abegglen.cloud
DE · Deutsch

The stack · five layersJump to a layer

The full stack map →

Checking homelab status

Platform

  • GitOps
  • Network
  • Gateway
  • Identity
  • Secrets
  • Certificates
  • Backups
  • Monitoring
  • Storage

Applications

  • Photos
  • Media
  • Files
  • Documents
  • Git
  • Automation
Full live status ↓
About

Homelab · platform engineering

One server. Run like production.

The story of my homelab, from a single box to a GitOps-run platform, with live evidence that it works. Scroll to build it.

Skip the story

01 / The stack

Built layer by layer.

  1. 01Hardware

    One server. A mirrored ZFS pool for everything irreplaceable, NVMe for fast disks, a GPU for transcoding.

  2. 02Virtualisation

    Proxmox splits the box into virtual machines and containers. The cluster manager runs beside the cluster, never inside it.

  3. 03Cluster

    Four Talos Linux nodes form Kubernetes: no SSH, no shell, every machine described by its configuration.

  4. 04Platform

    Git is the source of truth. Flux applies every change; networking, identity, secrets, certificates, backups and monitoring come with it.

  5. 05Applications

    What the family uses every day: photos, media, files, documents, code and automation, behind one login.

Diagram of the homelab stack, from hardware to applicationsHOMELAB · ONE SERVERCHECKINGKUBERNETES CLUSTERApplicationsPhotosMediaFilesDocumentsGitAutomationPlatformGitOpsNetworkGatewayIdentitySecretsCertificatesBackupsMonitoringKubernetesTALOS LINUXcontrol planeworkerworkerworker · GPUOmniMANAGEMENTOUTSIDEProxmoxVMS · CONTAINERStalosbackup · S3filesomniOne serverBARE METALZFS mirrorNVMeGPUHBASCROLL TO BUILD

02 / A request

Every request, checked.

Path of a request from the internet through firewall, gateway and login to an appPATH OF ONE REQUESTSCROLL TO SENDInternetANYONEFirewallONE COUNTRY ONLYGatewayTLS · RATE LIMITSLoginONE ACCOUNT · 2FAAppARRIVEDBLOCKEDSLOWED DOWN
  1. 01Internet

    Someone opens a link. From here on, nothing is trusted by default.

  2. 02Firewall

    One port is open, and only to addresses from one country. Intrusion prevention watches the rest. Most scanners never get further.

  3. 03Gateway

    Encryption ends here, with certificates that renew themselves. Rate limits slow down anyone guessing passwords.

  4. 04Login

    One account for every app, with a second factor. The identity service decides who gets in.

  5. 05App

    The request arrives, checked three times on the way.

03 / When it breaks

Things break. It comes back.

A worker node fails, its apps move to the healthy workers and data is restored from a backup outside the clusterCLUSTER · FOUR NODESSCROLL TO BREAK ITcontrol planeRUNS THE CLUSTERworkerworkerworkerGPUworkerNOT READYREBUILTPhotosMediaFilesDocumentsGitAutomationBackupS3 · EVERY NIGHTOUTSIDE THE CLUSTEROffsiteENCRYPTED COPYOUT OF THE HOUSE↺ RESTORING
  1. 01Running

    Four nodes, the apps spread across the three workers.

  2. 02A node fails

    A worker stops answering. Kubernetes marks it not ready and sends it no more work.

  3. 03Apps move

    Its apps start again on the healthy workers. Nobody has to log in for that.

  4. 04Data comes back

    If data itself is lost, it comes back from backup. Every night it goes to storage outside the cluster, and an encrypted copy leaves the house.

  5. 05Back to green

    The node is rebuilt from its configuration and rejoins. A restore test runs every night, so the backups are proven, not hoped for.

The restore test runs every night. Its live result shows here once the lab reports in.

04 / It's live

Not an animation. Live.

Everything above was a drawing. These values come from the cluster itself, pushed every five minutes.

Checking homelab status

Nodes ready

– / –

Last restore test

–

Changes through Git

–%

last 30 days

Photos

–

in the family library

Changes merged

–

per day, last 30 days

Storage used

–%

mirrored pool for irreplaceable data

Services

    Recent activity

      About

      Built at home. Run with care.

      This lab is where I run things the way I would at work: everything in Git, every change reviewed, backups that get restored on a schedule, and nothing that depends on luck. If you are building something similar or want to compare notes, write me.