Homelab

How a change travels

A playground for DevOps and system automation. The core is one Proxmox cluster across two HP EliteDesk mini PCs, with a Raspberry Pi as the third quorum vote. A small supervisor VM runs Cluster API with the Proxmox provider, so the workload cluster (three control planes, two workers, Cilium) is declared in YAML and cloned from a golden Rocky Linux image instead of built by hand. ArgoCD on the supervisor then deploys everything onto it from a private Git repo: an ApplicationSet watches the apps folder, so adding an app is just adding a folder, and nobody logs in to a server to deploy. Secrets are sealed before they are committed, and the admin tools are only reachable over Tailscale. The firewall is a pair of OPNsense VMs in high availability, one on each node, so either node can go down without taking the network with it. Storage is a big, loud rig running TrueNAS as a plain NAS, used for cold storage only. The network is split into VLANs so lab traffic stays apart from the rest of the house, and Pi-hole filters DNS across every segment.

The same idea at work

The homelab is built differently from the platform I help run at work, but the idea is the same. At work it is a VMware Tanzu platform with GitLab and ArgoCD. Each application repo carries one config file. Shared pipelines read it and generate the ArgoCD project, the namespace and the RBAC, and branches map to Dev, Integration and Production clusters.

What it is made of

What is running

• ArgoCDHub that deploys every app from Git
• Cluster APIDeclares and rebuilds the Kubernetes nodes
• Sealed SecretsSecrets safe to commit to Git
• TailscalePrivate access to the admin tools
• Pi-holeNetwork-wide DNS filtering