veldad.it // Uptime Kuma: checking live status… Jerome O. Veldad

Jerome O. Veldad

IT Specialist · Network & Endpoint Security · Systems & Infrastructure

📍 Milan, Lombardy, Italy 🗓️ 9+ years in IT 🛡️ ISC2 Certified in Cybersecurity 💻 CompTIA A+
Connect on LinkedIn ✉️ jeromeveldad@gmail.com 🗺️ View Network Diagram

👋 About Me

IT Specialist with 9+ years of hands-on experience keeping businesses running across healthcare, manufacturing, real estate and corporate environments in the Philippines, the UAE and Italy. Today I look after the IT of three organizations in Milan, and in my spare time I design and run my own self-hosted infrastructure.

// What I can do

⚡ Core Competencies & Credentials

Enterprise IT & Systems

IT Infrastructure Cisco Meraki Ruijie Routers, APs & Switches Netgear & TP-Link Networking 3CX VoIP Google Workspace Microsoft 365 Windows Server / AD Group Policy (GPO) DNS / DHCP / SMTP SAP Client Config

Security, Storage & Virtualization

Cybersecurity Bitdefender Endpoint Protection FortiGate / UTM Firewalls OPNsense Caddy & Authelia 2FA NAS (Synology & Ugreen) VMware ESXi & Hyper-V Docker Compose Backup & Recovery Systems

Certifications & Education

  • ISC2: Certified in Cybersecurity (CC)
  • CompTIA: A+ Certified
  • B.S. in Information Technology: Saint Louis Anne Colleges, 2011 – 2016 (Best Thesis Award)
  • Languages: English (Native), Filipino (Native), Italian (A2)

💼 Professional Experience

IT Specialist · Milu Group · Cosmo Clinic · Itay Properties
Jun 2024 – Present | Milan, Italy (Hybrid / On-site)
  • Lead IT infrastructure administration, technical support, and project planning across three organizations in Milan.
  • Manage network security and wireless infrastructure utilizing Cisco Meraki and Bitdefender Endpoint Protection.
  • Administer Google Workspace, 3CX enterprise telephony, and centralized NAS backup and disaster recovery systems.
Information Technology Assistant · FDC International FZCO
Feb 2019 – Jan 2021 | United Arab Emirates
  • Served as single point of contact for end-user technical needs, resolving hardware, software, and critical networking issues with 24/7 remote support.
  • Managed Synology NAS shared drive permissions, user provisioning, and wireless Access Point deployments.
  • Authored End-User Acceptable Use Policies, troubleshooting guides, and knowledge-base documentation.
IT Desktop Support · EMTECH Group (FDC International)
Aug 2017 – Feb 2019 | Dubai, UAE
  • Managed Active Directory, Group Policies, firewall rules, server room monitoring systems, and weekly Symantec tape backups.
  • Deployed and maintained CCTV/NVR surveillance, UPS systems, structured LAN/WAN cabling, and biometric fingerprint databases.
Desktop Support Technician / Technical & IT Specialist · First Datacorp (Alaska Milk Corp)
Apr 2015 – Apr 2017 | Makati / Laguna, Philippines
  • Administered Level 2 server configurations, FortiGate firewall management, switch/router upgrades, and Wi-Fi site surveys.
  • Handled SAP client deployments, full IT asset lifecycle management, and weekly plant IT status reports.
I.T. Technician · SSMC Group of Hospitals and Clinics
Apr 2014 – Mar 2015 | Laguna, Philippines
  • Maintained the hospital's patient/outpatient database system, deployed workstations, and executed preventive hardware maintenance.

🖧 Featured Case Study: Veldad Infrastructure

My homelab is a hobby I design, build and run in my spare time: a self-hosted private cloud for my photos, media and automations, guarded by single sign-on, active intrusion defense and automated 3-2-1 backups. Click a card to open it.

🗄️ The Core Host

  • Hardware: Ugreen UGOS 6800plus NAS
  • Compute: 48GB RAM for high-density virtualization & containers
  • Storage: 14TB redundant RAID 6 pool
  • Connectivity: 2.5 Gbps Down / 1 Gbps Up

🛡️ The Walled Garden (Ubuntu VM)

  • Edge Isolation: Dedicated Ubuntu VM separating the internet-facing edge from the storage host
  • Routing & DNS: Caddy reverse proxy with automatic TLS + Pi-hole DNS sinkhole
  • SSO & 2FA: Authelia + LLDAP single sign-on with per-application access policies
  • Active Defense: Fail2Ban watching proxy logs, banning at the host firewall, and emailing Whois-enriched threat alerts

🐳 Production Stack (Bare-Metal)

  • Hardware Access: Containers run directly on the NAS host for native Intel iGPU acceleration
  • Immich: OpenVINO AI photo server safeguarding a 1.18+ TiB library and its Postgres database
  • Jellyfin: Media server utilizing Intel QuickSync & an 8GB RAM disk (tmpfs) to eliminate RAID drive wear
  • Automation & Arcade: n8n workflow engine, jellyfin-newsletter & MAME arcade

💾 3-2-1 Data Vault & Telemetry

  • Off-site Cloud Vault: Nightly encrypted Rclone sync to Google Drive with automated SMTP summary reports
  • Local & Remote Mirror: Nightly sync to a 5TB external HDD & a remote UGOS PLUS 6800 node
  • Observability: Prometheus, Node Exporter & Grafana with SMTP alerting on capacity and BTRFS errors, plus external Uptime Kuma on an Oracle Cloud VM (public status page ↗)

🗺️ Infrastructure Topology

Blue packets follow traffic, orange ones follow alerts and control signals. Hover a component to trace its connections; click it for details. 

flowchart TD
    Internet(("🌐 Public Internet"))
    Email(("📱 SMTP Alert Pipeline"))

    subgraph OracleCloud["☁️ External Network (Oracle Cloud VM)"]
        UK["⏱️ Uptime Kuma Monitor"]
        Rustdesk["🖥️ RustDesk Relay"]
    end

    subgraph HomeNetwork["🏠 Home Network"]
        Router["📶 Home Router"]

        subgraph NAS["🗄️ Ugreen UGOS 6800plus NAS (14TB RAID 6, 48GB RAM)"]
            subgraph UbuntuVM["💻 Ubuntu VM Walled Garden"]
                FW["🧱 Host Firewall"]
                Caddy["🔗 Caddy Reverse Proxy"]
                Authelia["🔑 Authelia SSO + LLDAP"]
                F2B["🛡️ Fail2Ban"]
                Pihole["🛑 Pi-hole DNS"]
            end

            subgraph Dockers["🐳 Bare-Metal Containers"]
                Immich["📸 Immich + OpenVINO"]
                Jellyfin["🎬 Jellyfin (tmpfs RAM Disk)"]
                N8N["⚙️ n8n Automation"]
                Mame["🕹️ MAME Arcade"]
                Prom["📊 Prometheus + Grafana"]
            end
        end

        subgraph Backups["💾 3-2-1 Data Protection"]
            JobCloud["⏱️ Nightly Encrypted Rclone"]
            JobLocal["⏱️ Nightly Local Sync"]
            ExtHDD["💾 5TB External HDD"]
        end
    end

    GDrive["☁️ Google Drive Crypt Vault"]
    RemoteNAS["🗄️ Remote UGOS PLUS 6800"]

    Internet -->|HTTPS| Router
    Router -->|Port forward 80 / 443| FW
    FW --> Caddy
    Caddy <-->|Forward auth| Authelia
    Caddy -->|Reverse proxy| Dockers
    Caddy -.->|Access logs| F2B
    F2B -.->|Ban rules| FW
    F2B -.->|Whois alert| Email
    Prom -.->|Capacity / BTRFS alerts| Email
    Router -.->|DNS| Pihole
    N8N -->|Webhooks| Immich
    Dockers -->|Library + Postgres DB| JobCloud
    Dockers -->|Snapshot| JobLocal
    JobCloud -->|Encrypted Sync| GDrive
    JobLocal -->|Local Mirror| ExtHDD
    JobLocal -->|Remote Sync| RemoteNAS
    UK -.->|Push / Ping| NAS

🎮 Hobby: Custom PC Building

Outside work I plan and hand-assemble custom gaming PCs, from parts selection and cable management to cooling and power protection. Click the card to open it.

🖥️ "Dark Quiet" Gaming Build

  • CPU: AMD Ryzen 7 9800X3D
  • GPU: Gigabyte GeForce RTX 4080 SUPER Gaming OC
  • Motherboard: ASRock X870E Taichi
  • Memory: 64GB Kingston DDR5
  • Storage: WD_BLACK SN850X 4TB NVMe SSD
  • Cooling: NZXT Kraken Elite 360 RGB AIO liquid cooler
  • Power Supply: be quiet! Dark Power 13 1000W (80 PLUS Titanium)
  • Case: Cooler Master HAF 700
  • Power Protection: Green Cell 2000VA UPS