EPCST · Management Information Systems
Operations Handbook
How the campus network, labs, identity, and applications actually run — written so anyone on the team can fix it, not just the person who built it.
Something is broken → start here
> **Log it before you fix it.** Every change to firewall rules, GPOs, DNS, or Conditional Access goes in the [change log](/ops/change-log) — even the ones you're about to undo. Half of our repeat incidents are someone else's forgotten change.
{.is-warning}
# Systems
## Network
- [OPNsense overview *Interfaces, gateways, firewall rule sets, backup export*](/net/opnsense)
- [VLAN and IP plan *Segment map, DHCP scopes, what lives where*](/net/vlan-ip-plan)
- [Unbound DNS *Resolver config, overrides, and the SafeSearch setting that filters YouTube campus-wide*](/net/unbound-dns)
- [Omada wireless *Controller, SSIDs, AP placement, adoption process*](/net/omada)
- [Multicast and IGMP *igmpproxy rules, snooping on Omada, cross-VLAN floods*](/net/multicast)
{.links-list}
## Identity and accounts
- [Entra Connect *Hybrid sync from epcst.local, scheduler, sync errors*](/identity/entra-connect)
- [Account lifecycle *Creating, disabling, and offboarding staff and students*](/identity/account-lifecycle)
- [Conditional Access *Current policies, break-glass account, admin portal block*](/identity/conditional-access)
- [Duplicate account merges *Merge-EntraDuplicates.ps1 and when to run it*](/identity/duplicate-merges)
- [Group Policy catalogue *What each GPO does, where it's linked, who owns it*](/identity/gpo-catalogue)
{.links-list}
## Labs and endpoints
- [WDS deployment *Zero-touch multicast imaging over VLANs, end to end*](/labs/wds-deployment)
- [WinPE boot image *Build process, diskpart/DISM/bcdboot scripts*](/labs/winpe-image)
- [Lab software catalogue *What's installed on each lab, and how it got there*](/labs/software-catalogue)
- [Laragon dev stack *Per-user setup with NTFS junctions*](/labs/laragon)
- [Warden *Fleet agent and dashboard — deployment and troubleshooting*](/labs/warden)
{.links-list}
## Applications
- [Enrollment system *Laravel app, cashier module, deployment and env*](/apps/enrollment)
- [Staff dashboard *Dashy config and how to add a tile*](/apps/dashy)
- [Hosting and deployments *Coolify, Nixpacks, environment variables*](/apps/hosting)
- [ID capture tool *Signature cleaning, photo capture, backend endpoint*](/apps/id-capture)
{.links-list}
## Operations
- [Runbook index *Every "when X breaks, do Y" procedure in one list*](/ops/runbooks)
- [Backup and restore *What's backed up, where, and how to prove it works*](/ops/backup-restore)
- [Restore test log *Quarterly restores — date, system, result, who ran it*](/ops/restore-tests)
- [Change log *Chronological record of every production change*](/ops/change-log)
- [Maintenance calendar *Patch windows, semester breaks, enrollment freeze dates*](/ops/maintenance-calendar)
{.links-list}
## Hardware and facilities
- [Asset inventory *Servers, switches, APs, lab PCs — serials and locations*](/assets/inventory)
- [Server room *Rack layout, port map, cooling, physical access*](/assets/server-room)
- [Power and UPS *Load, runtime, shutdown order during brownouts*](/assets/power)
- [Vendors and support *Contacts, contract numbers, escalation paths*](/assets/vendors)
{.links-list}
# Escalation
| Situation | First response | Escalate to |
| --- | --- | --- |
| Campus network down | On-duty IT assistant | MIS Director |
| Student or staff data at risk | Stop, do not proceed | MIS Director immediately |
| Suspected account compromise | Disable the account, then report | MIS Director |
| ISP or vendor fault | Log ticket with reference number | Vendor support, cc MIS Director |
{.dense}
> **No credentials in this wiki.** Passwords, API keys, connection strings, and recovery codes belong in the team password vault — never in a page, never in a screenshot, never in the change log. Link to the vault entry by name instead.
{.is-danger}
# Writing pages here
A page earns its place if someone can follow it at 10pm without calling anyone. Practical rules:
- **Write for the person who wasn't there.** Name the exact menu, path, hostname, and command. "Check the firewall" is not a step.
- **Runbooks are numbered steps, not prose.** Start with the symptom, end with how you confirm it's fixed.
- **Record the why.** The reason a rule exists is the part nobody can reconstruct later.
- **Date anything that will drift.** Version numbers, IP addresses, and vendor procedures go stale silently.
- **Fix it while you're here.** If a page was wrong, correct it before you close the ticket.
> New page? Copy the [runbook template](/ops/templates/runbook) or the [system overview template](/ops/templates/system-overview) so pages stay consistent.
{.is-info}