// about
My name is Endre — most people know me online as Endi, but I prefer Andy. I've been working with technology since 2015, and I run EndreEndi Services out of Bucharest, Romania.
I help people and businesses with everyday IT problems — slow computers, broken networks, Wi-Fi dead zones, security cameras, data backup. The kind of things that shouldn't be complicated but somehow always are.
But I also do something most local IT technicians don't: I design and build infrastructure. Identity systems, virtualization platforms, secure networks, private AI setups — the kind of work that usually requires a team of engineers. I do it independently, and I do it properly.
I don't just fix problems — I design the infrastructure that prevents them.
// how I think
Most technology problems aren't isolated. A slow network, an unreliable server, a security gap — they're usually symptoms of a deeper design issue. I focus on understanding the entire system, not just patching the part that broke today.
That means when I fix something, it stays fixed. And when I build something, it's designed to be reliable, documented, and maintainable by someone other than me.
I also believe in testing before recommending. I run a personal infrastructure lab where I design, break, and rebuild the same technologies I deploy for clients. Proxmox clusters, identity systems, firewalls, AI stacks — if I suggest it, I've run it myself first.
Technology solutions should not be based on theory. They should be based on operational experience.
// the journey
First steps into IT — building, fixing, and understanding how computers and networks work from the ground up.
Started my own IT support business in Bucharest. Computer repair, networking, and technical help for individuals and small businesses. Still running it today.
Completed the Cisco Networking Academy program. Started treating security as a discipline, not just a checklist.
Instructor and website administrator for ClimbAgain, a Romanian paraclimbing NGO with a team composed mostly of people with disabilities. Helped where I could, when I was needed.
Full-time IT technician role. Hardware installation, troubleshooting, and hands-on experience in a professional IT environment in Bucharest.
Earned the CPP and WordPress Toolkit certifications from cPanel University. Web hosting and server management.
Full-time field technician at Hemmersbach, a global IT infrastructure services company operating in 190+ countries. Onsite hardware and software troubleshooting, deployments, data center support, and enterprise IT maintenance — delivering for major technology manufacturers and global system integrators.
Active Directory, Group Policy, IBM Cybersecurity Fundamentals. Built the homelab into a full production-grade environment with Proxmox, FreeIPA, Zitadel, and OPNsense.
Monitoring with alerts and an independent watchdog, backups with an offline copy and tested restores, written runbooks for updates and recovery, and several migrations done without losing data.
Working full-time at Hemmersbach while running EndreEndi Services on the side. Local IT support for homes and shops in Bucharest. Remote infrastructure consulting for technical teams worldwide.
// what I work with
// what I've built
Everything below is real work, in an environment of about 25 services that I designed and run day to day — monitored, backed up, documented and kept up to date the way a business would expect. If I recommend something to a client, I've already run it, broken it and fixed it.
Proxmox VE on ZFS: Linux containers and virtual machines, Linux and Windows guests, and hardware acceleration passed through to containers for video and AI work. A second server stands by, ready to restore services from backup. Linux every day — Debian, Ubuntu, RHEL-based, Alpine, Arch — plus Windows Server and Windows 11.
One central identity for every machine and app: directory, Kerberos, DNS and an internal certificate authority, with about 30 machines enrolled. Web apps sign in through OpenID Connect, older apps over encrypted LDAP. Group membership decides who can use each app, the VPN or a server shell — take someone out of a group and that access is gone within minutes.
Firewall and router on a fibre line, with wired and Wi-Fi devices on separate networks, DHCP with reserved addresses, and internal DNS. Remote access through a VPN that needs both a certificate and a password, limited to an approved group. Managed switching with encrypted SNMPv3 monitoring. Public services go out through Cloudflare tunnels, or through a cloud server that passes the encrypted traffic straight through to my own hardware.
Every service is backed up under a retention policy, copied off-site to the cloud, and copied again to a detachable offline disk that no sync job can touch — every copy checked against checksums. Restores are tested on a second server, because a backup you've never restored is only a hope. Firewall settings are saved separately, and firewall updates start from a snapshot that can be rolled back.
Servers, containers, network gear and public endpoints are all watched, with alerts sent to my phone and to a chat channel. A watchdog on a separate machine raises the alarm if the monitoring itself goes quiet. One notification per incident instead of alert storms, and a daily check of the software I run against the public list of actively exploited vulnerabilities (CISA KEV).
Least privilege by default: accounts that only need the VPN get no shell anywhere, and every app connects with its own limited account. Encryption by default — internal certificates on services, encrypted LDAP and SNMPv3, and no plain-text protocols for anything new. Internal apps that only open for a valid client certificate and the right group. Management interfaces never face the internet, and third-party software is reviewed before it goes in — anything that phones home without asking gets blocked.
Updates rolled out across the whole environment from a written runbook: backup first, a check after every step, and a safe place to stop if something looks wrong. Migrations done without losing data — a Windows file server rebuilt on Linux, apps moved off Docker to native services, a Git server moved to a new platform with every repository, key and access token carried over, and DHCP moved to a supported server. Every repeatable job has a written guide, kept current in a private knowledge base.
Deployed and connected a wide range of self-hosted apps — Git hosting, chat, end-to-end encrypted messaging, a photo library with hardware-accelerated search, home automation, remote desktop and PDF tools — and wired them into central sign-in, certificates, monitoring and backups.
Hands-on with the hardware too: network card swaps planned so remote access survives the restart, faulty memory diagnosed from the kernel's own evidence, SSD health and wear tracked, and Thunderbolt links between machines measured at 17 Gbit/s.
// certifications
Completed courses from Cisco, IBM, Udemy, Hemmersbach, and others. Click any certificate to view the original PDF or verify it.
// what I believe
If I can't fix it, you don't pay.
No fix, no fee. Simple as that.
Good technology shouldn't require a corporate budget.
Small businesses and individuals deserve the same quality of infrastructure that large companies get.
Documentation is not optional.
Everything I build comes with clear documentation. If I get hit by a bus, someone else should be able to understand your system.
Your infrastructure should be under your control.
I prefer solutions where you own the system. Self-hosted, documented, transparent — not locked into someone else's platform.
// let's talk
Whether it's a broken Wi-Fi or a Proxmox cluster — I'm happy to help.