Business Units

It is by "who is responsible when something breaks, and which layer you start looking at".

The network is down, calls cannot get through, the data centre has lost power, a hosted server has stopped, a container cluster is misbehaving, a system service has been interrupted — to the customer all six are simply "broken", but the paths for diagnosing them are entirely different. Business units exist so that every kind of failure has a clear first owner and a clear handling document, rather than leaving customers to guess whom to call.

At the same time the six units do not operate in isolation. Cross-domain failures are the most time-consuming kind — the network looks fine, the host looks fine, yet the service will not connect, and the problem often sits at the boundary between two domains. Shared architecture documents, equipment inventories and change records let cross-domain diagnosis proceed from one common set of facts.

Responsible for the backbone, regional and management network systems, covering external line access, BGP routing, inter-zone interconnection, VLAN planning, firewall policy, VPN, network segment configuration management, domains and DNS, along with certificate issuance and rotation. Equipment spans MikroTik routers, Dell EMC and D-Link switches, Extreme switches and OPNsense firewalls.

The hardest part of network operations is not entering the configuration but knowing what the configuration currently is, and why it was set that way. Segments, VLANs, routes and allowlists are all managed from a single source, with device configuration generated from that source by automation rather than typed in device by device.

The management network is fully isolated from the backbone and regional networks — even if the backbone comes under attack, affected equipment can still be handled through the management network.

Responsible for external line access, leased line services, inter-site interconnection and enterprise communications, covering internet access, enterprise leased lines, site-to-site connections, cloud PBX, voice and video communications, and the measurement and assurance of communication quality.

The value of telecom services is barely noticed day to day; it is noticed only during the few minutes of an outage. Operations therefore centres on two things: redundancy design, where every layer of line, route and equipment has an explicitly defined failover path; and measurement, continuously tracking latency, packet loss and availability so that problems are handled before the customer notices them.

Responsible for racks, power, cooling, physical equipment, virtualisation platforms and storage facilities. Virtualisation uses both VMware vSphere and Proxmox VE, divided by workload characteristics; storage is tiered by purpose across Ceph distributed storage, TrueNAS, QNAP and Synology, with the storage network segmented by equipment type and consuming platform.

The most underestimated part of data centre operations is simply knowing what assets exist. A live asset inventory is maintained keyed on physical equipment codes and mapped one-to-one onto host names in the virtualisation platform, so that the rack, site and role can be derived from the code alone.

Responsible for customer-side server hosting, cloud servers, database hosting, application hosting and storage hosting. Customers are carried in zones according to scale and requirements; customer databases and storage are consolidated in the hosting zone rather than built separately in each environment.

The core promise of hosting is isolation. Anything claimed as "customers cannot see one another" must be actually tested before it goes into a service agreement — the tests include whether a scoped credential can list another party's resource names and whether it can read another party's data. If a test fails, the isolation granularity is made coarser, rather than treating a design expectation as fact when promising it to customers.

Responsible for container clusters, image registries, continuous integration and deployment pipelines, observability facilities and message pipelines. Container orchestration uses Kubernetes; images are tagged with a version identifier and pinned by digest, and third-party official images are pinned to the upstream version and digest, never to a floating tag.

A further responsibility is keeping "the service is running" and "the service is actually being used" distinct. Caches, queues and monitoring share one characteristic: when they break they do not stop the service, they merely degrade quietly. The acceptance criterion is therefore not "the application is still alive" but the connection count and traffic at the other end — no output is a fault, even without an error message.

Responsible for OS baselines, host initialisation, backup and restore, security baselines and periodic inspection. Debian is the standard operating system, with exception categories listed item by item in the documentation together with their reasons.

The exception list is itself a means of control. The rule is that an exception must state its reason and its scope, and the scope must be written narrowly. Once an exception's reason is written as "this is more convenient", the list grows without end — and once the list is long, the standard itself ceases to mean anything.