Loading...
Stability-First Infrastructure
Infrastructure that behaves.
Stable, documented, and recoverable. The way it should have been built the first time.
How an engagement runs
Discovery
Assessment
Plan
Implement
Validate
Handoff
Matthias Goodman · Phoenix, AZ
Fixed-fee turnkey handoff. Hybrid vSphere, Azure Arc, and immutability.
7Services
$4KStarting
25+Years
Strategic Fit
Built for teams who own their infrastructure.
Expertise that transfers. Your team gets stronger, not more dependent. Healthcare, manufacturing, professional services, and multi-site operations across Arizona and beyond.
A good fit
- Teams running hybrid vSphere and Azure with untracked configuration drift
- Medical offices, specialty practices, and clinics with HIPAA compliance gaps
- Operators who require verified evidence that backup recovery paths actually work
- Leaders who need a fixed-fee scoped plan before committing to infrastructure change
Not a fit
- Commodity 24/7 helpdesk or desktop support queues
- Emergency break-fix without root-cause remediation
- Engagements focused on temporary patches without understanding architectural failure points
Selected work
Work from real engagements.
Real engagements. Anonymized details.
INC-2025-SQL-340
DATA INTEGRITY // SQL BACKUPSymptom
Daily backup jobs reported green status in the legacy MSP management portal.
Root cause
VSS SQL Writer failed silently after an unrecorded maintenance reboot 340 days prior. Backups were capturing empty database pointer stubs while transactions accumulated without truncation.
What changed
Re-registered SQL VSS writer, provisioned an isolated Veeam hardened Linux repository with immutable flags, executed cold restore simulations to a verification host, and scheduled automated weekly integrity test runs.
Verified Recovery Target
340 Days Silent Loss→15-Min RPO / 2-Hr RTO Verified
INC-2024-VMW-EXIT
HYPERVISOR // BROADCOM EXITSymptom
Broadcom contract renewal required a 300% fee increase with a mandatory per-core licensing shift.
Root cause
Legacy SAN architecture and vSphere dependencies were coupled to proprietary VMDK snapshots without a documented export or hypervisor conversion pipeline.
What changed
Scoped and tested non-disruptive Proxmox VE clustering on existing Dell PowerEdge hardware. Re-architected storage pools to native Ceph and migrated 42 production VMs over two weekend maintenance windows with zero data loss.
Annual Overhead Reduction
300% Fee Escalation→65% Net Licensing Savings
INC-2024-AZR-SPRAWL
CLOUD GOVERNANCE // COST DRIFTSymptom
Azure monthly invoice climbed from $4,200 to $9,800 over 14 months without headcount or patient volume growth.
Root cause
Orphaned managed disks from decommissioned patient portal test nodes, unattached public IPs, and non-reserved SQL instances running 24/7 without tagging or cost-center ownership.
What changed
Audited every cloud resource against clinic billing codes, decommissioned $2,800/month of unattached storage, reserved baseline SQL capacity, and enforced Azure Policy locks preventing unbudgeted instance provisioning.
Monthly Cloud Run Rate
$9,800 / month→$5,100 / month (-$4,700/mo)
Principal
Boring Monday mornings.
I design for predictable operations, not heroic 3 AM recoveries.
I am Matthias Goodman. For over 25 years, I have stabilized hybrid systems, built landing zones, and designed recovery architecture for organizations across Arizona.
After a decade as the sole IT leader taking a regional healthcare group from peer-to-peer networking and paper charts to a fully integrated VMware datacenter across 21 sites and 250+ employees with zero external consultants, I now work as a specialized partner for teams who own their systems. Current projects include stabilizing their entire digital platform (Next.js multi-brand architecture with SEO, localization, and patient portals), leading patient communication API integrations, and evaluating portal upgrades while working side-by-side with their internal team.
I run this practice without sales reps, junior handoffs, or artificial retainers. I audit your dependencies, eliminate configuration drift, verify recovery paths in a sandbox, transfer clear documentation to your team, and exit.
Phoenix, AZ
How I work
A short, repeatable process designed for low-risk change.
Discovery
CompleteDefine outcomes, constraints, and risk surface.
Assessment
CompleteMap dependencies, drift, and operational gaps.
Plan
CurrentClear tradeoffs and phased implementation paths.
Implement
NextSmall, reversible steps with validation.
Validate
NextRestore testing, cutover checks, stability verification.
Handoff
NextDocs, diagrams, and runbooks you can operate.
What changes.
Monday mornings where nothing is on fire. A team that handles what comes next without calling for backup.
01Manufacturing, 200 users
Zero
unplanned incidents
From 3AM pages to planned maintenance
Stabilize vSphere and hybrid dependencies so your team stops firefighting and starts operating.
02Professional services, 85 users
4hr
verified RTO
Backups that actually restore
Quarterly restore tests with documented results. Not assumptions that fail when it matters.
03Healthcare, 150 users
100%
baseline coverage
Security that doesn't require heroics
Hardening baked into the baseline, so compliance checks become routine instead of scrambles.
04Healthcare, 150 users
30min
avg onboarding
Runbooks your team will actually use
Clear ownership boundaries and documented procedures that survive staff turnover.
Services
Focused services, real-world delivery.
Project-led work for teams that need stability now and a clear modernization path.
vSphere Stabilization & Drift Control
Your vSphere environment drifted from its baseline and nobody noticed. I map the dependencies, score the risk, and hand you a runbook so your team can keep it from drifting again.
$2,500.00
- Environment map + dependency topology
- vSphere config baseline (Drift Checklist)
- Health score with prioritized remediation
- Configuration audit report
- Runbook for ongoing drift detection
Reversible Migration Engineering
Migrations fail when someone skips the dependency map and hopes for the best. I move workloads in phased waves with a rollback path at every stage. If something breaks, I roll back. No drama.
$2,500.00
- Pre-migration network and dependency mapping
- Phased "wave" execution planning
- Reversible "parallel run" architecture
- Explicit rollback runbooks
- Cutover validation
Proof of Recovery Architecture
Your backups run every night. Have you ever restored from one? I run the restore test, document the RTO and RPO, and hand you the proof that your recovery plan actually works.
$2,000.00
- Formal backup environment audit
- Documentation of RTO and RPO metrics
- Executed restore tests (sandbox)
- Disaster recovery runbook creation
- Immutable storage verification
Azure Guardrails & Governance
Azure spending tripled and nobody can explain why. I set up the guardrails: policy baselines, RBAC, cost alerts, and a landing zone your team can build on without creating the next mess.
$2,500.00
- Management group hierarchy and subscription topology
- Azure Policy baselines (CIS, NIST, custom)
- RBAC role design and Entra ID integration
- Cost Management budgets and anomaly alerts
- Landing zone accelerator deployment
- Tagging taxonomy and enforcement
- Resource naming convention automation
- Governance documentation and runbooks
IT Provider Collaboration
I work alongside your existing IT team.
Project-scope work your MSP or internal IT doesn't have bandwidth for. Migration engineering, backup redesigns, drift remediation. Everything goes back to your team with full documentation.
01
Your MSP maintains. I stabilize.
Ongoing support stays with your team. I come in for scoped projects with clear start and end dates.
02
White-glove handoff.
Architecture docs, runbooks, and validated configs your team can own and operate from day one.
03
90% of our engagements involve an existing IT provider.
I have built the process around clean collaboration, not competition.
Credibility
Proof you can verify, not logos you can't call.
What I actually deliver, and what it looks like when it works.
01
Landing zone guardrails
Azure foundations aligned to Microsoft CAF so your cloud does not become another source of drift.
02
Immutable recovery
Veeam immutability plus quarterly restore testing. Untested backups are not verified backups.
03
Operational handoff
Runbooks and ownership boundaries that survive staff changes and reorgs.
Engagement Snapshots
Manufacturing, 200 users
Weekly → Quarterly
Reduced unplanned downtime from weekly incidents to quarterly maintenance windows. Their team stopped dreading Mondays.
Professional services, 85 users
Unknown → 4hrs
First successful restore test in 3 years. Recovery time dropped from unknown to 4 hours.
Healthcare (21-site Group)
Active
Stabilizing their Next.js multi-brand platform, leading patient communication API integrations, and evaluating portal upgrades while collaborating with their internal team.
From the Notes
Brownfield
The BAA Chain Nobody Audited
A small medical practice relayed patient appointment requests through a five-year-old pipeline nobody had traced. When I...
Strategy
The Cheapest Compliant Architecture Isn't a Product
Small practices spend five figures a year on BAA-covered vendor stacks to move appointment requests around. Some of thos...
Engineering
HIPAA, Analytics, and the End of the Ad-Hoc Portal
How recent and upcoming HIPAA regulations force fundamental engineering changes across web analytics, shared logins, and...
Direct Technical Scoping
Schedule an infrastructure scoping session.
Direct conversation with Matthias Goodman, Principal Infrastructure Architect. Review current topology, downtime risks, or licensing renewals. Zero sales reps or junior discovery calls.
Choose a starting point
How this works
Zero sales reps. Direct contact with principal architect.
Explicit fixed-fee pricing with zero surprise hourly overages.
Complete documentation and runbook handoff. Zero consultant dependency.