Engineering school · ESEO · 2024 – 2025
Production-grade on a student budget
A platform for the school's apprentices and their tutors. As team lead and platform owner, I designed, automated and secured its Azure infrastructure on student credits.
- Role
- Team lead and platform owner
- Team
- 6 students, Scrum (Scrum Master for one sprint)
- Duration
- 2024 – 2025
- Stack
- Azure · Terraform · Ansible
Best project
of the 2025 class, still the school's reference
Under €20
a month for the whole platform, on three student accounts
20 min
to bring the platform back after a failure
01 · The need
Build a complete information system for apprentices, companies and tutors, worthy of a critical production environment. The best team presents its project at the school's open days.
02 · Constraints and decision
- Constraints
- Cloud · Azure only, on the student offer of $100 a year per account
- Budget · a cost as close to zero as possible
- Security · professors attacking both the software and the architecture
- Run · a platform the IT department can take over easily
- Options
- Research · days reading the Azure free and student offers, to find what costs nothing
- Sprint 1 · three accounts linked by peering, with a 20-minute recovery
- Sprint 2 · high availability, with a load balancer splitting traffic with a backup server, a replicated database and a fourth account. Reviewed as too costly, not eco-friendly enough and too complex for the need
- Sprint 3 · back to three accounts, with the recovery copy switched off until it is needed
- Storage · Blob Storage at €18.20 per TB a month, against €42 for a disk
- Decision
- Network · three accounts linked by peering, so student data never crosses the internet
- Frontend · behind a load balancer, protected by ModSecurity, Let's Encrypt and CrowdSec
- Backend · Docker, with a private managed PostgreSQL
- Access · a Teleport bastion with MFA, the only way in for SSH
- Security · CrowdSec rules against DDoS, bad bots, Tor and brute force on Apache and SSH, access rights per user, ISO 27001 and GDPR rules applied
- Delivery · Terraform and Ansible deploy everything in one click, GitHub Actions builds, tests and ships every change, images kept in a private Docker Hub
- Preproduction · one hybrid machine to test every release before production
- Recovery · an identical architecture kept switched off, started only when needed
- Backups · copied to Blob Storage, beyond the 7 days of the free tier
- Monitoring · Prometheus, Grafana and Alertmanager, with clear rules (85% usage, 15 minutes down) sent to Discord
- Costs · every account tracked in Azure cost analysis, to keep the forecast under budget
- Handover · technical documentation on GitHub, so the IT department can take over
03 · Architecture
Infrastructure
Network flows
Azure
Terraform
Ansible
Docker
GitHub Actions
PostgreSQL- CrowdSec
Teleport
Prometheus
Grafana
04 · Result
A platform that ran in production for under €20 a month, demonstrated at the school's open days, elected best project of the 2025 class and still shown by the school as its reference.
05 · What I learned
It consolidated what I practiced at Alfa-Safety, but with the opposite goal: in a company, you look for the best functional solution; here, I had to find the cheapest one that still met every need. It showed me what makes a good information system, and pushed me to deliver work I am proud of.
Next case study
Medical AI training · 2025 – 2026An HPC platform researchers actually use