Systems Modernization Roadmap

May 2026

FTP cutover · Server 2016 upgrades · WatchFileShare replacement · SSIS sign-off · VMware security

Critical FTP / SFTP OWS-14896/97/98/99/14902

ftp1 — complete remaining SFTP client guides, client testing, final cutover, decommission ftp1 VM

4 of 5 guides past due from April 30: ciss_nonprodsor, ciss_prodsor, apprissmobile, myOVC, kcummings. Get client sign-off, confirm SFTP working, pull the ftp1 RHEL 5 VM off Apps-Prod.

Shawn

Critical SSIS OWS-14633 · Due May 21

SSIS — test new packages against SFTP server, client sign-off, close epic

Packages for apprissmobile, kcummings, ciss done. Run final validation against new SFTP server. dev-ssis01 still on Server 2016 — close SSIS epic before upgrading OS.

Erin Hamilton

High OS Upgrade OWS-13390

Server 2016 → 2019: owdc03, owsql01, dev-ssis01, sql-gisdb03

4 remaining 2016 VMs — lower risk, appropriate for May. sql-db01/02 are larger and scheduled for July/August. sql-gisdb03 also needs Erin to coordinate DB side.

ShawnErin (sql-gisdb03)

High WatchFileShare ProjectSend → Nextcloud

Stand up Nextcloud instance, plan MSSQL client account migration

Evaluate Azure-hosted vs lp-con cluster. MSSQL backend has thousands of client accounts — test auth method (LDAP or import), stand up instance, begin small-batch user testing. Full cutover in June.

ShawnTravis

Medium Containers sinc1/sinc2 — Oct deadline

NCIC MQ containerization — progress check, confirm Oct 1 shutdown on track

7 IBM MQ clients moving to lp-con cluster. Verify container builds, test MQ connectivity. sinc1/sinc2 are the most dangerous EOL VMs in the fleet (2008 R2, 7800+ MHz CPU). This is the longest dependency chain.

ShawnDev team

Medium Security OWS-15219 — overdue

VMware security updates — overdue from April 30, push immediately

Critical given VMware EOL trajectory and hypervisor decision coming in August. Keep the platform patched in the interim.

Shawn

Medium OWS-13650 · Due May 30 OWS-15280 — overdue

Remote VMs 15–23 → Win11 · Portainer LDAP auth

Travis owns Win11 remote upgrades. Portainer LDAP was due April 2 — quick win, Portainer Business already installed, just add LDAP integration.

Travis (Win11)Shawn (Portainer)

June 2026

App server OS/code · GIS planning · SQL upgrades · Nextcloud cutover · CentOS/RHEL remediation

Critical App servers · PHP OWS-15345 · Due Jun 30

RHEL 5 app VMs — OS rebuild + PHP 5.4/7.3 → PHP 8.x (app2, app3)

Small VMs (2 vCPU/4GB/22GB) — easy to rebuild. PHP upgrade is the hard part. Dev team owns code, Shawn/Travis own OS. Must be complete before Oct 1 hard deadline.

ShawnDev team

Critical GIS / Map stack

GIS map stack — scope rewrite + plan OS migration: mappy (2008 R2), map1/map2 (RHEL 6)

Flagship sex offender registry application. mappy is 2008 R2 EOL urgent. Dev team scopes rewrite this month, new OS targets ready. Execution in July. This has the least runway of any rewrite task.

ShawnDev team

High SQL OWS-14654 · Due Jun 25 OWS-14655 · Due Jun 13

SQL upgrades — sql-gisdb02/03, portaldb01/02

sql-gisdb03 still on Server 2016 — double priority. Portal DBs: confirm decommission plan before upgrading since portal app is being retired.

Erin Hamilton

High SQL OWS-14647/48/50

SQL upgrades — uat-PAPI, uat-PortalDB01, uat-wsdb01

UAT SQL chain — knock out together while UAT environment is stable. Confirm portal DB decommission plan first.

Erin Hamilton

Medium WatchFileShare

Nextcloud — migrate MSSQL client accounts, complete user testing, cut over from ProjectSend

Instance stood up in May. Test batch migration with 50–100 accounts first. Confirm auth working at scale before cutting over thousands of client accounts.

ShawnDev team

July 2026

GIS execution · 2008 R2 EOL · NCIC container milestone · Production SQL

Critical Containers · Oct dependency

sinc1/sinc2 — all 7 NCIC MQ clients containerized on lp-con, begin shutdown validation

Oct 1 means July is the last safe month to complete containerization. Leave Aug/Sep as buffer. If any MQ client isn't stable in container by July 31, escalate and add resources immediately.

ShawnDev team

Critical GIS / EOL

mappy (2008 R2) + map1/map2 (RHEL 6) — deploy rewritten code to new OS, UAT test

Flagship sex offender registry. Dev team executing rewrite scoped in June. July = deploy to new VMs, UAT testing. New OS targets provisioned before cutover. map VMs are 4 vCPU / 160GB.

ShawnDev team

High EOL · Web-Prod

report1 / report2 — migrate off Server 2008 R2 (web-facing, 200GB each)

Web-Prod exposed EOL VMs. Dev team owns code rewrite, Shawn/Travis own OS migration. Plan storage migration carefully. Must be off 2008 R2 by Oct 1.

ShawnDev team

High EOL · Server 2012

ws-web01 (Web-Prod) + wt-web01 (UAT) — Server 2012 migration

ws-web01 running 648 MHz CPU — active production load. Migrate to 2019/2022. Dev team confirms app compatibility first.

ShawnDev team

Medium SQL OWS-14651/52/56

SQL upgrades — sql-svndb01/02, sql-wsdb01/02, sql-dist01 + Papi AG

Due mid-July. Papi AG is an availability group — needs coordinated failover with a maintenance window. Plan carefully with Erin.

Erin Hamilton

August 2026

sql-db01/02 · sinc shutdown prep · MySQL migration · Hypervisor decision

Critical SQL · OWS-14657

sql-db01/02 upgrade — largest SQL servers in fleet, full maintenance window required

sql-db01: 10 vCPU / 64GB RAM / 4.3TB disk / 15,382 MHz avg CPU. Highest-risk upgrade in the fleet. Fix sql-db02 VMware tools first. Full UAT validation before production. All hands on deck.

Erin HamiltonShawn

Critical Containers · sinc1/sinc2

All 7 NCIC MQ clients validated in containers — write decommission runbook, schedule Oct shutdown

All clients must be stable. Document who signs off on shutdown. No surprises in September. October 1 is the non-negotiable cutoff.

ShawnDev team

High Hypervisor · OWS-14929 Epic due Aug 14

Hypervisor modernization decision — Proxmox vs XCP-ng vs Azure IaaS, budget approved

Comparison already done (OWS-14933). August = leadership decision + budget approval + first pilot node. This feeds the 2027 Azure migration. Hardware (Cisco UCS/Nimble/ExaGrid) retires 2027.

Shawn

Medium SQL · MySQL OWS-14660

MySQL migration — mysql1, dev-mysql01, lt-uat-mysql01 → new MySQL server, decommission old VMs

All 3 on RHEL 5 EOL OS. New MySQL server task already done. Migrate data, validate, decommission. Coordinate with Erin on schema compatibility.

ErinShawn

Cleanup OWS-6368 · Snapshots

Can_I_Watch stale tables · Clean open snapshots (IssueTrak Apr 16, VPX02 Mar 31)

VPX02 snapshot on 8-NIC network appliance is high risk — divergent network state on rollback. Delete immediately. IssueTrak snapshot: commit or delete. OWS-6368 due July 31, slip to Aug.

Erin (DB)Shawn (snapshots)

September 2026

Final buffer · sinc shutdown · EOL sweep · Azure TCO · Hypervisor pilot

Oct 1 Deadline

sinc1/sinc2 — execute shutdown. All 7 NCIC MQ clients confirmed running on lp-con.

This is the finish line for the biggest EOL risk in the fleet. All clients live in containers, monitoring confirmed, sinc1/sinc2 powered off and removed from inventory.

ShawnDev team

Oct 1 Deadline

Full EOL sweep — confirm zero remaining EOL systems across entire fleet

mappy · sinc1/sinc2 · report1/2 · ws-web01 · wt-web01 · wt-reports01-old — all decommissioned. Run PowerCLI inventory script, confirm clean. Present to leadership.

Shawn

High Azure TCO

Azure cost analysis — like-for-like migration TCO, present to leadership for 2027 plan

All upgrades complete, inventory clean. Run Azure Migrate against fleet. Right-size VMs. Build TCO: on-prem cost vs Azure (pay-as-you-go, 1-yr reserved, 3-yr reserved + Hybrid Benefit). Justifies 2027 hardware retirement.

Shawn

Medium SQL · OWS-14635 · OWS-8919

SQL stored proc optimization — OWL API, NCIC/NCIC_Boost queries

All SQL upgrades done by now. Optimize workloads on new versions. NCIC queries especially relevant now that NCIC clients are containerized and Python scripts are modernized.

Erin Hamilton

Medium Hypervisor · OWS-14929

Hypervisor pilot — first non-VMware node live, 2–3 low-risk VMs migrated

Decision in Aug, pilot in Sept. Test on low-risk VMs (sheriffalertsupdate, trac). Validate before committing full fleet in 2027.

Shawn

Cleanup OWS-1355 · lp-sa-con01

OWS-1355 SQL replication epic (2020) — close or rescope · lp-sa-con01 CentOS 7 exception doc

OWS-1355 has an expired due date from 2025. Close it or create a new scoped ticket. lp-sa-con01 is CentOS 7 EOL — if not remediated, document as tracked exception with plan.

Erin (SQL)Shawn (lp-sa-con01)

Risk register

Items that can cause the Oct 1 deadline to slip or cause a production incident

Critical path

sinc1/sinc2 containerization — if dev team slips, Oct 1 is at risk

7 MQ clients, 4 devs, complex Python rewrites. Longest dependency chain in the plan. Track weekly. If behind by end of June, escalate and add resources. Dev team also has GIS rewrite and PHP upgrades in parallel — this is Priority 1.

Critical path

GIS rewrite (mappy + map1/map2) — both code rewrite AND OS migration required before Oct 1

Flagship sex offender registry app. Dev team owns the rewrite. If GIS code isn't ready, new OS doesn't help. Scope in June immediately — least runway of any rewrite task. Must not slip to August.

Watch

sql-db01 — 15,382 MHz CPU avg, 4.3TB, production. Upgrade failure = outage.

Highest-risk single upgrade in the fleet. Needs full maintenance window, tested rollback plan, and UAT validated before touching production. Schedule as a standalone event in August with full team on standby.

Watch

sql-db02 — VMware tools NOT installed. Flying blind on a 64GB SQL server.

No VMware guest visibility on a 10 vCPU / 64GB production SQL server. Install VMware tools immediately — before any upgrade work starts on this VM. This should happen this week.

Watch

PHP 5.4/7.3 → PHP 8 — 4 devs, multiple apps, tight timeline alongside NCIC + GIS

Dev team priority order: (1) NCIC containers — Oct hard deadline, (2) GIS rewrite — Oct hard deadline, (3) PHP upgrades, (4) Nextcloud support. If bandwidth is insufficient, escalate to management now.

Monitor

VPX02 snapshot (Mar 31) on 8-NIC network appliance — clean immediately

Open snapshot on your core network appliance. If it fails and rolls back to March 31 state, your network configuration diverges. Delete or commit this snapshot this week — do not let it sit.

Monitor

Nextcloud MSSQL user migration — thousands of client accounts, external-facing

Test batch migration with 50–100 accounts before cutting over all clients. Confirm auth method (LDAP, SAML, or manual import) works at scale. A botched cutover affects all client file sharing.

EOL systems

All must be decommissioned or migrated by October 1, 2026

VM name	OS	Network	Specs	Status	Action
sinc1	Server 2008 R2	Apps-Prod	4 vCPU / 12GB / 680GB · 7,856 MHz avg	EOL urgent	NCIC MQ → containerize to lp-con. Shutdown Oct 1.
sinc2	Server 2008 R2	Apps-Prod	4 vCPU / 12GB / 550GB · 7,775 MHz avg	EOL urgent	NCIC MQ → containerize to lp-con. Shutdown Oct 1.
report1	Server 2008 R2	Web-Prod	4 vCPU / 14GB / 200GB · 199 MHz avg	EOL urgent	Code rewrite + OS migrate. July target.
report2	Server 2008 R2	Web-Prod	4 vCPU / 14GB / 200GB · 278 MHz avg	EOL urgent	Code rewrite + OS migrate. July target.
mappy	Server 2008 R2	Servers-Prod	4 vCPU / 6GB / 400GB · 98 MHz avg	EOL urgent	GIS rewrite (scope Jun, deploy Jul). New OS target.
wt-reports01-old	Server 2008 R2	UAT-Prod	2 vCPU / 10GB / 140GB · POWERED OFF	EOL urgent	Powered off — just decommission. Easy win.
ws-web01	Server 2012	Web-Prod	2 vCPU / 4GB / 200GB · 648 MHz avg	EOL urgent	OS migrate to 2019/2022. App compat check. July.
wt-web01	Server 2012	UAT-Prod	2 vCPU / 4GB / 120GB · 140 MHz avg	EOL urgent	OS migrate to 2019/2022. UAT environment. July.
lp-sa-con01	CentOS 7	Apps-Prod	2 vCPU / 4GB / 300GB · 1,815 MHz avg	EOL — Jun 2024	Migrate to Rocky 9 or containerize. Or document exception.
map1	RHEL 6	Apps-Prod	4 vCPU / 6GB / 160GB · 130 MHz avg	EOL	GIS rewrite (scope Jun, deploy Jul). New OS target.
map2	RHEL 6	Apps-Prod	4 vCPU / 6GB / 160GB · 93 MHz avg	EOL	GIS rewrite (scope Jun, deploy Jul). New OS target.
ftp1	RHEL 5	Apps-Prod	2 vCPU / 4GB / 230GB · active snapshot Feb 2026	EOL urgent	Client SFTP cutover May. Decommission after all clients confirmed.

By owner

Weekly standup reference — who owns what, month by month

Shawn Burke — infrastructure lead

MAYVMware security updates · 2016 OS upgrades (owdc03, owsql01, dev-ssis01) · WatchFileShare/Nextcloud setup · FTP cutover · Portainer LDAP

JUNRHEL 5 app server OS rebuilds · GIS new OS targets provisioned · Nextcloud cutover · NCIC container milestone check

JULmappy/map1/map2 OS migration · report1/2 OS · ws-web01 OS · ftp1 decommission confirmed

AUGsql-db01/02 support · sinc shutdown prep + runbook · hypervisor decision · VPX02/IssueTrak snapshot cleanup

SEPsinc1/sinc2 shutdown execution · full EOL sweep + PowerCLI confirm · Azure TCO report · hypervisor pilot

Travis McAdams — infrastructure

MAYRemote VMs 15–23 → Win11 (OWS-13650, due May 30)

MAY–JUNWatchFileShare / Nextcloud standup support

JUN–JULApp and web server OS rebuild support alongside Shawn

Erin Hamilton — SQL

MAYSSIS packages final validation + client sign-off (OWS-14653, due May 21)

JUNsql-gisdb02/03 (due Jun 25) · portaldb01/02 (due Jun 13) · uat-PAPI · uat-PortalDB · uat-wsdb01

JULsql-svndb01/02 · sql-wsdb01/02 · sql-dist01 + Papi AG (availability group — maintenance window)

AUGsql-db01/02 upgrade (critical — full maintenance window) · MySQL data migration · Can_I_Watch cleanup

SEPOWL API optimization · NCIC/NCIC_Boost query optimization · OWS-1355 close or rescope

Dev team — 4 developers

P1NCIC MQ containers — 7 IBM MQ clients → lp-con. Must be done July. sinc1/sinc2 shutdown Oct 1.

P2GIS rewrite — mappy/map1/map2. Scope June, build June–July, deploy July. Flagship app — cannot miss.

P3PHP 5.4/7.3 → PHP 8 — app2, app3, remaining app servers. June–August.

P4Nextcloud MSSQL support — user migration and auth testing. May–June.

Azure roadmap

2027 target · Hardware retirement · Cost analysis planned for September 2026

Current state

On-premise infrastructure running on Cisco UCS blades, Nimble SAN, ExaGrid backup, VMware vSphere. No plans to invest further in on-prem hardware. All network hardware (ASA 5525-X, Nexus 9K, etc.) will not be renewed. Goal is to exit on-prem by 2027.

Azure migration plan — 2027

After Oct 1 remediation is complete, the fleet will be clean and modernized. September 2026 Azure TCO analysis will right-size VM equivalents across compute, storage, SQL managed instances, and networking. Factors to include: pay-as-you-go vs 1-year reserved vs 3-year reserved pricing, Azure Hybrid Benefit for existing Windows Server + SQL Server volume licenses, and Nextcloud as an Azure-hosted candidate.

Key workloads for Azure assessment

Production SQL cluster (sql-db01/02 — 10 vCPU/64GB/4TB), NCIC MQ containers on lp-con cluster, GIS map stack, portal and web tiers, SSRS/SSIS reporting stack, Veeam backup workloads, and the Nextcloud replacement for ProjectSend. Azure SQL Managed Instance is the likely target for the SQL fleet. AKS or Azure Container Apps for the NCIC MQ containers.

Action items before TCO can run

1. Complete all Oct 1 remediation so inventory is clean and accurate.
2. Install Azure Migrate appliance in September for discovery.
3. Confirm SQL Server edition/version details across fleet (companion WMI script pending).
4. Get actual on-prem cost data: power, cooling, datacenter space, licensing, support contracts.
5. Confirm Hybrid Benefit eligibility with volume licensing team.