54 lines
2.2 KiB
Markdown
54 lines
2.2 KiB
Markdown
---
|
|
title: "Homelab Kubernetes Cluster"
|
|
date: 2026-03-17
|
|
draft: false
|
|
description: "Self-hosted k3s cluster on bare-metal with Gitea CI/CD, multi-arch builds, Authentik SSO, and ~15 running workloads."
|
|
tags: ["kubernetes", "k3s", "homelab", "infrastructure", "traefik", "authentik"]
|
|
github: ""
|
|
url: ""
|
|
---
|
|
|
|
## Overview
|
|
|
|
A self-hosted Kubernetes cluster running on bare-metal hardware at home. The cluster serves as a
|
|
platform for running personal services, experimenting with cloud-native tooling, and learning
|
|
operational patterns without a cloud bill.
|
|
|
|
## Hardware
|
|
|
|
| Host | Role | Specs |
|
|
|---|---|---|
|
|
| Minisforum UM780 XTX | K3s control-plane | AMD Ryzen 7 8745H |
|
|
| HP ProDesk (nik-debian) | K3s storage agent | NFS server, mergerfs media pool |
|
|
| Mac Mini M2 | Standalone Docker host | ARM, outside the cluster |
|
|
|
|
## Stack
|
|
|
|
- **Distribution:** k3s
|
|
- **Ingress:** Traefik v3
|
|
- **TLS:** cert-manager — Let's Encrypt (public) + internal CA (LAN)
|
|
- **Auth:** Authentik SSO — OIDC + forwardAuth proxy, TOTP MFA enforced
|
|
- **DNS:** Pihole (primary + secondary, externalIPs)
|
|
- **Storage:** NFS (Debian) + local-path dynamic provisioner
|
|
- **CI/CD:** Gitea Actions + act_runner, Docker buildx multiarch (amd64 + arm64)
|
|
- **Registry:** Gitea built-in container registry
|
|
- **Observability:** Prometheus + Grafana + Loki + Promtail
|
|
- **IaC:** Ansible (host-level), Helm + raw manifests (cluster-level), all tracked in Gitea
|
|
|
|
## Highlights
|
|
|
|
- All cluster state is managed as code in a Gitea monorepo — single-file manifests per service, organised by concern
|
|
- Authentik SSO protects all web-facing services via Traefik forwardAuth; OIDC integrated with Gitea and Grafana
|
|
- Multi-arch image builds (amd64 + arm64) via buildx on every push to `main`, pushed to the self-hosted registry
|
|
- Dual-cert TLS strategy: internal CA for `*.home.arpa` services, Let's Encrypt for `*.nik4nao.com` public services
|
|
- Pihole running as primary + secondary with externalIPs for LAN-wide DNS and ad-blocking
|
|
- DDNS CronJob keeps the public A record in sync via the Porkbun API
|
|
|
|
## Running Workloads
|
|
|
|
Traefik, cert-manager, Pihole, Authentik, Gitea, Prometheus, Grafana, Loki, Promtail,
|
|
Jellyfin, qBittorrent, JDownloader, Photoview, Dashy, Glances, DDNS CronJob, this portfolio site.
|
|
|
|
## Status
|
|
|
|
Active and in daily use. |