Services
Each service states its scope and its boundaries. Knowing both up front is what makes a project go well.
Network infrastructure
Routing, switching and wireless for offices that have outgrown a consumer router — designed, installed, configured and documented.
Most office networks fail in the same way: a consumer router doing a job it was never built for, a flat network where every device can reach every other, and no record of how any of it was set up. When something breaks, nobody knows what the original configuration was.
The work starts with a written plan — the addressing scheme, the VLAN boundaries, which traffic is allowed to cross between them, and where the access points go and why. That document is agreed before hardware is ordered, which means the equipment list matches the design rather than the other way round.
Configuration is done to a standard, not ad hoc: management interfaces restricted to one administrative range, unused services disabled, default credentials gone before the device carries traffic. Loop protection is enabled on the access layer, because an office will eventually plug a patch cable into two wall ports.
At handover you receive the topology diagram, the addressing plan, the port map and an exported configuration backup for every device. These are what let another engineer take the network over without reverse-engineering it.
Included
- Site survey and a written addressing and VLAN plan before any hardware is ordered
- MikroTik routing and firewall configuration, or TP-Link Omada where a controller suits the site better
- Managed switching, VLAN segmentation, PoE planning and loop protection
- Wireless design with channel and power planning, not default settings
- Structured cabling supervision, labelling and a port map
- Topology diagram, addressing plan and configuration backup at handover
Not included
- Civil works — conduit, trunking and wall penetrations are the building's contractor
- Internet circuits — the ISP contract stays between you and the ISP
- Ongoing monitoring unless a support agreement is signed separately
Servers and storage
File, application and virtualisation servers with storage that is actually recoverable — specified, built, tested and documented.
A server is only as good as the day you need to restore from it. Plenty of offices have a backup job that has run green for two years and has never once been restored — which is a backup nobody has tested, not a backup.
Sizing happens before purchase. What the office actually runs decides the specification: concurrent users, the size of the working data set, whether anything needs virtualising. An oversized server is wasted budget; an undersized one is a replacement in eighteen months.
Storage is built on ZFS, with redundancy appropriate to the data, scheduled scrubs so silent corruption surfaces while it can still be fixed, and snapshots so a file deleted on Tuesday can come back on Wednesday without touching the backups at all.
For the workgroup offices common in Myanmar — no domain controller, no Active Directory — file sharing and permissions are set up to be manageable by someone who is not a sysadmin. That constraint shapes the design rather than being worked around.
Before handover, the backup is restored. Not inspected, not verified in the console — actually restored, so the recovery procedure is one you have seen work.
Included
- Workload sizing before purchase — CPU, memory and disk matched to what the office actually runs
- Server build and operating system installation, physical or virtualised
- ZFS storage with redundancy, snapshots and scheduled integrity checks
- File sharing and permissions for workgroup offices without Active Directory
- A backup scheme that is tested by restoring from it, not only by running it
- UPS sizing and safe shutdown configuration
Not included
- Licensing costs for proprietary operating systems or applications
- Off-site backup capacity — the storage or cloud subscription is billed to you directly
- Application support for third-party software running on the server
Security hardening
Closing the things an attacker looks for first — exposed management, default credentials, flat networks — and proving they stay closed.
Most small-office compromises do not involve anything sophisticated. They involve a router with its management page reachable from the internet, a default password that was never changed, and a flat network where reaching one machine means reaching all of them.
The review works through a written checklist rather than impressions: is telnet or FTP enabled, is the web management interface exposed, is there a SOCKS proxy nobody enabled deliberately, does DNS answer queries from outside, are there accounts with empty or default passwords, is administrative access restricted to a known address range.
Segmentation follows. Guest wireless should not be able to see the file server. Printers and cameras should not sit on the same network as workstations. These are boundaries that cost nothing at install time and are expensive to retrofit.
Remote access goes through a VPN. Forwarding a port to an internal machine so somebody can work from home is the single most common way an office network ends up exposed.
The output is a written report: what was found, how serious each item is, what was fixed during the engagement and what remains with a recommended order. Items that need your decision — because they affect how people work — are listed as decisions, not as failures.
Included
- Configuration review of routers, switches and access points against a written checklist
- Management access restricted by address, with remote administration services disabled
- Network segmentation so guest, staff and infrastructure traffic cannot reach each other
- Firewall rule review — removing rules nobody can explain
- Endpoint protection deployment and verification across workstations
- Remote access via VPN rather than ports forwarded to internal machines
- A written findings report with each item rated and a remediation order
Not included
- Penetration testing or red-team engagements against third-party systems
- Compliance certification — the work supports an audit, it does not issue one
- Incident response retainer unless agreed separately
- Any testing without written authorisation from the system owner
IT support and automation
Day-to-day support for small offices, and the automation that stops the same request arriving every week.
Support is mostly the same handful of problems. The useful work is not answering them faster — it is removing the conditions that produce them.
A standardised workstation build means a replacement machine is ready in an hour rather than a day. A monitored backup that reports to a channel someone actually reads means a failure is noticed on the day it happens rather than the day it matters. A health check that runs itself and only speaks up when something is wrong means nobody has to remember to look.
Automation here is deliberately plain. Alerts arrive on Telegram, because an office will read Telegram and will not log into a dashboard. Scripts are written to be readable by whoever inherits them, with their assumptions stated at the top. Nothing depends on a service that will quietly stop working when a free tier changes.
Where a task genuinely has to stay manual, the walkthrough is written down and handed to the person who will do it — not demonstrated once and forgotten.
Included
- Workstation setup, imaging and standardisation across an office
- Troubleshooting for network, server, printing and shared-file problems
- Scripted and automated routine tasks — backups, reporting, health checks, alerting
- Telegram-based alerting and support workflows where a dashboard would go unread
- Staff walkthroughs for anything they will have to do themselves
- An asset and licence register kept current
Not included
- 24/7 on-call unless a support agreement specifies it
- Hardware repair below component level — a failed board is replaced, not rebuilt
- Recovery of data from physically damaged media
- Software the office installed without telling anyone, until it is inventoried
Want to talk through a job?
A new office, an existing network that needs rethinking, or not knowing where to start — a conversation is the right first step.