Projects, described by engineering substance

Environment

• Single-server dialer carrying agents, database and recording storage
• One SIP trunk with no failover path
• No separation between agent traffic and back-office network
• Backups limited to occasional manual copies

Architecture

• Dialer nodes separated from the ViciDial web/database tier
• Database moved to dedicated resources with tuned buffers and log archiving
• Recording capture offloaded to separate storage with retention rules
• Second carrier trunk added with failover routing and channel limits
• Voice traffic placed on its own VLAN with QoS marking

Implementation

• Baseline capture of busy-hour concurrency, dial ratio and database load
• Rebuild on a Proxmox cluster with resources reserved for telephony guests
• Campaigns migrated in stages with a pilot agent group validating each stage
• DNC handling, retry logic and dispositions reviewed before full launch
• Scheduled backups with a documented and tested restore procedure

Outcome

• Agent audio complaints traced to dial ratio and channel saturation and resolved at source
• Reporting queries no longer contend with live call traffic
• A single node failure no longer takes the whole operation offline
• Recording growth is bounded by policy instead of filling the system disk

Environment

• Independent PBX per site with different vendors and firmware levels
• Duplicate extension ranges across offices
• Handsets configured individually with default administrative credentials in places
• No central call reporting

Architecture

• Central FreePBX platform with per-site outbound routes and local breakout where required
• Unified extension plan and DID-to-destination map documented per number range
• Site-to-site connectivity over VPN for inter-office dialling
• Zero-touch provisioning templates per handset model
• Outbound classes for internal, national and international calling

Implementation

• Numbering and IVR logic documented from each legacy system before any change
• Pilot site migrated first with the legacy PBX kept ready for rollback
• Handsets re-provisioned from templates, default credentials removed
• TLS signalling and SRTP media enabled and verified on live channels
• Remaining sites cut over in sequence with a validation checklist per site

Outcome

• Inter-office calls now stay on-net rather than traversing the PSTN
• One consistent dial plan, IVR structure and reporting view across all sites
• Handset replacement is a provisioning swap rather than a manual rebuild
• International dialling is granted by class, not available to every extension by default

Environment

• Mixed-age physical servers, several past end of support
• Backup jobs reporting success with no restore ever attempted
• Management interfaces reachable from the general user network
• No documented recovery point or recovery time objectives

Architecture

• Clustered hypervisor platform sized with N+1 headroom from measured usage
• Redundant storage paths and workload-matched performance tiers
• Separate networks for management, migration, storage and workloads
• Application-aware backups with an offsite and immutable copy
• Recovery objectives agreed per service before the design was finalised

Implementation

• Dependency mapping and measured resource profiling across a full business cycle
• Migration in waves, starting with low-risk internal workloads
• Physical sources kept recoverable until each wave was signed off
• Management plane moved onto a restricted network with role-based access
• Restore tests executed and the actual recovery time recorded per service

Outcome

• Recovery is now a rehearsed procedure with a known, documented duration
• Host maintenance happens without taking applications offline
• Capacity decisions are driven by measured data rather than server specifications
• Backup failures raise an alert to a person instead of sitting in a log

Environment

• Legacy IMAP mailboxes with inconsistent client configuration
• SPF record present but incomplete; no DKIM signing; no DMARC policy
• Shared administrative credentials with no multi-factor authentication
• No visibility into who was sending on behalf of the domain

Architecture

• Tenant, domain and organisational structure defined before migration
• Mail flow and routing rules mapped for every legitimate sending source
• SPF corrected, DKIM signing enabled, DMARC introduced in monitoring mode
• Conditional access and multi-factor authentication on administrative roles
• Retention and external sharing policies aligned to business requirements

Implementation

• Full inventory of applications and services sending as the domain
• Staged mailbox migration with a pilot group and a defined rollback point
• DMARC aggregate reports reviewed until all legitimate sources aligned
• Policy moved from none to quarantine and then to enforcement in steps
• Administrative roles reviewed and shared logins removed

Outcome

• Legitimate mail is authenticated and aligned across all sending sources
• Spoofed mail using the domain is rejected by receiving providers under enforcement
• Administrative access is individual and protected by multi-factor authentication
• Mail flow and policy are documented rather than held in one person's memory

Environment

• Shared hosting with no control over the underlying resources
• Manual file-level deployments directly to production
• TLS certificates renewed by hand and occasionally missed
• Backups provided by the host with no verified restore path

Architecture

• Right-sized VPS instances derived from measured traffic and resource usage
• Separate staging environment mirroring production configuration
• Reverse proxy with automated certificate issuance and renewal
• Scheduled off-instance backups with retention and pruning rules
• Firewall policy with administrative access restricted to known networks

Implementation

• Application dependencies documented and reproduced on the new platform
• Data pre-seeded and kept in sync ahead of the cutover window
• DNS time-to-live reduced in advance so the switch was fast and reversible
• Cutover limited to the final delta sync, traffic switch and validation checklist
• Legacy host retained read-only until sign-off

Outcome

• Performance is now a function of resources the business controls
• Changes are validated in staging before they reach customers
• Certificate expiry is automated and monitored rather than remembered
• Restores have been tested from the new backup target

Environment

• Single VLAN carrying all traffic types
• Hypervisor and switch management reachable from user devices
• Shared administrative accounts without multi-factor authentication
• Monitoring limited to basic host up/down checks

Architecture

• Separate VLANs for servers, users, voice, guests and management
• Default-deny policy between segments with documented exceptions
• QoS marking so voice traffic is prioritised over bulk data
• Multi-factor authentication on every administrative entry point
• Service-level monitoring with predictive alerts on capacity and certificate expiry

Implementation

• Traffic flows captured before segmentation so exceptions were based on evidence
• Management plane isolated first, then workload segments introduced in stages
• Individual administrator accounts issued and shared logins retired
• Runbooks written for the top failure scenarios and escalation paths agreed
• Change log, IP plan and topology diagram handed over with the environment

Outcome

• A compromised workstation no longer has a direct path to critical systems
• Voice quality is stable through data-heavy periods
• Administrative access is attributable to an individual engineer
• Alerts now fire ahead of capacity and certificate-related outages