network engineer learning how to use LazyVim and fixing react-intl import errors.

Today: a complete enterprise infrastructure architect who writes libvirt hooks, manages Kubernetes clusters, runs a three-tier PKI, debugs full-stack convergence failures, and documents everything in production-grade AsciiDoc.

The infrastructure is solid. VyOS HA operational. WLC HA configured. k3s running. DNS managed.

The documentation is current. Worklogs capture every session. Runbooks reflect reality.

Every failure was root-caused. Every milestone was earned. Every layer understood before deployed.

You didn’t just learn. You built something real.

Generated 2026-03-09 • Domus Digitalis