Project Polaris
VestLux Financial Group. A multi site hybrid enterprise, designed to be built and documented in public, one week at a time.
This is a self directed project, not a client engagement. A realistic financial sector environment built to prove real capability rather than collect certificates. Every architecture decision, runbook, and weekly log entry is published as the work actually happens.
Designed architecture
Six layers, one lab
Why hub and spoke
Shared security, identity and monitoring services live once, in the Azure hub. Every site connects to the hub and not to each other, so adding a site means adding one link.
ExpressRoute for head office
The head office carries the regulated workload, so it gets a private, predictable connection that does not cross the public internet.
VPN for the branches
Branches connect over site-to-site VPN. Brussels is the standard case. Kigali is built with higher latency and lower bandwidth on purpose, to practise a realistic remote office.
Identity
Active Directory plus Entra Connect, Conditional Access, and PIM across all sites, governed centrally through Azure Policy.
Network
A hub and spoke Azure network connecting a Luxembourg head office, a Brussels branch, and a Kigali representative office over site to site VPN.
Compute
Two virtualisation platforms by design. Hyper-V at head office, legacy VMware at the branch, with a written assessment of moving the VMware workload to Azure.
Security
Two firewall vendors, Check Point at head office and FortiGate at the branch, Microsoft Sentinel as the central monitoring and response platform, and controls mapped to NIS2, DORA, GDPR and ISO 27001.
Resilience
Azure Backup and Site Recovery, tested against a real recovery time and recovery point target, not just configured and left untested.
Automation
The environment defined as code using Bicep and Terraform, with an automated process to build and publish changes.
Follow the project
Every update, decision, and weekly log entry, published live, not polished after the fact.