Homelab

This repository contains the applications and configurations for my private home server infrastructure.

Important

This repository is developed in my privately hosted Gitea instance. The version on GitHub is a push mirror. Any changes made there will be overwritten during the next sync.

Infrastructure

The infrastructure runs on a Talos Linux Kubernetes cluster composed of two nodes.

• Controlplane: Intel N100 mini-PC with 8GB RAM
• Worker: Intel N97 mini-PC with 16GB RAM

Talos is an immutable, minimal Kubernetes OS designed for security and ease of management. Configuration is managed declaratively in the .talos/ directory.

GitOps with ArgoCD

ArgoCD manages itself and all other applications from this repository. The primary ArgoCD Application is applications/argocd.yaml and ArgoCD reconciles the rest of the repo.

Key locations:

• applications/argocd.yaml — ArgoCD self-management manifest.
• applications/ — ArgoCD Application manifests for all services.
• kubernetes/ — plain Kubernetes manifests deployed via ApplicationSets.
• custom-resources/applicationsets/ — ApplicationSet manifests (generators and templates).
• custom-resources/appprojects/ — ArgoCD AppProject manifests (scoping, source/destination restrictions).

Updates to ArgoCD and all apps are automated via Renovate.

Cilium - CNI, Load Balancing & Gateway

Cilium is the CNI provider, handles LoadBalancer services (LB-IPAM with L2 announcements), and serves as the Gateway API implementation. Configured via:

• Cluster-wide network policies: custom-resources/cilium-clusterwide-network-policies/
• Load balancer IP pools: custom-resources/cilium/ipPool.yaml
• L2 announcement policies: custom-resources/cilium/l2Announcement.yaml

Applications

Networking & Ingress

• Cilium: CNI, L2 load balancing, Hubble observability, and Gateway API implementation.
• Gateway API: Kubernetes Gateway API CRDs.
• Contour: Ingress controller.
• Cert-Manager: Automatic TLS certificate provisioning.
• External DNS: Automatic DNS record management via Cloudflare.
• Tailscale: VPN operator for secure remote access.
• Metrics Server: Kubernetes resource metrics (CPU/memory) for HPA and kubectl top.

GitOps & CI/CD

• ArgoCD: GitOps controller managing all cluster applications.
• Argo Workflows: Workflow engine for orchestrating jobs.
• Gitea: Self-hosted Git server.
• Gitea Actions: CI/CD runners for Gitea.
• Renovate Operator: Automated dependency updates.

Secret & Storage Management

• Vault: HashiCorp Vault for secret storage.
• External Secrets Operator: Syncs secrets from Vault into Kubernetes. Requires a bootstrap secret: kubectl create secret generic vault-token -n external-secrets-operator --from-literal=token=<token>
• Cloud Native Postgres Operator: PostgreSQL operator (CNPG) for managed database clusters.
• NFS Provisioner: Dynamic NFS-backed PersistentVolume provisioning.

Monitoring & Observability

• Kube Prometheus Stack: Prometheus, Grafana, and Alertmanager for cluster monitoring.
• Gatus: Uptime and health status monitoring dashboard.

Applications

• Homepage: Unified dashboard for all services.
• Docker UI: Docker registry with a management UI.
• Kanboard: Project management (Kanban board).
• Ntfy: Self-hosted push notification service.
• Mogenius Operator: Cluster management operator.
• Too Restful API: REST API service.
• Webservice: Generic web service deployment.
• Workflow: Generic workflow deployment.

Additional Resources

• Network Policies: custom-resources/cilium-clusterwide-network-policies/
• Persistent Volumes: custom-resources/persistent-volumes/
• Postgres Clusters: custom-resources/postgres-operator/
• RBAC Configurations: custom-resources/rbac/