A private cloud built to be secured, not only to run
My MSc thesis infrastructure. Apache CloudStack 4.22 over KVM on a Dell PowerEdge R710, with the identity, certificate and network work that turns a working lab into a defensible one.
- When
- 2025 to present
- Context
- MSc thesis, FCUL
- Hardware
- Dell PowerEdge R710, Ubuntu 24.04
- Platform
- Apache CloudStack 4.22 over KVM
The problem
Standing up a private cloud is a solved problem. Standing one up that you would be willing to hand to other people, on a network you do not fully control, is not. The thesis question is what a small department actually has to do to run its own cloud infrastructure safely, and the lab is where I find out by doing it.
The platform
Apache CloudStack 4.22 as the orchestration layer, KVM as the hypervisor, Ubuntu 24.04 underneath, all on a single Dell PowerEdge R710. Old hardware, which is useful, because it forces every decision to be justified by something other than spare capacity.
Identity
Local accounts on a hypervisor do not scale and cannot be audited. The lab integrates LDAP through FreeIPA so that identity lives in one place, accounts can be disabled once rather than eight times, and access decisions are made against a directory instead of against whoever remembers who left.
Certificates
I run my own PKI with a root certificate authority rather than scattering self-signed certificates and teaching everyone to click through the warning. That means issuing certificates to the management interfaces and the internal services, and distributing the root so that a browser warning goes back to meaning something is wrong.
Network segmentation
VLANs separate management traffic, guest instance traffic and storage. The value is not the configuration, it is the assumption behind it, which is that any one segment will eventually be compromised and the blast radius has to be decided in advance.
Privileged access
Administrators need a way in that does not mean exposing SSH to everything. I evaluated Apache Guacamole against JumpServer as the privileged access layer, weighing how each handles session recording, credential brokering and how much of an attack surface the gateway itself becomes.
What I took from it
- Identity, certificates and segmentation are the three things that are painful to add later and cheap to add first.
- A private cloud is not one system, it is several trust boundaries that happen to share a chassis.
- Running the infrastructure yourself is the only way to find out which parts of the documentation quietly assume a team.