Senior DevOps, Cloud Infrastructure Architect and Systems Integrator (DigitalOcean, GitLab, Grafana)

# Integrated Private Cloud Infrastructure Project ## 1. Project overview This project will design, build, integrate and validate a secure private-cloud infrastructure supporting the organisation’s websites, business applications, communications systems, accounting, customer management, project management, software development, geographic information services, device management and operational data. The project will deliver a hybrid architecture combining: * iPage-hosted public web services; * scalable DigitalOcean Droplets for application and data workloads; * a dedicated authoritative data server; * a separate management and failover environment; * a local Synology NAS for private storage, synchronisation and backup; * Google Workspace for email, organisational identity and selected application authentication; * OpenVPN for secure connectivity between geographically distributed servers, devices and users. The objective is not merely to install individual software packages. The applications must operate as an integrated business platform with controlled data exchange, shared authentication where appropriate, central monitoring, reliable backups, tested recovery procedures and documented operational ownership. Examples of required integration include: * connecting Manager.io with Saudi ZATCA electronic-invoicing requirements; * connecting Mattermost with Jitsi, Taiga and GitLab notifications; * connecting SuiteCRM with email, telephony, project and accounting workflows; * connecting QGIS Server with PostgreSQL and PostGIS; * connecting GitLab CI/CD with the web and application deployment environments; * connecting all servers, authorised devices and the Synology NAS through OpenVPN; * monitoring application, server, database, backup and security status through Grafana; * ensuring that the application server receives only the data required for its functions rather than unrestricted access to the full data environment. --- ## 2. Project scope The project includes: * infrastructure architecture and technical design; * server provisioning and operating-system preparation; * network segmentation and secure connectivity; * database and data-access architecture; * application installation and configuration; * API, notification and workflow integration; * monitoring and security tooling; * backup and recovery configuration; * failover preparation and testing; * user, administrator and service-account configuration; * technical and operational documentation; * functional, integration, security and recovery testing. The project does not assume that installing an application makes it operationally or legally compliant. For example, Manager.io installation alone does not establish ZATCA compliance. The required regulatory integration, certificates, invoice formats, reporting processes and middleware must also be assessed, implemented and tested. --- ## 3. Delivery milestones The project will be delivered through five controlled milestones. Each milestone must be reviewed and accepted before the following phase is treated as complete. ### Milestone 1: Approved architecture blueprint The first milestone will define and approve: * the final server architecture; * the placement of each application; * the data flows between systems; * the private-network design; * the security and monitoring model; * the backup and failover strategy; * the application integration matrix; * the required environments for development, testing and production; * the acceptance criteria for each phase. The milestone will be complete when the architecture, data-flow, security, monitoring and integration designs have been reviewed and approved. ### Milestone 2: Operational infrastructure foundation The second milestone will establish: * provisioned and hardened servers; * configured operating systems; * private networking and firewall rules; * databases and service accounts; * Docker and container environments where appropriate; * reverse proxies and TLS certificates; * Synology connectivity; * initial monitoring, logging and backup services; * development, test and production environments. The milestone will be complete when all servers communicate through the approved network, the data server is inaccessible from the public internet, monitoring is operational and a test backup has been successfully restored. ### Milestone 3: Core operational applications The third milestone will install, configure and integrate: * Mattermost; * Grafana; * Manager.io; * Jitsi Meet; * Taiga; * Asterisk and FreePBX. The milestone will include business-workflow testing, not merely installation checks. For example: * Mattermost must send notifications and launch Jitsi meetings; * Manager.io must support the required accounting workflow and have a defined ZATCA integration route; * Taiga must support project and sprint operations; * FreePBX must complete internal, inbound and outbound test calls; * Grafana must detect and report controlled service failures. ### Milestone 4: Development, CRM, VPN, device management and GIS The fourth milestone will install or configure: * GitLab CI/CD; * OpenVPN; * SuiteCRM; * Miradore; * QGIS Server. The milestone will be complete when: * code can be deployed through a controlled GitLab pipeline; * authorised devices can access permitted internal systems through OpenVPN; * CRM workflows function across customer, project and communication processes; * representative devices are enrolled and controlled through Miradore; * QGIS Server publishes approved spatial services from PostGIS data. ### Milestone 5: Security, failover and operational acceptance The final milestone will validate: * patching and vulnerability management; * access control and least-privilege permissions; * server and application monitoring; * encrypted backups; * database and application restoration; * web, application, data and VPN failover; * incident-response and recovery procedures; * final technical and administrator documentation. The project will not be considered complete until recovery and failover have been demonstrated through testing. --- ## 4. Required skill sets The project requires a combination of infrastructure, software, security, networking, data and business-system skills. It should not be assigned solely to a general web developer or server administrator. ### Infrastructure and Linux administration Required capabilities include: * Linux server installation and hardening; * user, permission and service management; * SSH administration; * firewall configuration; * storage and filesystem management; * operating-system patching; * performance tuning; * troubleshooting and recovery. ### Cloud and VPS engineering Required capabilities include: * DigitalOcean Droplet architecture; * iPage VPS administration; * DNS and domain configuration; * public and private IP addressing; * snapshots and provider-level backups; * server scaling; * high-availability and failover planning; * cost and resource optimisation. ### Network engineering Required capabilities include: * VPN design and OpenVPN configuration; * routing between multiple providers and locations; * subnet and firewall design; * secure remote administration; * SIP and RTP network configuration; * bandwidth and latency assessment; * network monitoring and troubleshooting. ### Container and application-platform engineering Required capabilities include: * Docker and Docker Compose; * container networking; * persistent volumes; * reverse proxies; * TLS certificate management; * resource allocation; * container security; * upgrade and rollback procedures. ### Database and data engineering Required capabilities include: * PostgreSQL; * PostGIS; * MariaDB; * database-user and permission design; * replication and backup; * point-in-time recovery; * query and performance monitoring; * data segregation; * API and data-service design; * high-frequency cache and event-stream design. ### Cybersecurity Required capabilities include: * server and application hardening; * least-privilege access; * identity and access management; * security logging and monitoring; * vulnerability scanning; * secrets management; * TLS and certificate management; * backup security; * incident response; * security testing and remediation. ### DevOps and CI/CD Required capabilities include: * GitLab administration; * repository and branch controls; * GitLab Runner configuration; * automated testing; * container build pipelines; * staging and production deployment; * credentials and secret protection; * rollback and release management. ### Monitoring and observability Required capabilities include: * Grafana; * Prometheus; * Loki or equivalent log aggregation; * Alertmanager; * operating-system and database exporters; * application-health checks; * alert escalation; * dashboard design; * capacity and performance analysis. ### Application integration and API engineering Required capabilities include: * REST APIs; * webhooks; * OAuth and Google Workspace identity; * SMTP and notification integration; * data mapping; * middleware design; * workflow automation; * error handling; * integration testing; * synchronisation and duplicate-data prevention. ### Specialist application knowledge The project also requires knowledge of: * Mattermost; * Manager.io; * Jitsi Meet; * Taiga; * Asterisk and FreePBX; * SuiteCRM; * Miradore; * QGIS Server; * Synology DSM and Synology Drive. ### Saudi accounting and ZATCA integration Manager.io integration requires specialist knowledge of: * Saudi VAT; * ZATCA Phase 1 and Phase 2 requirements; * electronic invoice structures; * invoice XML formats; * QR-code requirements; * Cryptographic Stamp Identifiers; * compliance and reporting APIs; * invoice clearance and reporting workflows; * onboarding and certificate management; * accounting-data validation. This work may require a separate ZATCA integration specialist if the selected Manager.io extension does not provide complete compliance. ### Telephony and real-time communications Jitsi and FreePBX require knowledge of: * VoIP; * SIP; * RTP; * NAT traversal; * STUN and TURN; * call routing; * SIP trunks; * IVR; * voicemail; * call-quality monitoring; * video-conferencing bandwidth and latency. ### GIS engineering QGIS Server requires knowledge of: * QGIS project preparation; * PostgreSQL and PostGIS; * WMS, WFS and related geospatial services; * coordinate reference systems; * spatial-data permissions; * map-service performance; * caching and publication controls. --- ## 5. Project roles Depending on the available internal expertise, one person may undertake several roles. However, responsibility for each area must be clearly assigned. | Role | Main responsibility | | ----------------------------- | -------------------------------------------------------------- | | Project sponsor | Approves scope, budget and strategic decisions | | Project manager | Coordinates phases, dependencies, milestones and acceptance | | Solution architect | Owns the overall architecture and integration design | | Cloud and Linux engineer | Provisions and administers the servers | | Network and security engineer | Designs VPN, firewalls, access controls and security | | Database engineer | Configures databases, permissions, replication and recovery | | DevOps engineer | Implements GitLab CI/CD and automated deployments | | Integration developer | Connects applications, APIs, webhooks and workflows | | Application specialists | Configure individual business platforms | | ZATCA specialist | Validates and implements electronic-invoicing compliance | | GIS specialist | Configures QGIS Server and PostGIS workflows | | Test and quality lead | Manages functional, integration, security and recovery testing | | System administrator | Takes responsibility for ongoing operation after handover | --- ## 6. Project dependencies The project depends on the availability of: * administrator access to iPage and DigitalOcean; * control of the required domains and DNS; * Google Workspace administrator access; * Synology NAS hardware and sufficient storage; * approved server specifications and budget; * SIP trunk and telephone-provider information; * ZATCA registration and onboarding information; * Manager.io business configuration and invoice requirements; * existing website and application source code; * GIS datasets and QGIS project files; * a list of intended users, roles and access levels; * agreed backup-retention and recovery requirements; * representative devices for Miradore testing. Delays in these dependencies may delay the corresponding milestone. --- ## 7. Project governance The project should use formal phase-gate approval. At the end of each phase: 1. Deliverables will be reviewed. 2. Functional and technical tests will be completed. 3. Security and documentation issues will be recorded. 4. Outstanding risks will be identified. 5. Acceptance or corrective action will be agreed. 6. The next phase will proceed only when critical dependencies are satisfied. A change-control process will be used for significant changes to: * architecture; * application selection; * server providers; * data flows; * security requirements; * ZATCA scope; * user numbers; * failover objectives; * project budget. --- ## 8. Overall success criteria The project will be successful when: * public websites, applications and databases are separated; * the data server is not exposed publicly; * each application accesses only the data it requires; * the high-frequency cache contains limited, rebuildable data; * all selected applications complete their intended business workflows; * required integrations operate reliably; * Manager.io has a documented and tested ZATCA compliance route; * Google Workspace continues to provide email and identity where required; * authorised devices and servers communicate securely through OpenVPN; * Synology storage and backup are integrated; * all critical systems are monitored; * backups are successfully restored; * failover procedures are tested; * administrators receive complete operational documentation; * ongoing ownership, patching and support responsibilities are assigned. The following sections describe the final architecture and the detailed work required within each of the five project phases.