Core compute
Virtualization platforms running production services and automation workloads.
- Proxmox for VM/LXC operations
- VMware/vCenter experience and interoperability mindset
Senior IT Consultant · 20+ years
Infrastructure, automation, and security you can trust.
I design and operate resilient systems: virtualization and storage platforms, secure remote access, monitoring, backups, and local-first automation—validated daily in my production-grade homelab.
Primary services
This is what clients usually come to me for first.
Home Assistant (local-first)
Design, recovery, and local-first integrations that work offline.
Alarm systems for motorhomes and homes
Intrusion + safety detection with secure remote access.
Security cameras with Shinobi
Local recording, retention, and optional offsite backup.
Reference architecture
A real environment I maintain, harden, and automate.
Public-facing materials are anonymized: no internal IPs, secrets, or customer identifiers.
Who I am
Pablo Bondesio Ruiz
Senior IT Consultant · Infrastructure, Automation & Security
I’m an IT consultant based in Reus, Spain, with 20+ years across enterprise IT: Windows and Linux administration, virtualization, storage, backups, monitoring, and automation. I’ve supported everything from datacenter operations to large-scale VMware environments and modern homelabs.
My current focus is local-first, resilient systems—especially Home Assistant, smart security for homes and RVs, and camera platforms like Shinobi. I build solutions that keep running without cloud dependencies, with clear runbooks and reliable recovery paths.
Fluent in Spanish, Catalan, and English. Comfortable leading teams, documenting processes, and shipping systems that are maintainable long after handoff.
Homelab as a living portfolio
This isn’t a toy setup: it’s an integrated environment where I validate architecture choices, hardening, backup strategies, and automation before applying the same discipline for clients.
Storage backbone
TrueNAS-backed storage exported to compute and application layers.
- NFS storage for application data and backups
- Practical permission models and predictable mount conventions
Backup and recovery
Proxmox Backup Server with restricted access and scheduled jobs.
- Key-only SSH policies and tight firewalling on management ports
- Repeatable backup jobs for critical datasets
Secure edge
Minimal exposure model: reverse proxy, VPN, log-based banning, and safe admin access.
- Reverse proxy segmentation (admin paths restricted)
- fail2ban jails based on real access logs (401/403 patterns)
Local-first smart home & telemetry
MQTT-centric integrations, designed to survive internet outages.
- BLE → MQTT → Home Assistant → ESP32 dashboards
- Headless services with auto-recovery goals
Surveillance + media
Local recording first; optional offsite backup as a second layer.
- RTSP-based recording (no reliance on vendor cloud)
- Backup sync via rclone to cloud storage / Nextcloud
Capabilities snapshot
What you can rely on me for, end-to-end—from design to day-2 operations.
Infrastructure
Linux (Debian/Armbian)
Windows Server
Proxmox VE
VMware/vCenter
TrueNAS
NFS/SMB
systemd
Security & access
SSH hardening
Key-only auth
2FA/TOTP
UFW
nftables
fail2ban
Reverse proxy (Caddy)
OpenVPN
VLANs
Automation & observability
Ansible
PowerShell
Grafana
Bash
systemd timers
Log-driven security controls
Runbooks
Change control
Local-first IoT
MQTT
Home Assistant
BLE
Zigbee
ESP32
Tuya (local patterns)
Telemetry pipelines
Experience (CV)
Windows & Linux operations
Hands-on experience in enterprise environments, from directory services to automation and monitoring.
Windows Server & Microsoft stack
- Active Directory: users, groups, OUs, trusts, sites, replication, RODC
- GPO design, NTFS/share permissions, RBAC
- DNS/DHCP, SCCM, WSUS, Exchange, Microsoft 365
- PowerShell automation (bulk provisioning, reporting)
- Ansible automation for cross-platform tasks (WinRM/SSH)
- Veeam + Avamar backup tooling
Linux, virtualization & datacenter ops
- Debian/Ubuntu administration, systemd services, Bash automation
- Ansible playbooks for provisioning and patching
- VMware vCenter/ESXi/vSAN, Proxmox, KVM
- Storage: NFS, VMFS/iSCSI, RAID planning
- Monitoring: SolarWinds Orion, Nagios; hardware health (iLO/iDRAC)
- Datacenter operations (AWS): hardware, networking, cabling
Selected implementations
Real solutions built with maintainability in mind. Details are anonymized for safety.
Secure edge publishing for internal services
Reverse-proxied applications with protected admin endpoints, log-based banning, and strict SSH access controls.
- Caddy reverse proxy, structured access logs
- fail2ban filters and jails tuned to the proxy layer
- Key-only SSH, restricted source IPs, and hardened configs
Backup platform with tight access policy
Proxmox Backup Server with restrictive firewall rules and scheduled backups for critical data paths.
- Key-based auth with root restrictions
- nftables policy: management access only from a jump host
- Repeatable backup schedules for data sets and exports
Local-first surveillance recording and backups
RTSP-based camera recording to local storage, with optional rclone synchronization for offsite resilience.
- Local recording independent of vendor cloud
- Automated updates and logs for operational traceability
Automation pipelines for day-to-day ops
Headless scripts and timers for consistent operations: upgrades, sync jobs, notifications, and service lifecycle management.
- systemd timers for scheduled maintenance
- PowerShell automation integrating monitoring systems
- Documented workflows: develop locally, deploy safely
Backup posture hardening
Backup server locked down with key-only access and strict firewall rules around management ports.
- Least-privilege network exposure
- Repeatable backup schedules for critical datasets
Reverse proxy + bans on real signals
Edge protection using structured access logs to drive automated bans and reduce noise.
- fail2ban filters matching 401/403 patterns
- Admin paths restricted by source and policy
Local-first IoT telemetry
BLE data collected and published to MQTT, consumed by Home Assistant, visualized on ESP32 dashboards.
- Headless services designed for recovery
- Cloud-free live operation
What I offer
Services
Engagements that produce measurable outcomes, clear documentation, and maintainable operations.
Home Assistant
MQTT
Espressif
Shinobi
Proxmox
TrueNAS
OpenVPN
Windows
Linux
Red Hat
Ansible
macOS
Veeam
Dell
Zigbee
I build Home Assistant systems around local messaging, Bluetooth, and Zigbee so everything stays local-first. The result is a resilient stack with clear automations, structured dashboards, and a runbook for recovery.
Typical delivery workflow
- Inventory sensors, actuators, and network paths; define offline behavior.
- Ingest data via local messaging and Bluetooth; normalize entities and naming for long-term maintainability.
- Build automations with guardrails, timeouts, and health checks.
- Design dashboards for day-to-day use plus an ops view for diagnostics.
- Implement backups, update strategy, and recovery steps.
I design alarm systems that stay local and reliable. Sensors communicate over Zigbee, so the alarm works even if there is no Wi-Fi or internet. If you add a 4G router, you can enable urgent mobile push notifications (even overriding Do Not Disturb). If you do not, the alarm still runs locally with siren and on-site alerts.
Workflow (motorhome example)
- Battery-backed sensors (vibration on windows/windshield, motion sensors, door contacts) report to Home Assistant.
- Anti-false-positive logic runs: windshield vibration triggers immediately; side windows require a second hit within 3 seconds.
- Confirmed events set an alarm flag and energize the siren/relay for a timed response window.
- Notifications fire in parallel: mobile push + email through a local mail relay.
- Health checks run continuously: if any sensor is unknown/unavailable for 5 minutes, or battery drops below 10% for 10 minutes, you receive warnings.
- Battery management telemetry (Bluetooth → local messaging → Home Assistant) attaches live battery status (voltage, current, state of charge, temperatures) so you can see energy state alongside alarms.
Home + motorhome unified view
- Remote Home Assistant integration consolidates motorhome entities in the home dashboard.
- Secure remote access via a private tunnel, with no cloud dependency for live operation.
Cameras record locally first, without vendor cloud dependencies. I deploy Shinobi or comparable open-source NVRs, enforce retention, and add optional offsite sync for resilience.
Workflow
- Camera streams validated, transcoding tuned, and storage paths mapped to local disks.
- Retention policies set per camera (continuous vs. motion-based).
- Health checks and update routines scheduled with maintenance timers.
- Optional backups to cloud or a private storage target.
I deliver clean host layouts, templates, patch plans, and predictable operations so your stack scales without surprises.
Workflow
- Baseline hardening, key-only SSH, and firewall policy.
- Template creation for consistent virtual machine and container provisioning.
- Monitoring hooks and service runbooks for day-2 ops.
Storage and backups are designed for recovery, not just for retention. I build the data paths, permissions, and backup cadence around real restore tests.
Workflow
- Define datasets and export strategy for network shares.
- Implement backup schedules and retention policy.
- Validate restores and document recovery steps.
Secure access patterns with strict SSH policy, reverse proxy segmentation, and automated blocking from real access logs.
Workflow
- Define ingress and trusted networks.
- Deploy secure remote access and reverse proxy with hardened headers.
- Configure fail2ban filters and monitor events.
I automate repetitive work with scheduled timers and scripts, and integrate monitoring so issues are detected early.
Workflow
- Define monitoring scope and alert thresholds.
- Automate provisioning and patching with Ansible playbooks.
- Build scripts for patching, sync jobs, and notifications.
- Document operational steps for handoff.
I deploy internal services, harden access paths, and deliver documentation so the system remains maintainable long after handoff.
Workflow
- Install and secure the application stack.
- Create backups, update plans, and recovery steps.
- Provide runbooks and change-control notes.
I build bespoke websites and storefronts you own end-to-end: custom UI, admin tools for content and products, multilingual support, and email integrations. A recent example is a paintings storefront with admin user management, bulk actions, verification tokens, email settings, and manual locales with a cookie-driven language selector.
Workflow
- Define goals, content model, and UX flow (catalog, product details, admin operations).
- Design and build a fully custom UI plus admin features (create/edit, bulk actions).
- Set up multilingual content and reliable email delivery.
- Deploy on Proxmox containers with a system service and reverse proxy.
- Document operations, updates, and recovery steps.
How I work
Reliable outcomes come from repeatable process and clear operational ownership.
Local-first by default
Design systems that keep working without external dependencies. Use cloud only as an optional layer for backups and replication.
Security as a baseline
Harden SSH and admin surfaces, apply principle of least privilege, and use log-driven controls like fail2ban and rate limiting.
Operate what you build
Deliver runbooks, sane alerts, and automation for patching and backups—so the system remains maintainable long after handoff.
Contact
If you want to discuss a project, I’ll share the right contact channels and references on request.
Direct contact
Reach me here for new projects and consultations.
-
Email:
[email protected]
-
WhatsApp:
+34 647 877 482