Transmission Online → Alliance Fleet
Systems Administrator.
Eight years of IT operations.
Building toward Cloud and IAM.
// AZ-104 in progress · Los Angeles · BSTG
Infrastructure I actually run: a three-node Proxmox cluster, 25+ self-hosted services, five VLANs, and a documentation standard that treats the homelab like production.
ACT II
Role Sys Admin I · BSTG
Cert Path AZ-104 → SC-300
Fleet 3 nodes · 25+ services
NODE-A ONLINE
NODE-B ONLINE
NODE-C ONLINE
K-2SO ONLINE
34.0522°N · 118.2437°W · MID-CITY LA
Operator
Tima Nlemvo
// Senior IT Engineer → Systems Administrator → Cloud + IAM Engineer (in progress)
Eight years running enterprise IT for film studios, creative agencies, and a professional esports org. Sole IT owner at Team Liquid for three-plus years: 200-plus users, one person, everything from Google Workspace to physical access control.
When the layoff came in March 2026, I didn't start building. I already had a three-node Proxmox cluster, a SIEM, an identity platform, and 26 running automations. The lab existed because the gap between "operating systems" and "building them" needed closing on my own terms.
Career Arc
Field Service Technician RealPro Consulting Jul 2016 – Nov 2019
POS deployments, Cat5e/Cat6 cabling. Contract work nights and weekends, overlapped with Turner Tech from May 2018.
Service Desk Lead Turner Tech → Fox Studios May 2018 – Nov 2019
W2 MSP deployed to 21st Century Fox. M365, SCCM, AD at studio scale.
Helpdesk Lead & Asset Lead Creative Artists Agency Nov 2019 – Aug 2021
AD, JAMF Pro, CrowdStrike, Crestron, PingOne. Century City, LA.
Sr. Information Technology Engineer Stagwell Aug 2021 – Mar 2023
M365, Entra ID, Okta, Google Workspace across distributed agency network.
IT Engineer Team Liquid Mar 2023 – Mar 2026
Sole IT owner. 200+ users, Google Workspace, ManageEngine RMM, OpenPath physical access control. Santa Monica, CA.
Systems Administrator I BSTG (MSP) May 2026 →
Hybrid identity, endpoint lifecycle, network triage, and security incident response across a multi-client portfolio. Entra ID, Active Directory, JumpCloud, Datto RMM, IT Glue, SonicWall, ThreatLocker, UniFi.
Cloud / IAM Engineer Target role 2027 →
AZ-104 → SC-300 → AZ-500. The fleet is the lab. The certs are the proof.
Currently
⚙ Building
Alliance Fleet Codex
BookStack + NetBox + Gitea on Yavin-IV
Phase 2 · Target: mid-August 2026
Documenting the fleet like it's production
Documenting the fleet like it's production
⚙ Building
Holonet Uplink
Jocasta live on Coruscant · Hermes v0.18 · 76 skills
K-2SO rebuild to Fulcrum (NanoClaw v2)
Agent-to-agent integration · UniFi port control
Agent-to-agent integration · UniFi port control
01
Alignment Matrix
| Domain | Enterprise Experience | Alliance Fleet Implementation |
|---|---|---|
| Identity & Access | Okta, Entra ID, AD for 200+ users · OpenPath physical access · JAMF/Intune endpoint identity | Authentik SSO → OIDC/SAML, 15+ services, 100% MFA · Entra Connect PHS · alliance.lab AD forest |
| SIEM & Detection | CrowdStrike, ManageEngine · incident ownership · escalation triage at enterprise scale | Wazuh → 10+ agents, MITRE ATT&CK rules · AbuseIPDB enrichment · automated UniFi IP blocking |
| Automation | Google Workspace API scripting · SCCM deployment · ManageEngine RMM workflows | n8n → 20+ active workflows, Detect/Enrich/Decide/Act/Report · CVE digest to local LLM |
| Observability | ManageEngine monitoring · endpoint telemetry · alert-to-resolution ownership | TIG Stack → Telegraf + InfluxDB + Grafana at 10s resolution · GPU telemetry · forensic timeline |
| Network Security | VLAN design review · firewall policy enforcement · Tailscale mesh for distributed teams | 5-VLAN segmentation · UniFi inter-VLAN firewall · Tailscale subnet routing · Bot-Net /28 isolation |
02
Fleet Status
Millennium Falcon
FCM2250 · NODE-A · 192.168.1.10
ONLINE
CR90 Corvette
QCM1255 · NODE-B · 192.168.1.11
ONLINE
Gozanti Cruiser
OptiPlex 7050 · NODE-C · 192.168.1.12
ONLINE
Proxmox VE 8.x · HA enabled
VMs + LXC 17 active
Services 25+ running
VLANs 5 active + 1 planned
n8n 20+ workflows
Wazuh 10+ agents
03
Projects
Act II writeup
VFIO Forensic Postmortem
Silent hard lockup, zero local logs. Crash timeline reconstructed using external InfluxDB telemetry at 10-second resolution. Root cause: PCIe ASPM power state transition under VFIO.
Read writeup →
Act II project
Fleet Defense Stack
Wazuh SIEM across 10+ agents, n8n enrichment with AbuseIPDB threat intelligence, automated UniFi IP blocking, Discord alerting with MITRE ATT&CK tagging.
Read writeup →
Act II project
Hybrid Identity Lab
On-prem AD forest (alliance.lab) synchronized to Entra ID via Password Hash Sync. GPO cascade testing, domain-joined workstation, hands-on SC-300 prep.
Read writeup →
Act II project
BD-1: Claude-Powered Discord Bot
Custom Discord bot powered by Anthropic Claude API with a $10/month budget cap enforced in code. Git-synced knowledge base, Haiku/Sonnet model routing, PM2 process management under a dedicated user. Archived to bd1-archive after 996 PM2 restarts; succeeded by Jocasta.
Read writeup →
Act III project
Jocasta: Hermes Agent Platform
BD-1's successor on the Hermes Agent framework. Local-first inference (qwen3:14b) with Claude Haiku/Sonnet elevation under a $5/day hard cap, 76 loadable skills including a full Azure cert study track, and a Git-synced Fleet Codex knowledge base.
Read writeup →
Act II project
Local AI Stack
RTX 4000 Ada passed through via VFIO to a dedicated VM. Ollama at 50+ tokens per second. OpenWebUI, AnythingLLM RAG with 2,385 embedded document vectors, ComfyUI. Zero data egress.
Read writeup →
Act II project
Authentik SSO Platform
Centralized identity for 15+ services via OIDC, SAML, and Forward Auth. MFA enforced at the flow level, not per-app. Single audit trail forwarded to Wazuh. One login gates everything.
Read writeup →
Act II project
Azure Offsite Backup Pipeline
Nightly Proxmox-to-Azure Blob backup via azcopy on the Corvette node. SAS-scoped credentials, 3AM cron, full vzdump set pushed daily. The first piece of the homelab to cross the boundary into Azure.
Read writeup →
Act II project
n8n Infrastructure Automation
20+ active workflows following a Detect/Enrich/Decide/Act/Report pattern. Connects SIEM, identity, network, AI inference, and Discord into one operational layer.
Read writeup →
Act II project
TIG Stack Observability
Telegraf shipping 10-second metrics to InfluxDB from every host. Grafana dashboards for fleet health and GPU telemetry. The monitoring layer that made the VFIO postmortem possible.
Read writeup →
Act III project
Alliance Fleet Codex
Docs-as-code for the fleet: BookStack authoring (18 shelves, 10 ADRs), nightly n8n export to Gitea, 4am sync into Jocasta's knowledge base. NetBox as IPAM authority. Authentik OIDC across the stack.
Read writeup →
04
Field Notes
Transmission Received
Holocron Logs → Online
Self-hosted on the Alliance Fleet. Infrastructure documented in real time.
17 Projects
14 Writeups
3 Field Notes
Phase 2 active