A 12-week educational program for running a Linux environment the way an enterprise would: layered identity and operations, not every role stacked on one VM.
This program is for learners, career-switchers, and lab members who want to understand enterprise Linux architecture by building a small, honest replica. The shell and systemd are the thread. KVM (or any hypervisor you have) is the classroom. Restore drills are the exam.
Plan on 10–12 weeks at 4–6 hours per week after you can survive on one Linux box. Rocky Linux (RHEL-like) or Debian are enough. Do not practice on a production host — including this website’s server.
12 weeks
Enterprise architecture track
4–6 hrs
Study and lab time each week
KVM / QEMU
Host for the scaled-down replica
Rocky or Debian
RHEL-like or Debian-family lab
Skip foundations only if you already administer Linux without guessing. Otherwise start here, then join week 1 of the architecture program.
Before the enterprise track: the CLI, systemd, and recovery on a single box.
Install Rocky or Debian, harden SSH, set a firewall, and recover from a snapshot.
A reverse proxy, a database, TLS, and a restore you have actually run.
Host a small app with proxy, database, TLS, and a documented restore.
A layered identity and operations platform — not every role stacked on one VM.
Build the replica below, then run the 12-week sequence and the capstone outage drill.
Enterprise Linux is a layered platform. The lab proves each layer at a smaller scale. It does not pretend a single VPS is a data centre.
| Layer | What production looks like | What the lab can prove |
|---|---|---|
| Identity | FreeIPA / RHEL IdM, SSSD, Kerberos; optional cloud IdP for SaaS | 1 IdM replica or SSSD against a small LDAP; sudo tied to groups |
| Directory HA | Replicated IdM or LDAP, DNS NS pairs, documented Kerberos KDCs | Two identity-aware hosts; fail one and still authenticate |
| Sites / network | Split DNS, routed subnets, jump hosts, no SSH from the internet to app VMs | Two VLANs/subnets, one bastion, nftables or firewalld zones |
| Privilege | No daily root; sudoers by group; separate break-glass account | Named sudo group, root login disabled, a jump box |
| PKI | Internal CA, TLS on every listener, automated renewal | 1 lab CA; HTTPS on the reverse proxy; SSH CA optional |
| Compute | KVM/libvirt, Proxmox, or cloud instances; optional Kubernetes later | 2 KVM guests plus one container host (Podman or Docker) |
| File / data | NFS or Samba with backups; databases on their own nodes | NFS export or dedicated disk; PostgreSQL with a tested restore |
| Patch | Staging then production; unattended-upgrades or dnf-automatic with a window | A pilot VM, then the rest; reboot policy written down |
| Security | SELinux or AppArmor enforcing, auditd, SSH keys only, SIEM shipping | Enforcing MAC, sshd_config hardened, journald + one alert script |
| Hybrid / DR | 3-2-1 backup (restic/borg), off-host copies, written RPO/RTO | Backup to a second disk; restore a VM and a database |
| Ops | Change notes, runbooks, node exporter / logs, on-call lite | One-page runbook and a “proxy or IdM down” drill |
Architecture discussion first, then a lab that matches the diagram, scaled down. Week 12 is a drill, not a slide recap.
What lives on a bastion versus an app node. Why identity, DNS, and backups are not guests on the web VM.
Units, timers, journald, persistent logs, and how to prove a service is actually running.
DNS, search domains, split horizon, firewall zones, and a jump host.
sudoers, no root login, sshd_config, optional SSH CA, and a break-glass account.
LVM, mount options, quotas idea, and snapshots versus real backups.
FreeIPA or SSSD+LDAP, groups for sudo, what breaks when the replica is down.
Internal CA, reverse-proxy certificates, and expiry as an incident type.
Nginx/Caddy, PostgreSQL, NFS or a dedicated data disk, least-privilege service users.
Podman or Docker Compose, volumes, logs, and not treating compose as a cluster.
Ansible for repeatable boxes, update rings, reboot windows.
SELinux/AppArmor denials, auditd, restic/borg restore of a VM and a database.
Draw the architecture, then a 30-minute incident: proxy or IdM is gone and the database backup must work.
A bastion, DNS, a proxy, a database, two subnets, and a backup disk that you actually restore. Snapshots are not backups.
| Piece | Role |
|---|---|
| Host | Linux with KVM/libvirt, or a hypervisor you already know (including Hyper-V) |
| BASTION | Jump host: SSH only, sudo, Ansible control node |
| DNS1 | Lab DNS; optional second resolver later |
| IPA1 | FreeIPA / identity replica (can start as local users + SSSD stub) |
| WEB1 | Reverse proxy (Nginx or Caddy) and TLS |
| APP1 | Application VM or container host |
| DB1 | PostgreSQL on its own disk |
| Networks | Two subnets: management and application |
| Backup | Separate disk or NFS; restore is the proof, not the job status |
