My Kubernetes cluster managed with ArgoCD.
| Device | Name | Specs | OS | Role |
|---|---|---|---|---|
| Lenovo ThinkCentre M75q-2 | homelab2 | Ryzen 5 Pro 5650GE (6 core / 12 threads) / 24GB RAM / 256GB + 2TB SSD | NixOS | k8s controller+worker node |
- Kubernetes cluster deployed with k0s
- GitOps deployment with ArgoCD and Helm
- Simple flat directory structure: argocd-apps contains ArgoCD applications deploying umbrella Helm charts in k8s-apps
- Fully automated HTTPS exposition using cert-manager, external-dns and traefik
- Authentication of sensitive apps with PocketID as a passkey-only OIDC provider
- WAF using ModSecurity plugin and some hacks
- Secrets management with external-secrets, OpenBao and sops (check terraform for provisioning method)
- Offsite data backup using Velero and Backblaze B2
- Easy Backblaze-to-disk backup synchronization with Kopia
- PostgreSQL database management with CloudNativePG
- Observability with Prometheus, Grafana, Loki and Opentelemetry Collector
- Alerting with Alertmanager and a Telegram Bot
- Thorough HTTP / PostgreSQL status checks with go-healthcheck and Gatus
- Automated updates with Renovate (even linuxserver images!)
- Scale to zero using Sablier
- Any app you'd want to host: Nextcloud, Immich, Paperless-ngx and more (see below)
workbench/ is where self-hosted programs are developed. Each
subdir holds source code, a Dockerfile, and a build.yaml. On commit, ArgoCD
renders a Kaniko Job that builds the image and pushes it to the in-cluster
registry — ready to deploy from k8s-apps/. See
workbench/README.md.
This is an automatically updated list of the apps I have configured and/or deployed. Click on an app to check its Helm configuration.
| App | Description | Is deployed |
|---|---|---|
| anki-sync-server | Sync server for AnkiDroid | ❌ |
| anubis | Weighs the soul of incoming HTTP requests to stop AI crawlers | ✅ |
| argocd | Declarative, GitOps continuous delivery tool for Kubernetes | ✅ |
| arr-stack | Arr Stack | ✅ |
| attic | Multi-tenant Nix Binary Cache | ❌ |
| audiobookshelf | Self-hosted audiobook and podcast server | ✅ |
| blackbox-exporter | Allows blackbox probing of endpoints over HTTP, HTTPS, DNS, TCP, ICMP and gRPC | ❌ |
| calibre-web | Web app for browsing, reading and downloading eBooks stored in a Calibre database | ❌ |
| cert-manager | Automatically provision and manage TLS certificates in Kubernetes | ✅ |
| changedetection | Website change detection, web page monitoring, and website change alerts | ✅ |
| cloudnative-pg | CloudNativePG is a comprehensive platform designed to seamlessly manage PostgreSQL databases within Kubernetes environments, covering the entire operational lifecycle from initial deployment to ongoing maintenance | ✅ |
| cnpg-restore-test | Daily CNPG backup restore verification | ✅ |
| convertx | Self-hosted online file converter | ✅ |
| disk-usage-exporter | Per-directory disk usage Prometheus exporter for local-path volumes | ✅ |
| external-dns | Configure external DNS servers (AWS Route53, Google CloudDNS and others) for Kubernetes Ingresses and Services | ✅ |
| external-secrets | External Secrets Operator reads information from a third-party service like AWS Secrets Manager and automatically injects the values as Kubernetes Secrets | ✅ |
| falco | Cloud Native Runtime Security | ❌ |
| firefly | A free and open source personal finance manager | ✅ |
| gitea | Self-hosted Git service with a lightweight code hosting solution written in Go | ✅ |
| go-healthcheck | Simple HTTP healthchecks | ✅ |
| home-assistant | Open source home automation that puts local control and privacy first | ✅ |
| homepage | A highly customizable homepage (or startpage / application dashboard) with Docker and service API integrations | ❌ |
| httpbin | Echoes request data as JSON | ✅ |
| immich | High performance self-hosted photo and video management solution | ✅ |
| it-tools | Collection of handy online tools for developers | ✅ |
| kube-prometheus-stack | kube-prometheus-stack collects Kubernetes manifests, Grafana dashboards, and Prometheus rules combined with documentation and scripts to provide easy to operate end-to-end Kubernetes cluster monitoring with Prometheus using the Prometheus Operator | ✅ |
| lastfm-scrobble-deduplicator | Periodically delete duplicate Last.fm scrobbles | ✅ |
| local-path-provisioner | Utilize the local storage in each node | ✅ |
| loki | Like Prometheus, but for logs | ✅ |
| longhorn | Cloud-Native distributed storage built on and for Kubernetes | ❌ |
| metallb | A network load-balancer implementation for Kubernetes using standard routing protocols | ✅ |
| microbin | A secure, configurable file-sharing and URL shortening web app | ✅ |
| mosquitto | Open source MQTT broker | ✅ |
| nextcloud | A safe home for all your data | ✅ |
| niks3 | S3-backed Nix binary cache with garbage collection | ✅ |
| openbao | Open source, community-driven fork of Vault managed by the Linux Foundation | ✅ |
| opencloud | Excellent file sharing | ❌ |
| opentelemetry-collector | Vendor-agnostic implementation on how to receive, process and export telemetry data | ✅ |
| opentelemetry-operator | Kubernetes Operator for OpenTelemetry Collector | ✅ |
| paperless-ngx | Scan, index and archive all your physical documents | ✅ |
| pocket-id | Simple and easy-to-use OIDC provider that allows users to authenticate with their passkeys to your services | ✅ |
| registry | In-cluster OCI image registry (CNCF distribution) | ✅ |
| reloader | A Kubernetes controller to watch changes in ConfigMap and Secrets and do rolling upgrades on Pods with their associated Deployment, StatefulSet, DaemonSet and DeploymentConfig | ✅ |
| sablier | A free and open-source software to start workloads on demand and stop them after a period of inactivity | ✅ |
| satisfactory-server | Satisfactory server | ❌ |
| snapshot-controller | Implements the control loop for CSI snapshot functionality | ❌ |
| tailscale-operator | A Kubernetes Operator for Tailscale | ✅ |
| temporal | Durable execution engine. | ✅ |
| traefik | A Traefik based Kubernetes ingress controller | ✅ |
| tts9000 | Text-to-Speech service using Mistral's Voxtral TTS | ✅ |
| vaultwarden | Unofficial Bitwarden compatible server written in Rust | ✅ |
| velero | Backup and migrate Kubernetes applications and their persistent volumes | ✅ |
| versity-gw | High-performance S3 translation service | ✅ |
| workbench | ApplicationSet that builds images from workbench/* subdirs | ✅ |
| zigbee2mqtt | Zigbee to MQTT bridge | ✅ |