The full stack
Everything that runs. One map.
52 components in five layers on one server, plus the few services outside the house. It shows what runs and what each part does, never where it runs.
Internet · the way in
- Cloudflare DNSPublic names. The cluster writes its own records.
- FirewallOne port open to one country. Everything else is closed.
- WireGuardThe only way to the admin side from outside.
05
Applications
- ImmichFamily photos and videos, with face and object search on the server.
- JellyfinFilms and series, transcoded on the GPU.
- SeafileFiles synced across every device.
- Paperless-ngxScanned letters, read by OCR and searchable.
- ForgejoPrivate Git hosting.
- n8nAutomations between the services.
04
Platform
Delivery
- FluxApplies every change from Git and reverts drift.
- RenovateProposes every update as a pull request.
- KyvernoRejects workloads that break the rules: no root, pinned images, limits set.
Observability
- PrometheusCollects metrics from every layer.
- GrafanaDashboards, behind the same login.
- LokiKeeps the logs.
- AlloyCollects logs from pods and network gear.
- AlertmanagerGroups alerts and sends them on.
- ntfyPush notifications to the phone.
- UnPollerNetwork gear metrics.
Way in
- Envoy GatewayThe one door in: TLS, routing and rate limits.
- AuthentikOne login with a second factor in front of every app.
- cert-managerGets and renews every certificate.
- external-dnsWrites the public DNS record for each app.
Secrets
- External SecretsFetches secrets from the vault. Git never holds one.
Data and backups
- CloudNativePGRuns Postgres for the apps, with continuous backups.
- VolSyncNightly encrypted copies of every volume.
- Restore drillRestores a backup every night and checks the result.
Security
- Trivy OperatorScans every running image for known vulnerabilities.
- Status exporterSends this site its live status, signed.
03
Cluster
- Talos LinuxImmutable OS for the nodes: no SSH, no shell, configured by API.
- KubernetesOne control-plane node and three workers.
- CiliumPod network, load balancer and the firewall between pods.
- HubbleShows live which pod talks to which.
- Proxmox CSICreates disks for pods directly on the host's storage.
- Intel GPU pluginLets the media server use the GPU.
02
Virtualisation
- Proxmox VESplits the server into virtual machines and containers.
- Sidero OmniCreates and upgrades the Talos machines. Runs beside the cluster, never inside it.
- GarageS3 storage for every backup, on the mirrored pool.
- SambaNetwork drive for the family's computers.
- NFSMedia reaches the cluster read-only, on a network that exists only inside the server.
- TerraformDescribes every VM and container.
- AnsibleConfigures the host and every guest. A second run changes nothing.
01
Hardware
- ZFS mirrorMirrored disks for everything irreplaceable. Every block checksummed.
- Media diskOne large disk for media that can be fetched again. No redundancy, on purpose.
- NVMeFast storage for the machines and databases.
- Intel Arc GPUPassed through to one node for transcoding.
- HBAHands the data disks straight to ZFS.