GitOps-managed Kubernetes cluster running on bare metal, powered by Flux and Talos Linux.
| Component | Details |
|---|---|
| Hardware | 5× Dell Optiplex 3090 Micro |
| OS | Talos Linux |
| Kubernetes | Talos-managed, 3 control plane + 2 workers |
| Boot disk | 128GB 2230 NVMe via M.2 WiFi key adapter |
| GitOps | Flux with SOPS encryption |
| Networking | Cilium CNI with full network policy enforcement |
| Ingress | HAProxy Kubernetes Ingress Controller |
| Storage | Rook-Ceph (NVMe + SATA SSD, block + filesystem) |
| Certificates | cert-manager |
| Secrets | SOPS with Age encryption |
| Databases | CloudNative-PG for PostgreSQL workloads |
| Monitoring | Prometheus + Grafana via kube-prometheus-stack |
| Backups | VolSync for PVC replication |
| Updates | Renovate with automerge |
kubernetes/
├── apps/ # Application deployments
├── clusters/ # Cluster-level Flux Kustomizations
├── core/ # Core infrastructure (Cilium, cert-manager, HAProxy, Flux)
├── monitoring/ # Prometheus stack, alerting rules
├── security/ # Admission policies
└── storage/ # Rook-Ceph cluster configuration
Ansible playbooks for host provisioning and configuration are in the ansible/ directory, executed via AWX running in-cluster.
Every namespace has a default-deny network policy. Ingress and egress are explicitly allowed per-app using Kubernetes NetworkPolicies and CiliumNetworkPolicies.
| Service | Purpose |
|---|---|
| Jellyfin | Primary media server |
| Plex | Secondary media server |
| Sonarr / Radarr / Lidarr | Media management & automation |
| Readarr / Speakarr | Books & audiobooks |
| Navidrome | Music streaming (Subsonic API) |
| Icecast | Radio stream endpoint |
| Audiobookshelf | Audiobook & podcast server |
| qBittorrent | Download client |
| Prowlarr | Indexer management |
| Bazarr | Subtitle management |
| Tdarr | Distributed media transcoding |
| ErsatzTV | Custom IPTV channels |
| Recyclarr | Quality profile sync for Sonarr/Radarr |
| Seerr | Media request management |
| Pinchflat | YouTube archival |
| AudioMuse-AI | Sonic analysis playlist generator |
| MeTube | Video downloads |
| Service | Purpose |
|---|---|
| Nextcloud | Files, calendar, contacts |
| Paperless-ngx | Document management with AI classification |
| Mealie | Recipe manager |
| FreshRSS | RSS feed aggregator |
| Karakeep | Bookmark manager |
| Vaultwarden | Bitwarden-compatible password manager |
| Wallos | Subscription tracker |
| Service | Purpose |
|---|---|
| Forgejo | Self-hosted Git forge |
| AWX | Ansible automation platform |
| Wastebin | Minimal pastebin with syntax highlighting |
| Service | Purpose |
|---|---|
| Hermes Agent | Self-improving AI agent (NousResearch) |
| LiteLLM | OpenAI-compatible LLM proxy (GitHub Copilot gateway) |
| Ollama | Local LLM inference |
| Open WebUI | Chat interface for local models |
| SearXNG | Privacy-respecting metasearch engine |
| Service | Purpose |
|---|---|
| AdGuard Home | DNS-level ad blocking |
| Unifi Controller | Network management |
| Changedetection.io | Website change monitoring |
| Uptime Kuma | Service uptime monitoring |
| NeuVector | Runtime Kubernetes security, vulnerability scanning, and compliance |
| Kubescape | Kubernetes posture, compliance, and vulnerability scanning |
| Syncthing | File synchronization |
| OwnTracks | Location tracking |
| signal-cli | Signal messaging REST API |
| Service | Purpose |
|---|---|
| Minecraft | Multiple Java + Bedrock servers |
Renovate with automerge for trusted container digests, patch updates, and Grafana dashboards.
kube-prometheus-stack with custom alerting rules for Ceph health, node resources, pod restarts, blackbox probes, and VolSync backup status.
Rook-Ceph manages all persistent storage across the cluster:
- Block storage (RBD) — NVMe-backed, 3-way replication for databases and stateful apps
- Filesystem (CephFS) — Shared storage for media libraries, 2-way replication
- Encryption — All OSDs use encrypted devices
- Each node contributes NVMe and SATA SSDs to the Ceph cluster
Each Optiplex 3090 Micro has three storage devices:
| Slot | Device | Purpose |
|---|---|---|
| M.2 WiFi → NVMe adapter | 128GB 2230 NVMe | Talos OS |
| M.2 NVMe | 1–4TB NVMe (970 EVO Plus, SN850X, SN735) | Ceph OSDs (2 per drive) |
| 2.5" SATA | 4–8TB Samsung 870 QVO | Ceph OSD (1 per drive) |
The WiFi-to-NVMe adapter trick gives each node a dedicated boot drive without sacrificing the main NVMe slot for Ceph.
PVC backups via VolSync with Restic snapshots to S3-compatible storage.