Welcome to my homelab! This repository contains my complete GitOps-driven Kubernetes infrastructure running on Talos Linux. Everything is declarative, automated, and immutable - exactly how modern infrastructure should be.
This homelab showcases enterprise-grade practices in a home environment, featuring:
- Immutable infrastructure with Talos Linux
- GitOps workflow using Flux CD
- Comprehensive monitoring with Prometheus and Grafana
- Automated dependency management via Renovate
- Security-first approach with encrypted secrets and network policies
The entire cluster is managed through Git - no manual kubectl commands, no SSH access, no exceptions.
| Component | Technology | Purpose |
|---|---|---|
| Operating System | Talos Linux | API-driven, immutable Kubernetes OS |
| GitOps | Flux CD | Continuous delivery and cluster synchronization |
| Container Network | Cilium | eBPF-based networking with BGP support |
| Storage | OpenEBS | Local persistent storage with hostPath provisioner |
| Secret Management | SOPS + Age | Encrypted secrets in Git |
| Certificates | cert-manager | Automated Let's Encrypt certificates |
| Ingress | NGINX + Cloudflare Tunnel | Internal and external application access |
| Monitoring | Prometheus + Grafana | Metrics collection and visualization |
| Logging | Loki + Promtail | Centralized log aggregation |
- 🔒 Immutable Infrastructure: Zero SSH access, all changes via GitOps
- 🤖 Automated Everything: Renovate handles dependency updates
- 📊 Enterprise Monitoring: 20+ Grafana dashboards with comprehensive alerting
- 🔐 Security First: Encrypted secrets, network policies, security contexts
- 🎭 High Availability: 3-node control plane with local persistent storage
- 🚀 Zero Downtime: Rolling updates with proper health checks
- 🌐 Hybrid Networking: Internal and external application access
┌─────────────────────────────────────────────────────────────────┐
│ 🌐 Internet │
└─────────────────────────┬───────────────────────────────────────┘
│
┌─────────────────────────▼───────────────────────────────────────┐
│ ☁️ Cloudflare │
│ │
│ ┌─────────────────┐ ┌─────────────────┐ │
│ │ DNS & Proxy │ │ Zero Trust │ │
│ │ │ │ Tunnel │ │
│ └─────────────────┘ └─────────────────┘ │
└─────────────────────────┬───────────────────────────────────────┘
│
┌─────────────────────────▼───────────────────────────────────────┐
│ 🏠 Homelab Network │
│ │
│ ┌─────────────────┐ ┌─────────────────┐ ┌─────────────┐ │
│ │ Talos Node │ │ Talos Node │ │ Talos Node │ │
│ │ (Control+Work) │ │ (Control+Work) │ │(Control+Work)│ │
│ └─────────────────┘ └─────────────────┘ └─────────────┘ │
│ │
│ ┌─────────────────────────────────────────────────────────────┐ │
│ │ 📦 Kubernetes Cluster │ │
│ │ │ │
│ │ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │ │
│ │ │ Media │ │ Monitoring │ │ Networking │ │ │
│ │ │ Stack │ │ Stack │ │ Stack │ │ │
│ │ └─────────────┘ └─────────────┘ └─────────────┘ │ │
│ │ │ │
│ │ ┌─────────────────────────────────────────────────────────┐ │ │
│ │ │ 🗄️ OpenEBS Local Storage │ │ │
│ │ └─────────────────────────────────────────────────────────┘ │ │
│ └─────────────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────────┘
# Install development tools
mise trust && mise install
# Bootstrap the cluster
task bootstrap:talos # Install Talos Linux
task bootstrap:apps # Deploy applications# Monitor cluster health
kubectl get pods -A --watch
cilium status
flux get hr -A
# Force synchronization
task reconcile
# View logs
kubectl logs -n <namespace> <pod> -f📁 homelab/
├── 🔧 bootstrap/ # Initial cluster setup
├── 📁 kubernetes/
│ ├── 📁 apps/ # Applications by namespace
│ │ ├── 📁 cert-manager/ # Certificate management
│ │ ├── 📁 default/ # Media applications
│ │ ├── 📁 network/ # Ingress, DNS, tunnels
│ │ ├── 📁 observability/ # Monitoring stack
│ │ └── 📁 openebs-system/ # Local storage provisioner
│ ├── 📁 components/ # Reusable components
│ └── 📁 flux/ # GitOps configuration
├── 📁 talos/ # OS configuration
└── 📁 scripts/ # Automation scripts
- Sonarr/Radarr: Automated TV show and movie management
- Prowlarr: Indexer management
- Plex: Media server with hardware transcoding
- Prometheus: Metrics collection with 20+ pre-configured alerts
- Grafana: 20+ dashboards covering infrastructure and applications
- Loki: Centralized logging with retention policies
- Alertmanager: Multi-channel alerting (Discord, email)
- Internal Access: k8s-gateway for local DNS resolution
- External Access: Cloudflare Tunnel for secure remote access
- Load Balancing: NGINX ingress controllers
- Network Security: Cilium network policies
- Local Storage: OpenEBS hostPath provisioner for persistent volumes
- Media Storage: NFS integration with TrueNAS for media files
- AI Workloads: Dedicated storage for Ollama models and inference
Every application follows a consistent pattern:
app/
├── helmrelease.yaml # Helm chart deployment
├── kustomization.yaml # Kustomize configuration
├── externalsecret.yaml # SOPS-encrypted secrets
└── resources/ # Additional K8s resources
- 🔐 Encrypted Secrets: All sensitive data encrypted with SOPS + Age
- 🛡️ Network Policies: Micro-segmentation with Cilium
- 📜 Security Contexts: Non-root containers with minimal privileges
- 🔒 Pod Security Standards: Enforced security policies
- 🌐 Zero Trust: Cloudflare Access for external services
- Automated Updates: Container images, Helm charts, GitHub Actions
- Grouped Dependencies: Related updates bundled together
- Scheduled Updates: Weekend update cycles
- Pre-commit Validation: flux-local ensures manifests are valid
- Manifest Validation: Pre-commit hooks with flux-local
- Diff Generation: Automated PR comments showing changes
- Security Scanning: SOPS validation for encrypted secrets
- Infrastructure: Node metrics, storage, networking
- Applications: Application-specific metrics and health
- Kubernetes: Cluster resources and workload status
- Media Stack: Download statistics and performance
- Infrastructure Alerts: Node down, disk space, memory usage
- Application Alerts: Pod crashes, certificate expiry
- Network Alerts: Ingress failures, DNS resolution issues
- Local Changes: Edit manifests in your IDE
- Validation:
flux-localvalidates changes locally - Git Push: Changes pushed to repository
- Automatic Sync: Flux applies changes to cluster
- Monitoring: Grafana dashboards show deployment status
# Flux troubleshooting
flux check
flux get sources git -A
flux get ks -A
flux get hr -A
# Application debugging
kubectl -n <namespace> describe pod <pod-name>
kubectl -n <namespace> logs <pod-name> -f
kubectl -n <namespace> get events --sort-by='.metadata.creationTimestamp'
# Network debugging
cilium status
nmap -Pn -n -p 443 <ingress-ip># Force reconciliation
task reconcile
# Restart failed pods
kubectl -n <namespace> rollout restart deployment <deployment>
# Certificate issues
kubectl -n cert-manager describe certificatesThis homelab draws inspiration from the amazing Kubernetes at Home community:
- onedr0p/home-ops - The gold standard for homelab GitOps
- bjw-s/home-ops - Excellent patterns and practices
- k8s-at-home/charts - Community Helm charts
- Home Operations Discord - Incredibly helpful community
⭐ If you find this repository helpful, please consider giving it a star!
Built with ❤️ using GitOps principles and powered by the Kubernetes at Home community