Services

Fries Consulting Services, LLC (FCS) provides IT infrastructure consulting to non-profits, charter schools and small businesses. This page sets out what we do, the technologies we work in, who we take on, and how to get started.

Network audit and documentation

A network audit produces a complete picture of your network: every device on it, how those devices connect, which VLANs they sit on, what access each one has, and where switch and firewall configuration has quietly drifted from intent. The documentation that comes out of it is yours to keep. Automated reporting comes with it too, so that new devices surface as they appear rather than accumulating unnoticed.

This is the right starting point when nobody can confidently answer “what is on our network,” when documentation was never written in the first place, or when a recurring problem has resisted every attempt at diagnosis.

Schools get more out of it still, ending up with a defensible picture of the 1:1 device fleet, of how student and guest traffic is separated, of what slips past the content filter, and of where the E-Rate Category Two equipment actually ended up.

Our network audit write-up describes one such engagement in detail, including how the documentation we gathered went on to solve an unrelated VLAN and multicast failure days later.

E-Rate funding and CIPA compliance

We have worked both sides of E-Rate: planning what to spend it on, and filing to get it in the first place.

Spending. Category Two covers internal connections — switching, wireless access points, cabling, and the rest of the equipment that moves traffic inside your buildings — against a per-student budget spread over a five-year cycle. Getting real value out of that means reading the eligible services list before you design the network rather than after, and sequencing purchases so that none of the budget is left stranded at the end.

Category One covers the broadband circuit itself, where the questions are contract term, bandwidth sizing, and whether what you are being sold actually matches what you need.

Filing. The application cycle is procedural and unforgiving from competitive bidding through to certification, and the deadlines do not move for anyone. We produce the technical documentation the process demands: service descriptions precise enough to bid against, equipment lists mapped to eligible categories, and the supporting detail PIA review asks for.

CIPA compliance. E-Rate discounts are conditional on CIPA, and we have both implemented it and enforced it. In practice that means a technology protection measure that blocks what the statute actually requires, an internet safety policy that matches what the filter does day to day, monitoring of minors’ online activity, and a documentation trail standing behind the certification you sign.

One failure mode turns up more than any other: a filter configured years ago, never reviewed since, and no longer matching either the written policy or the current threat picture. That is a funding risk as much as a safety one.

This work pairs naturally with a network audit, since the device and topology documentation an audit produces is most of what a Category Two request needs anyway.

Private cloud design and build

We design and build private clouds on Proxmox VE backed by Ceph distributed storage, which gets you clustering, live migration, VM-level high availability, and storage that survives the loss of a node — all of it running on hardware you own, with no per-VM hourly billing attached.

We size the cluster against the workloads you actually run, specify the hardware and networking, build it, and hand the whole thing over documented.

For non-profits and schools this is frequently the highest-leverage project on the table, because it converts a licensing and hosting bill that grows every year into a capital purchase made once. Our private cloud write-up works through a real three-node example with itemized costs, set against what the equivalent compute would cost in the cloud.

VMware to Proxmox migration

Broadcom’s acquisition of VMware repriced virtualization out of reach for a great many smaller organizations. Proxmox VE is a credible destination: KVM-based, open source, immediately recognizable to anyone who has run vSphere, and far less restrictive about what hardware it will tolerate.

We handle cluster design, VM migration, backend storage and backup strategy. Our Proxmox write-up sets out our position on the migration generally, and on the backup question in particular.

Infrastructure monitoring and alerting

We build monitoring on Grafana, InfluxDB, Prometheus and Telegraf, designed around a single principle we call alerting with purpose: an alert should fire only when somebody actually needs to act on it.

In practice that means percentage-based thresholds rather than absolute ones, suppression during backups and patch windows, and metrics chosen because they predict problems rather than because they happened to be easy to graph.

Monitoring is also a record. When your ISP’s support desk asks for evidence, historical latency and throughput data is the difference between a ticket and an argument. See our monitoring write-up.

AWS architecture and cost optimization

We work in AWS, and we will tell you plainly when AWS is more than you need. The work covers architecture review, right-sizing, spend analysis, and security configuration review — the questions that matter once an account has grown organically for a few years and nobody is quite sure what is running or why.

Cost is usually where this starts. Untagged resources cannot be attributed to anything, unattributed spend never gets cleaned up, and the bill grows for reasons nobody can reconstruct. For a fuller treatment see Streamlining Your AWS Account, and for the question of whether you need a hyperscaler at all, Do you really need a hyperscaler?.

Infrastructure as code

We implement infrastructure as code with Pulumi and Terraform, which puts your environment into version control and turns every change into a pull request somebody can review before it ships. The same definition reproduces the environment in a second region or a fresh account, and recovers it after a mistake. That is the difference between a cloud account that merely accumulates and one you can reason about. See our infrastructure as code write-up.

IT asset inventory

Asset inventory keeps a current record of hardware and software, tied to the people responsible for it, with automated reports flagging whatever changed.

Schools running 1:1 Chromebook or laptop programs get the most out of this: devices tie back to students, changes surface without anyone chasing them, and at inventory time you have a real answer rather than a spreadsheet nobody quite trusts.

It also answers the two questions that always arrive at the worst possible moment — what appeared on our network in the last 24 hours, and what is the authoritative list of authorized devices. See our inventory write-up.

Automation and custom integration

We automate the repetitive work that quietly consumes staff hours: combining and processing documents, moving data between systems and spreadsheets, batch file operations, scheduled reporting, and API integrations between applications that were never designed to talk to one another.

We also automate software that offers no API at all. One recent engagement took on a reporting application with no scheduling or export capability whatsoever, which we ended up driving through its own interface — several hundred hours a year handed back to the client. See our automation write-up.

Server architecture, installation and configuration

We specify, install and configure the servers you run on, physical or virtual: Windows Server and Active Directory, MSSQL and reporting services, SMB file services and Linux servers.

Hardware purchase recommendations come with that, sized against what you actually need rather than what a vendor quote suggests, as does desktop imaging so that workstation builds are repeatable instead of hand-assembled one at a time.

Kubernetes and CI/CD pipelines

We set up and support Kubernetes clusters, containerize applications with Docker, and build GitHub Actions pipelines so that builds, tests and deployments happen without anyone typing commands at the wrong moment.

This is really infrastructure as code applied to the deployment path: the process is defined, reviewable, and identical on every run.

Data analysis and visualization

Most organizations already collect the data that would answer their operational questions; what they lack is any practical way to look at it. We build dashboards and scheduled reports against your existing systems, each one aimed at a specific question somebody actually needs answered, rather than producing charts nobody opens twice.

Ransomware recovery operations

If you are dealing with an active ransomware incident, reach us through the contact form and mark it urgent. We monitor it and will respond quickly.

Schools, districts and non-profits are targeted disproportionately, because attackers know that valuable records and a one-person IT department tend to go together. If that describes you, do the backup and recovery design work described below before you need it rather than after.

Recovery work begins with scoping the blast radius and establishing what is genuinely clean, then moves through restoring from backup, rebuilding compromised infrastructure, and closing the gaps that allowed the intrusion in the first place.

Afterward we design the strategy that makes a second event survivable: offline or immutable copies, restores that have actually been tested, and monitoring tuned to catch the early signals rather than the aftermath.

Technologies we work in

Virtualization and storage: Proxmox VE, VMware vSphere/ESXi, Hyper-V, Ceph, Unraid
Cloud: Amazon Web Services (AWS), DigitalOcean
Infrastructure as code, containers and CI/CD: Pulumi, Terraform, Docker, Kubernetes, GitHub Actions, Python, PowerShell, Bash
Monitoring and observability: Grafana, Prometheus, InfluxDB, Telegraf
Networking: VLAN design and segmentation, multicast and inter-VLAN routing, managed switching across vendors, Ubiquiti UniFi, firewall configuration, structured network documentation
Servers and services: Windows Server, Active Directory, MSSQL, SMB file services, Linux server administration, desktop imaging

Who we work with

Non-profits, charter schools and small businesses of up to roughly 50 staff — organizations that depend heavily on their infrastructure but have no reason to employ a team to run it.

Non-profits and K-12 schools are a major part of the practice, and a charter school is our largest ongoing client. Working with non-profits and schools below covers what that looks like day to day.

Small businesses make up the rest, across professional services, trades, and light industry.

Two situations are common in both:

No dedicated IT staff. We act as the infrastructure team, making the architecture decisions, building the systems and documenting them, then staying available afterward.
An internal IT department that needs a specialist. Your team runs daily operations while we come in for one project — a Proxmox migration, a monitoring build, a network audit — and leave documentation behind so your staff owns it once we are gone.

We are a small practice, which means you work directly with the person doing the work.

Working with non-profits and schools

Non-profit and K-12 work is not simply commercial work with a smaller budget attached. The constraints are structurally different, and a consultant who ignores them tends to create problems rather than solve them.

Budgets are fixed in advance, and often restricted. Money approved for one purpose frequently cannot be moved to another, and a recurring subscription is a considerably harder approval than a one-time purchase. We scope to that reality and are direct about total cost of ownership before you commit rather than after.
License costs compound against a budget that does not grow. This is the biggest lever available to us. Proxmox, Ceph, Grafana and Prometheus carry no per-VM, per-socket or per-seat licensing anywhere in the stack. Our private cloud write-up prices a real three-node cluster at roughly $4,950 against what the equivalent compute costs annually in the cloud, and that arithmetic is what turns a recurring line item into a one-time one.
The calendar is not negotiable. Schools have genuine maintenance windows — summer, breaks, after hours — and everything outside them is production with students in the building. We plan cutovers around the academic calendar rather than asking you to accept downtime during instruction.
The IT department is often one person. Documentation is not something we tack on at the end; it is most of the point. Everything we build is handed over documented, so that neither your staff nor whoever eventually replaces them is dependent on our memory.
Student and donor data carries obligations. Student records, donor information and payment data each come with their own handling requirements, and we build segmentation, access control, backup and retention with those in mind. Where something falls outside our lane and needs counsel or a specialist, we say so plainly.
Funding compliance is infrastructure work. For schools, E-Rate and CIPA are not paperwork happening somewhere adjacent to the network. The filtering, the documentation and the equipment bought with Category Two money are the same systems we are already building and auditing.
You have to be able to show your work. Boards, auditors and funders all ask for evidence, and the documentation and monitoring we build produce that record as a matter of course, so answering never turns into a scramble.

Schools and non-profits are also disproportionately targeted by ransomware, for the straightforward reason that valuable data and lean IT staffing tend to travel together. See ransomware recovery operations below.

Service area

On-site work covers the Denver metro and Northern Colorado, including Denver, Fort Collins, Loveland, Greeley, Longmont, Boulder and the surrounding region. Remote engagements run anywhere in the United States, and a good deal of this work is remote as a matter of course, AWS architecture and infrastructure as code especially.

How engagements work

Most work is project-based, with a defined scope, a fixed deliverable and documentation at the end of it. Typical projects include a network audit, a private cloud build, a VMware migration, a monitoring rollout or an automation project.

Ongoing advisory and monitoring support is available once we have completed a first project together and know your environment.

Every engagement begins with a scoping conversation, in which we establish what the problem actually is, what the deliverable ought to be, and whether we are the right people for it — all of that before any work is committed.

For non-profits and schools we are used to working against a budget calendar rather than a blank cheque. Sometimes that means scoping to a figure that has already been approved, sometimes phasing work across fiscal years, and sometimes producing the cost detail you need to take to a board or into a funding application.

Frequently asked questions

Do you work with non-profits and schools?
Yes. It is a major part of the practice, and a charter school is our largest ongoing client. We plan around restricted budgets, funding cycles, academic-calendar maintenance windows, and lean IT staffing. We lean on open-source infrastructure to keep recurring license cost off your budget.

Can you help with E-Rate?
Yes, on both sides. On spending, we plan Category One and Category Two purchases against eligible services and per-student budgets. On filing, we handle competitive bidding and the application cycle, plus the technical documentation PIA review asks for.

Can you get us CIPA compliant?
Yes. We implement and enforce CIPA. That covers content filtering that meets the technology protection measure requirement, an internet safety policy matching what the filter actually does, monitoring of minors’ online activity, and the documentation behind the certification you sign. It is a prerequisite for keeping E-Rate discounts.

Do you offer non-profit rates?
We scope to the budget that exists. Tell us what you have and what you need to accomplish. We will tell you honestly what is achievable within it, and what is not.

Do you work with clients outside Colorado?
Yes. On-site work is Denver and Northern Colorado. Remote engagements run anywhere in the United States. Cloud, infrastructure-as-code, monitoring, and automation projects are routinely delivered entirely remotely.

Do you work with companies that have no IT staff?
Yes, it is one of our two most common engagement types. We act as the infrastructure team. Everything is handed over documented, so you are never dependent on anyone’s memory.

Will you work alongside our existing IT department?
Yes. Many engagements are exactly that. Your team handles daily operations. We deliver a project they lack the bandwidth or specialist depth to take on, then hand it over documented.

We are trying to get off VMware. Can you help?
Yes. VMware to Proxmox migration is an active part of our practice. It covers cluster design, storage, VM migration, and backups.

Can you help us reduce our cloud bill?
Yes. AWS cost optimization covers right-sizing, spend analysis and architecture review, together with the tagging that makes spend attributable in the first place. Where the honest answer is moving workloads somewhere smaller or back on-premises, we will tell you that too.

What does an engagement cost?
It depends on scope. We quote per project after a scoping conversation rather than publishing a rate card. Send us your situation through the contact form and we will tell you what it would take.

How do we start?
Use the contact form. Tell us your current environment, the problem you are solving, and your timeline.

Contact

Contact form: friesconsulting.services/contact Service area: Denver and Northern Colorado on-site; United States remote