Welcome to my home infrastructure and Kubernetes cluster repository! This project embraces Infrastructure as Code (IaC) and GitOps principles, leveraging Kubernetes, Flux, Terraform, Renovate, and GitHub Actions to maintain a fully automated, declarative homelab environment.
My semi-hyperconverged cluster runs Talos Linux-an immutable, minimal Linux distribution purpose-built for Kubernetes-on three bare-metal machines. Storage is handled by Rook, providing persistent block, object, and file storage directly within the cluster, complemented by a dedicated NAS for media files. The entire cluster is architected for complete reproducibility: I can tear it down and rebuild from scratch without losing any data.
- cert-manager: Creates TLS certificates for services in my cluster.
- cilium: High-performance container networking powered by eBPF.
- cloudflared: Secure tunnel providing Cloudflare-protected access to cluster services.
- envoy-gateway: Modern ingress controller for cluster traffic management.
- external-dns: Automated DNS record synchronization for ingress resources.
- external-secrets: Kubernetes secrets management integrated with Bitwarden.
- rook: Cloud-native distributed storage orchestrator for persistent storage.
- spegel: Stateless cluster local OCI registry mirror.
- volsync: Backup and recovery of persistent volume claims.
Flux continuously monitors the kubernetes folder and reconciles my cluster state with whatever is defined in this Git repository-Git is the single source of truth.
Here's how it works: Flux recursively scans the kubernetes/apps directory, discovering the top-level kustomization.yaml in each subdirectory. These files typically define a namespace and one or more Flux Kustomization resources (ks.yaml). Each Flux Kustomization then manages a HelmRelease or other Kubernetes resources for that application.
Meanwhile, Renovate continuously scans the entire repository for dependency updates, automatically opening pull requests when new versions are available. Once merged, Flux picks up the changes and updates the cluster automatically.
This Git repository contains the following directories under Kubernetes.
📁 kubernetes
├── 📁 apps # applications
├── 📁 bootstrap # bootstrap configuration
├── 📁 components # re-useable kustomize components
└── 📁 cluster # flux system configurationHere's how Flux orchestrates application deployments with dependencies. Most applications are deployed as HelmRelease resources that depend on other HelmRelease's, while some Kustomization's depend on other Kustomization's. Occasionally, an application may have dependencies on both types. The diagram below illustrates this: actual won't deploy or upgrade until rook-ceph-cluster is successfully installed and healthy.
Click to see a high-level architecture diagram
graph LR
classDef kustom fill:#43A047,stroke:#2E7D32,stroke-width:3px,color:#fff,font-weight:bold,rx:10,ry:10
classDef helm fill:#1976D2,stroke:#0D47A1,stroke-width:3px,color:#fff,font-weight:bold,rx:10,ry:10
A["📦 Kustomization<br/>rook-ceph"]:::kustom
B["📦 Kustomization<br/>rook-ceph-cluster"]:::kustom
C["🎯 HelmRelease<br/>rook-ceph"]:::helm
D["🎯 HelmRelease<br/>rook-ceph-cluster"]:::helm
E["📦 Kustomization<br/>actual"]:::kustom
F["🎯 HelmRelease<br/>actual"]:::helm
A -->|Creates| C
B -->|Creates| D
B -.->|Depends on| A
E -->|Creates| F
E -.->|Depends on| B
While most of my infrastructure and workloads are self-hosted I do rely upon the cloud for certain key parts of my setup.
| Service | Use | Cost |
|---|---|---|
| Bitwarden | Secrets with External Secrets | Free |
| Cloudflare | Domain, S3 and Tunnel | ~$12/yr |
| Discord | Alerts and Notifications | Free |
| Github | Github Actions | Free |
| Let's Encrypt | TLS certificates | Free |
| Total: ~$1/mo |
I run two instances of ExternalDNS to handle DNS automation:
- Private DNS: Syncs records to my
Pi-hole - Public DNS: Syncs records to
Cloudflare
This is achieved by defining routes with two specific gateways: internal for private DNS and external for public DNS. Each ExternalDNS instance watches for routes using its assigned gateway and syncs the appropriate DNS records to the corresponding platform.
| Device | Num | OS Disk Size | Data Disk Size | RAM | OS | Function |
|---|---|---|---|---|---|---|
| Lenovo m90q i5-10500T | 3 | 256GB NVMe | 500GB SSD (local) / 1TB NVMe (rook-ceph) | 32GB | Talos | Kubernetes |
| Aoostar WTR PRO 5825U | 1 | 512GB NVMe | 2x2TB SSD | 16GB | TrueNAS | NAS |
| TP-Link Archer AX53 | 1 | - | - | - | - | Router |