Islam Elsayed — IT Specialist, Endpoint & Infrastructure

islam@portfolio:~$~$cat about.md

I keep endpoints and infrastructure running for a school of a thousand devices — a mixed Windows, macOS, iPadOS and ChromeOS fleet managed through Intune and Google Workspace, supporting 150+ staff and 900+ students.

Off the clock it is the same work at smaller scale: a Proxmox host I break and rebuild, a Python collector feeding a monitoring dashboard, and a Rocky Linux VM I administer to study for RHCSA.

ROLEIT Specialist · NYC DOE

ENDPOINTS1,000+

ASSETS$3M+ tracked

EDUCATIONB.S. CS · Brooklyn College

BASEDNew York area

95%+first contact resolution

30%less manual reporting time

80+wireless access points

islam@portfolio:~$~$cat homelab_arch.md

One host, three VMs, and somewhere to fail safely

A Proxmox hypervisor on a Dell OptiPlex 7060 Micro. Snapshots make every change reversible, and monitoring lives on separate hardware so a host failure still reaches me.

architecture write-up →

homelab.topology1 HOST · 3 GUESTS

wan / isp · 1 gbps symmetric fiberNO INBOUND PORTS

ap ×2 · wirelesswi-fi 7 mesh · ap mode

gateway-01 · routing · dhcp · natONE GATEWAY

switch-01 · tp-link tl-sg116e easy smart802.1Qcapableone flat segment today

proxmox-01dell optiplex 7060 micro · pveHYPERVISOR

rocky linuxrhcsa study env

docker hostcontainer workloads

home assistant oshousehold service

snapshots per vm · rollback and rebuild

macmini-srvmac mini server · off-host

netdata · real time telemetryuptime kuma · service checkspython collector · security eventshealthchecks.io → out of band alert

tailscale meshzero exposed ports

macbook-promacmini-srvrocky-linuxdocker-hostdesktop

access per device

macmini-srv — ssh proxmox-01live

DESIGN DECISIONS

Three choices I would defend in a review, each one made after the alternative cost me something.

01

Snapshot before every change. The lab exists to be broken, so rollback is one step and a rebuild starts from a known state rather than memory.

02

Monitoring lives off the host. Netdata and Uptime Kuma watch Proxmox from separate hardware, and healthchecks.io expects a heartbeat — silence pages me out of band, so a dead monitor is not a quiet one.

03

Tailscale instead of port forwarding. Nothing is published to the internet and no inbound port is open. The switch supports 802.1Q, but the network stays flat until the storage tier that justifies a boundary is actually deployed — segmenting around something that does not exist yet adds a failure mode and protects nothing.

INCIDENTS

Two real failures, including the part where my first guess was wrong.

01

Monitoring that was silently dead

The dead man switch fired, so I went looking for a dead host and found a healthy one. A placeholder value sat in the credential store instead of the real check-in identifier, so the heartbeat had been posting into nothing for about twenty hours while the scheduled job kept reporting success. Now nothing counts as monitored until I have deliberately broken it and watched the alert arrive.

02

Broadcast storm from a cabling loop

A machine came up with a self-assigned address, so I started on DHCP. Wrong end of the problem: an uplink that was not fully seated explained the missing lease, and tracing it turned up a redundant run that had created a physical loop between two switch ports. Loop prevention is on, cables are labeled at both ends, and I check physical topology before suspecting configuration.

AGENT ORCHESTRATION

The Mac Mini also runs the layer most labs stop short of.

Claude Code, Codex CLI and local agents coordinate through a SQLite-backed room structure, with a knowledge vault as shared memory, so work from any agent lands in one searchable place instead of scattering across tool histories.

Infrastructure access is read only by default, reachable only over the Tailscale overlay, and every write is propose-and-approve. An agent with write access to a hypervisor is an agent that can take down the household network, so new tooling gets evaluated in a disposable VM before it touches a permanent host.

read only by defaultoverlay onlypropose and approve

islam@portfolio:~$~$ls -la ./skills

What I work with daily

01ENDPOINT & WORKPLACE

Microsoft Intune
Autopilot
Google Workspace Admin
Microsoft 365
Entra ID
Device & asset lifecycle

02CLOUD & INFRASTRUCTURE

Microsoft Azure
Proxmox VE
Docker
VMware
Tailscale
Server administration

03NETWORKING & SYSTEMS

TCP/IP · DHCP · DNS
VLANs & segmentation
Switches & routers
Wireless AP management
VPN

04MONITORING & RELIABILITY

Netdata
Uptime Kuma
healthchecks.io
Incident response
Root cause analysis

05OPERATING SYSTEMS

Windows
macOS
Rocky Linux
Linux
ChromeOS
iPadOS

06AUTOMATION & SCRIPTING

Python
Bash
Google Apps Script
CI/CD pipelines
cron & launchd

islam@portfolio:~$~$git log --oneline ./projects

Things I built and run

talvext/

MULTI TENANT PLATFORM

Talvext

Multi tenant IT operations platform for uptime monitoring, incident management and ticketing. Tenant data is isolated at the database layer through row level security, and a test suite runs against an ephemeral Supabase stack in Docker to prove separation on every build.

Row level security isolation, verified per build
CI/CD in GitHub Actions: typecheck, lint, tests, gitleaks
Migrations replayed from zero on each CI run

Next.jsTypeScriptSupabasePostgreSQLDockerGitHub Actions

github ↗live site ↗

minidash/

MONITORING

MiniDash

A dashboard for the homelab, built against upstream API shapes captured live from the running services rather than assumed. It reads a custom Python collector for auth events, alerts and tailnet state, Netdata for host telemetry, and Uptime Kuma for service checks.

Every panel designed against captured API shapes
Auth events, alerts and tailnet from one collector
Read only: no upstream service is modified

Next.jsTypeScriptTailwindNetdataUptime Kuma

github ↗

trading_agent/

CONSTRAINED AUTONOMY

Trading Agent

An LLM agent connected to a live brokerage API through MCP, inside a deliberately small blast radius. The trading account is the test harness; the subject is whether guardrails written in natural language hold when real money is on the other side.

Broker enforced account scoping
Propose and approve on every order
Refusal tests run before going live

PythonMCPBroker APIClaude Code