Services Networks & IT
Most small networks have one expert, and most of what they know is in their head. The four-tenant building written up on this site arrived exactly like that: one consumer modem, everyone on the same flat network, and nobody who could say which cable went where — so if the person who set it up left, the building's internet left with them. The work here goes the other way round. Separation the network enforces rather than asks for, restores that have actually been performed, and a documentation set generated from one data file so it cannot drift away from the thing it describes.
PartsCisco Meraki · VLANs · Cloudflare DNS · VPN · Docker · Linux VPS · Google Workspace
§01 What gets built
Three of these are the network. The fourth is the reason the network survives you, us, and whoever is holding the keys in three years' time — and it is usually more work than the other three together.
One line in, separate networks out. Tenants, staff and the public guest Wi-Fi each get their own segment and their own key, so a device on one has no route to the others and no way into the management network the building is run from.
PartsCisco Meraki · VLANs · one SSID each
Records that point where you think they point, a cutover planned so the old destination stays standing until the new one has proved itself, and mail set up so the visible sender and the envelope sender agree — which is what makes SPF align and DMARC pass.
PartsCloudflare DNS · SPF · DKIM · DMARC · TLS
A Linux machine and a handful of containers, for the work where paying per user every month has stopped making sense. Every backup is restored onto clean hardware before it counts as a backup, because a copy that has never come back is a claim.
PartsLinux VPS · Docker · restore rehearsals
The larger half of the job: a master manual, a quick guide, an admin access sheet, a recovery guide and the diagrams — all generated by script from one canonical data file, so when the network changes the manuals get rebuilt rather than re-typed.
Partspython-docx · cairosvg · SVG diagrams
§02 How the work goes
The test is the same one every stage is building towards: could somebody who has never seen this network bring it back by reading? Everything here either moves that answer towards yes or it does not belong in the job.
01 · Survey
Every port, every SSID and every account that can change something — captured from the console and reduced to one data file before anything is touched.
Most of this work starts in a building where nobody can say which cable goes where. The first pass is inventory rather than opinion: what the line actually is, what the gateway actually is, which devices answer, which networks are broadcasting, and who holds the logins that can change any of it. Every console screen gets captured and reduced to one canonical data file — because that file is what every diagram and every page of the manual is generated from later, and it is the reason a changed credential updates every page that mentions it rather than four pages out of five.
The pass ends in a findings list: what is wrong, ranked by what it would cost you, with the fix written beside it rather than quoted separately. Most of what follows can be done from a browser. Where hands are needed in the room, they get named at this point instead of discovered on the afternoon something is down.
02 · Segment
The public guest network is the least trusted thing in the building. The management network is the one nobody else can see. Everything else sits between those two, deliberately.
Segmentation is a hierarchy of trust written as configuration. In the four-tenant building that meant five VLANs — four tenants plus management — with one SSID and one key per tenant, so a device on the shop's Wi-Fi has no route to the office's machines and no way into the management network the place is run from. Intrusion detection and content filtering go where they earn their keep rather than everywhere: switched on blanket they mostly produce noise somebody learns to ignore, which is worse than not having them at all.
Remote administration is designed in here rather than bolted on afterwards — cloud management, a client VPN for the work that has to reach inside, and configuration that is pushed rather than typed into a box in a cupboard. Nothing gets built that can only be fixed by standing next to it. A unit that dies is replaced by one that pulls its own configuration down, which is a different kind of afternoon from rebuilding a router from memory.
03 · Build
A window, a written order of operations, and a way back from every step — agreed before anything is touched.
The order matters more than the speed. Management comes up first, so there is still a way in if the rest misbehaves; then the tenants; then the guest network last. DNS and mail cutovers are treated the same way — time-to-live lowered in advance, the new destination tested before anything points at it, and the old one left standing until the new one has proved itself rather than switched off the same evening. Mail is the one nobody schedules and everybody notices.
The time difference is the one genuine advantage of working from here, and it is worth stating narrowly: the change that takes your network down is made while your building is empty, and from this desk that is an ordinary working afternoon rather than somebody's lost night. The window is scheduled around your quiet hours, not ours.
04 · Rehearse
A backup nobody has restored is a rumour. Before anything counts as finished, a copy is brought back onto clean hardware — not checked for a green tick, restored.
This is the stage the rest of the page exists for. Green ticks in a console are evidence that a job ran, not that a system comes back, and the day you discover the difference is always the worst available day to discover it. So a restore is performed onto a machine with nothing on it, and what comes back is checked against what was supposed to come back.
The recovery guide is held to the same standard, and it is a demanding one: it has to be executable by somebody who has never seen the system. A procedure written by the person who already knows the answer reads perfectly to that person and stops being followable at the first step they assumed was obvious — so wherever we can put it in front of one of your own people cold, we do, and every place they stop is a place the guide is wrong rather than the reader. Those stops are the most valuable thing produced in the whole job.
05 · Hand over
The accounts are in your name, ours is a separate login you can delete in one click, and the manuals leave the job with you rather than living on our machine.
The documentation set is the deliverable, not the paperwork after it. For the four-tenant building it came to roughly forty pages: a 16-page master manual, a 4-page quick guide, an admin access sheet, a 7-page recovery guide, five diagrams — physical topology, VLAN segmentation, SSID map, security services and access layers — and a self-contained HTML overview. Access and credentials come first, install and recovery next, the full reference last: the order you need them in when something is down, not the order they were built in.
Access is handed over as deliberately as the files. The dashboard, the domain and the hosting are in your name from the first day, and the studio works from a separate named account that can be removed without breaking anything else. A supplier you cannot lock out is the real lock-in, and it is almost never malice — it is a decision nobody made at the start.
§03 The toolkit
The gateway is chosen for the building rather than the brochure — Cisco, Ubiquiti, Fortinet, Palo Alto, Juniper, Aruba, SonicWall, MikroTik, pfSense, WatchGuard, Sophos and Netgate all end up in front of one eventually. What does not change is the discipline around it.
| Part | Why it is there |
|---|---|
| Cisco Meraki | The gateway on the multi-tenant build published here. Cloud-managed and administered from a browser by design, which is what makes a network on the other side of the world an ordinary thing to run rather than a brave decision. |
| VLANs | Separation enforced by the network instead of by asking people not to look. Four tenants on one fibre line is a segmentation problem long before it is a bandwidth problem, and it is the cheapest fix in this entire list. |
| One SSID per tenant | Because a shared password is not a boundary. One network name and one key each means a staff change in one unit never turns into re-keying the whole building. |
| Client VPN | The route in for administration that puts one authenticated endpoint on the gateway rather than a management interface on the internet — and a route you can close, which is the point of it being a named account rather than a shared one. |
| Cloudflare | DNS, TLS, an edge cache and a firewall in front of hosting you already own, and one nameserver change away from being gone again. Reversibility is the reason it is on the list. |
| SPF, DKIM, DMARC | Mail alignment is arithmetic rather than taste: the visible sender and the envelope sender have to agree, or your invoices land in spam. DMARC starts in reporting mode, so you can see everything already sending as you before anything of yours gets rejected. |
| Google Workspace | Where the mailboxes sit when the answer is not a server you own. It runs here for the studio’s own mail alongside Microsoft 365, so what gets said about either comes from using it rather than from a comparison chart. The alignment records above are what decide whether your mail arrives; the platform underneath them is a preference. |
| Linux VPS | Where a self-hosted service goes once paying per user every month has stopped making sense. Plain packages and plain files, so the machine can be rebuilt from the guide rather than from somebody's memory. |
| Docker | A service pinned to a version and described in a file, so “how was this set up” has a written answer. A container you can rebuild is a container you can move to another host. |
| python-docx | The manuals are generated, not typed. One data file goes in; the Word and PDF versions come out. It is the mechanism behind the promise that documentation cannot drift from the network. |
| cairosvg | Turns the SVG diagrams into images the documents can carry at any size. Topology, VLANs, SSIDs, security services and access layers all come out of the same drawing rather than five screenshots taken on five different days. |
| A clean machine | Not a tool but a rule, and the one that does the most work: nothing counts as a backup until a copy has been restored onto hardware with nothing on it. Whose machine that is gets decided per job — what is not negotiable is that the restore happens. |
NoteConfiguration lives in the platform that owns it, and the documentation source file lives in version control — so a manual that changed can be diffed, and you can see when and why.
§04 Hands on site
This is the lane where “remote” and “one person” sound weakest, so it is the part to settle first rather than last. Three questions do it:
None of that is a disclaimer. It is the design constraint the whole method comes from: build nothing that requires the builder, and the question of where the builder happens to be stops mattering.
§05 Not a sales page
Six ways small networks fail. Four of the six were in the building described above on the day it was surveyed, and none of them looked like a problem until it was one.
§06 Straight answers
Not us, and that is said at the start rather than discovered halfway. Seating an ONT, pulling cable through a ceiling and labelling a patch panel need hands in the room, and those hands are your own staff or a local cabling contractor working from numbered instructions with a photograph per step and a call open while they do it. We do not run cable, rack equipment or install anything on site. Everything after that — gateway, VLANs, SSIDs, firewall rules, DNS — is administered from a browser by design.
You should assume we are. There is no overnight desk, no four-hour on-site response and no spare switch in a van, and a one-person studio that implies otherwise is selling you something. What stands in their place is built earlier: labelled ports, a restore already performed on clean hardware, a recovery guide written to be followed by whoever is holding it, and a local escalation agreed by name before anybody needs it. If your building cannot tolerate that, hire a provider with a bench — that is the honest answer, not a sales objection.
Then nothing should be waiting on us, which is exactly why the documentation is the larger half of the job rather than the paperwork after it. Nothing gets built that only we can log into, the admin accounts are in your name, and the recovery guide is written to be executed by somebody who has never seen the system. A supplier who cannot be replaced is a risk whatever country they are in. What you do not get is a bench: this is one person's capacity, not a department's.
In one click. The dashboard, the domain and the DNS are in your name and on your billing, and our access is a separate named account — so revoking it is deleting one user rather than changing every password in the building. At the end of a job it is revoked by default rather than left sitting there dormant, and the admin access sheet you hold is what you check that against. A network you cannot lock your supplier out of is the real lock-in, and no contract clause fixes it. Only the account list does.
Not properly, and anybody who says otherwise is guessing. Coverage is a physical problem — walls, lifts, a metal roof, the neighbour's access point — and it is answered by walking the building with a meter, which cannot be done from here. Segmentation, routing, firewalling, DNS and documentation are logical problems, and those are answered perfectly well remotely. If the real complaint is dead spots on the second floor, hire somebody local for the survey; we will design from their readings and say so in the findings.
With what is actually there, before anything is changed: an inventory of every device, port and SSID, a named owner for every admin account that can be found, and a findings list ranked by what bites first. Ownership of the domain usually bites first, because the mail and the website both hang off it. Some of it comes back the slow way, through registrar and provider recovery processes that need you rather than us. That recovery is a real cost — and it should also be the last time you ever pay it.
Yes, and it is the usual arrangement: a defined piece of work that ends with the network segmented, the restores rehearsed and the manuals in your hands. There is no retainer to sign and nothing that stops working if you never call again. It also means we are the wrong studio for the daily business of IT — a printer that will not print, a laptop that will not wake. That needs somebody who can walk to the desk, and it is worth having a local person for it whether or not we ever touch your network.
If the answer is no, that is the job — and it starts with finding out what is actually in the building. Describe what you have and what you are afraid of.
Leave a note See the network work
Alsoone fibre line, four tenants, five VLANs · web & app design · AI integration
