ComMX

A small team's chat app had outgrown a single machine. It needed persistent WebSocket sessions, encrypted traffic end to end, and a cluster that keeps serving when any one node dies, all running on a handful of lab PCs behind one MikroTik router.

1. 01MikroTik router with NAT, DNS forwarding and local records, DHCP pools, a hotspot Wi-Fi, an L2TP/IPSec VPN, per-subnet queues, and a firewall rule that blocks brute-force logins.
2. 02A Proxmox cluster of several nodes with nightly VM backups and HA migration, so VMs move to a neighbour when a node goes down.
3. 03Terraform provisions every VM in bulk and idempotent Ansible roles set up the system, load balancer, cluster, monitoring and CI/CD.
4. 04Kubernetes with three control planes and three workers on Cilium, HAProxy and keepalived for a floating IP, MetalLB and Gateway API for ingress, and Kyverno policies against latest tags, the default namespace and missing labels.
5. 05A Forgejo pipeline that scans with GitLeaks, Semgrep, Trivy and Checkov, pushes to a private registry and bumps the manifest tag, then ArgoCD syncs it, with Prometheus and Grafana alerting by email.