TuxAlfa: building a hybrid IT environment

Taitotalo final project · 2026

From planning to a verifiable implementation

I designed, built and documented an IT laboratory for the fictional TuxAlfa organisation. The project brings together local servers, cloud management, network security and practical troubleshooting.

I handled architecture planning, virtual machine and service setup, permissions, functional testing and documentation. A simulated business let me investigate service dependencies without changing a real client's environment.

IT Support Technician qualification completed in October 2026.

Download the project brief (FI / EN / ES, PDF)

Virtual laboratoryFedora · KVM/QEMU · libvirt · Open vSwitch
Network boundariesIPFire · Debian router · VLAN 30 / 40 / 60 · nftables
Central servicesWindows Server 2025 · AD DS · DNS · DHCP · GPO
Cloud management and monitoringEntra ID · Intune · Azure Arc · Zabbix · Wazuh

What I implemented

Networking and virtualisation

I built the virtual environment on a Fedora host. Open vSwitch connected the virtual networks, IPFire controlled external traffic and a Debian router handled connections between VLANs.

Identity and Windows services

I configured two domain controllers, AD DS, DNS, DHCP and Group Policy. File permissions, printing and software deployment were incorporated into central administration.

Hybrid and device management

I implemented Entra ID synchronisation, Hybrid Join and Intune enrolment. The documentation covers update rings, Delivery Optimization, Microsoft 365 application deployment and DC02 registration in Azure Arc.

Monitoring and protection

I deployed Zabbix and Wazuh servers in Azure. I documented host availability monitoring, Wazuh agents, vulnerability findings and the status of WithSecure endpoint protection.

How I checked the environment

Compared blocked management connections from user networks with permitted connections from the IT network.
Checked AD replication, DHCP configuration, DNS and the time hierarchy using service-specific tests.
Checked Group Policy application, file permissions and centrally deployed software.
Verified hybrid joining, Intune device enrolment and receipt of monitoring data.

Evidence from an actual test

TuxAlfa Wazuh dashboard showing active agents for the Windows server and Debian router. — Wazuh during the final project checks: the DC01 and RTR01 agents are active. The addresses shown belong to the private laboratory network. This demonstrates agent status at that moment, rather than an ongoing monitoring service.

Scope and further work

This is an academic laboratory project, not a client production deployment or an independently audited security solution.
Backup configuration was documented, but a completed restore test was not demonstrated.
External WireGuard validation and FSRM email alerts remained further work.
TLS for the Zabbix web interface and Wazuh SCA validation on RTR01 were not demonstrated. Production use would require separate hardening and testing.