M2: content collections — case studies, blog, RSS, tags, sitemap

Projects + blog as schema-validated content collections; structured case studies (problem/design/outcome), blog with tag pages, reading time, RSS feed (drafts excluded), sitemap, and Shiki dual-theme code highlighting.
2026-06-17 16:56:46 +10:00
parent 720d579386
commit 22f482d89a
26 changed files with 1139 additions and 105 deletions
@@ -0,0 +1,49 @@
+---
+title: "Global Infrastructure Modernisation"
+outcome: "Modernised enterprise infrastructure at scale — ~1,000 VMs, segmented networks, multi-region cloud migration."
+summary: "Across global IT roles: a ~1,000-VM VMware estate, flat-to-segmented network redesign with SD-WAN and Aruba ClearPass, firewall upgrades, and migration to Azure and Microsoft 365."
+role: "Infrastructure Engineer · Virtus Health / Linde"
+period: "2019 – 2025"
+stack: ["VMware", "Azure", "SD-WAN", "Aruba ClearPass", "FortiGate", "Microsoft 365"]
+featured: false
+order: 40
+---
+
+## Problem
+
+Enterprise estates accrete. Flat networks, sprawling VM counts, aging firewalls, and
+on-prem-only services become a security and operations drag. The work: modernise without
+breaking a global business that runs 24/7.
+
+## Constraints
+
+- **Keep the lights on** — change a live, multi-region estate without downtime.
+- **Security and compliance** — segmentation, patching, and auditability throughout.
+- **Cost-aware** — modernise to cloud where it pays, not for its own sake.
+
+## Design
+
+Across global roles I ran and improved a **~1,000-VM VMware estate** and re-segmented **flat
+sites into isolated VLAN ranges**, layering in **SD-WAN** and **Aruba ClearPass** onboarding
+for a tiered, authenticated network. **Palo Alto / FortiGate** firewalls were upgraded and
+redesigned around the new segmentation. Workloads and identity moved to **Azure** (Blob, AVS)
+and **Microsoft 365** — including an ERP hardware refresh with a new DR solution, and a
+region-wide PBX-to-VoIP migration.
+
+## Security & reliability decisions
+
+- **Flat → segmented** — isolation by design, not by exception.
+- **Authenticated access** (ClearPass, 802.1x) — the network knows who's on it.
+- **Patched, current firewalls** — closing the easy doors first.
+- **DR built in** — recovery designed, not assumed.
+
+## Outcome
+
+A more secure, segmented, cloud-leaning estate that's cheaper to run and easier to operate —
+delivered against live-business constraints across multiple regions.
+
+## Future improvements
+
+The throughline from this work to the edge platforms: take the same segmentation and
+identity rigour and express it as code, so a thousand-VM estate and a single edge node are
+governed the same way.