{"id":51704562,"url":"https://github.com/fabricesemti80/home-dc","last_synced_at":"2026-07-16T14:06:50.978Z","repository":{"id":368640151,"uuid":"1286117735","full_name":"fabricesemti80/home-dc","owner":"fabricesemti80","description":"Summary of my `home-dc-*` repos","archived":false,"fork":false,"pushed_at":"2026-07-01T13:32:48.000Z","size":1102,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-01T15:17:46.149Z","etag":null,"topics":["datacenter","docker","homelab","kubernetes","proxmox"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/fabricesemti80.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-07-01T13:12:02.000Z","updated_at":"2026-07-01T13:32:53.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/fabricesemti80/home-dc","commit_stats":null,"previous_names":["fabricesemti80/home-dc"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/fabricesemti80/home-dc","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fabricesemti80%2Fhome-dc","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fabricesemti80%2Fhome-dc/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fabricesemti80%2Fhome-dc/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fabricesemti80%2Fhome-dc/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/fabricesemti80","download_url":"https://codeload.github.com/fabricesemti80/home-dc/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fabricesemti80%2Fhome-dc/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35546346,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-16T02:00:06.687Z","response_time":83,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["datacenter","docker","homelab","kubernetes","proxmox"],"created_at":"2026-07-16T14:06:50.178Z","updated_at":"2026-07-16T14:06:50.963Z","avatar_url":"https://github.com/fabricesemti80.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Home DC Overview\n\nHigh-level map of the homelab. Core repos:\n\n| Repo | Remote | Role |\n|------|--------|------|\n| [`home-dc-proxmox`](../home-dc-proxmox) | [github.com/fabricesemti80/home-dc-proxmox](https://github.com/fabricesemti80/home-dc-proxmox) | Bare-metal Proxmox VE + Ceph cluster |\n| [`home-dc-kubernetes`](../home-dc-kubernetes) | [github.com/fabricesemti80/home-dc-kubernetes](https://github.com/fabricesemti80/home-dc-kubernetes) | Talos Kubernetes cluster and GitOps workloads |\n| [`home-dc-service-hosts`](../home-dc-service-hosts) | [github.com/fabricesemti80/home-dc-service-hosts](https://github.com/fabricesemti80/home-dc-service-hosts) | Standalone service hosts: Docker VMs, PBS LXC, physical hosts |\n\n\u003c!-- ponytail: intentionally excludes secret values, token strings, and password hashes; see each repo's local/runtime files --\u003e\n\n---\n\n## Architecture Diagram\n\n![Architecture Diagram](assets/architecture.png)\n\n\u003c!-- ponytail: regenerate with `python assets/generate-diagram.py` after `pip install diagrams` and graphviz --\u003e\n\n---\n\n## Network Layout\n\n| Network | CIDR | Purpose |\n|---------|------|---------|\n| Management / VM | `10.0.40.0/24` | Proxmox UI, VMs, Kubernetes nodes, Docker host, NFS |\n| Ceph storage | `10.0.70.0/24` | Ceph cluster traffic between Proxmox nodes |\n| Kubernetes pods | `10.42.0.0/16` | Pod IPs (default) |\n| Kubernetes services | `10.43.0.0/16` | Service IPs (default) |\n\n### Key Addresses\n\n| Host / Service | IP |\n|----------------|-----|\n| Proxmox nodes | `10.0.40.10` – `10.0.40.12` |\n| Proxmox VIP (Keepalived) | `10.0.40.15` |\n| NFS server | `10.0.40.2` |\n| Proxmox Backup Server (`proxmox-pbs-0`) | `10.0.40.16` |\n| Docker service host (`docker-svc-0`) | `10.0.40.54` |\n| Physical Docker service host (`docker-svc-1`) | `10.0.40.53` |\n| Legacy Docker host (`morpheus`) | `10.0.40.19` |\n| Kubernetes control-plane nodes | `10.0.40.90` – `10.0.40.92` |\n| Kubernetes API VIP | `10.0.40.101` |\n| Internal gateway (`envoy-internal`) | `10.0.40.102` |\n| External gateway (`envoy-external`) | `10.0.40.103` |\n| Kubernetes DNS gateway (`k8s-gateway`) | `10.0.40.153` |\n| Management VM (`deep-thought-01`) | `10.0.40.100` *(disabled by default)* |\n\n---\n\n## Layer 1: Proxmox (`home-dc-proxmox`)\n\n- **3-node Proxmox VE cluster** (`pve-0`, `pve-1`, `pve-2`) on Debian 12.\n- **Keepalived** floating VIP at `10.0.40.15` for HA web UI access.\n- **Ceph** distributed storage across the three nodes, using dedicated NVMe drives on the `10.0.70.0/24` storage network.\n- **NFS integration** from `10.0.40.2` for backups, ISOs, templates, and the shared media library.\n- **API tokens** for Packer (`packer@pve`) and Terraform (`terraform@pve`) automation.\n- **Backup jobs**, Gmail SMTP notifications, Chrony NTP, SSH key deployment.\n\nManaged with Ansible + `Taskfile.yml`.\n\n---\n\n## Layer 2: Kubernetes (`home-dc-kubernetes`)\n\n### Cluster\n\n- **Talos Linux** VMs running on Proxmox.\n- Active nodes: 3 control-plane nodes only (`k8s-ctrl-01` – `k8s-ctrl-03`).\n- Legacy worker VMs exist in Proxmox but are **powered off** and not in the active Talos inventory.\n- API endpoint uses a Talos VIP at `10.0.40.101`.\n\n### Networking\n\n- **Cilium** CNI in kube-proxy-free mode.\n- **CoreDNS** for in-cluster DNS.\n- **Envoy Gateway** (`envoy-internal` / `envoy-external`) exposes HTTPRoutes.\n- **k8s-gateway** at `10.0.40.153` provides split-horizon DNS for local clients.\n- **Cloudflare Tunnel** (`cloudflared`) brings public traffic in without opening ports.\n- **external-dns** publishes records to Cloudflare.\n\n### GitOps\n\n- **Argo CD** watches `fabricesemti80/home-dc-kubernetes` and reconciles apps under `kubernetes/apps/`.\n- Bootstrap ordering in `bootstrap/helmfile.d/` installs Cilium, CoreDNS, Spegel, cert-manager, Argo CD, etc.\n\n### Storage\n\n- **CephFS** via `ceph-csi` for workload config PVCs (`storageClass: cephfs`).\n- **NFS media library** at `10.0.40.2:/media` exposed as `media-library-pvc` for media apps.\n\n### Workloads\n\n| Namespace | Apps |\n|-----------|------|\n| `media` | jellyfin, jellyseerr, immich, prowlarr, qbittorrent, radarr, sonarr, sabnzbd, recyclarr, tdarr |\n| `productivity` | linkwarden, n8n, termix |\n| `monitoring` | kube-prometheus-stack (Prometheus + Grafana), beszel-agent |\n| `network` | cloudflare-dns, cloudflare-tunnel, envoy-gateway, k8s-gateway |\n| `web` | glance, homepage |\n| `argo-system` | argo-cd |\n| `kube-system` | cilium, coredns, etcd-defrag, metrics-server, reloader, spegel, ceph-csi |\n| `ci-cd` | arc-controller, arc-runner-set-homelab |\n| `default` | echo |\n| `doppler-operator-system` | doppler-operator |\n\n### Ingress / Domains\n\n- Base domain: `krapulax.dev`\n- Internal domain: `krapulax.home`\n- Public apps terminate through Cloudflare Access / Zero Trust, except webhook paths and bypassed apps like Jellyfin.\n- Local DNS records for media apps point to the internal gateway via UniFi.\n\n### Secrets\n\n- **Doppler** operator syncs secrets into Kubernetes.\n- **SOPS + age** for encrypted Git-stored secrets.\n- No secrets committed to Git.\n\n---\n\n## Layer 3: Service Hosts (`home-dc-service-hosts`)\n\nStandalone VMs, LXCs, and physical hosts for services kept outside Kubernetes.\nDocker stacks are Portainer-managed from GitOps compose files where appropriate.\n\n### Services\n\n| Service | Role |\n|---------|------|\n| Portainer | Docker management UI and GitOps stack deployment |\n| Docktail | Tailscale Service proxy for Docker-host apps |\n| Homepage | Internal service dashboard |\n| Beszel | Host and container monitoring |\n| Uptime Kuma | Uptime monitoring |\n| Vaultwarden | Password manager |\n| Technitium | DNS server |\n| Whoami | Test / debug endpoint |\n| Proxmox Backup Server | Backup target, currently LXC-backed |\n\n### Network / Access\n\n- Docker stacks share the `homelab_proxy` bridge network.\n- Public service access uses native Tailscale Services via Docktail, e.g. `*.koala-dominant.ts.net`.\n- Beszel agents on Docker hosts listen on TCP `45876`.\n\n### Secrets\n\n- Local `.env` values are ignored by Git; `.env.example` documents required variables.\n- No secrets committed to Git.\n\n---\n\n## Terraform / OpenTofu Stacks\n\n| Stack | Repo | Purpose |\n|-------|------|---------|\n| `infra/terraform_proxmox` | `home-dc-kubernetes` | Proxmox VMs for Talos and optional management VM |\n| `infra/terraform_cloudflare` | `home-dc-kubernetes` | Kubernetes tunnel, DNS, Access apps/policies |\n| `infra/terraform_localdns` | `home-dc-kubernetes` | UniFi local DNS records for `*.krapulax.home` |\n| `terraform/` | `home-dc-service-hosts` | Standalone service VMs/LXCs and Tailscale services |\n\n---\n\n## Common Entrypoints\n\n### Proxmox repo\n\n```bash\ntask plan      # dry-run Ansible\ntask apply     # deploy cluster config\n```\n\n### Kubernetes repo\n\n```bash\nmise install \u0026\u0026 task deps\ntask tf:plan\ntask talos:genconfig\ntask talos:bootstrap\ntask apps:bootstrap\ntask verify:cluster\n```\n\n### Service-hosts repo\n\n```bash\ntask tf:plan\ntask tf:apply\ntask ansible:apply\n```\n\n---\n\n## Notes / Simplifications\n\n- The Kubernetes cluster runs control-plane-only for current workloads; workers are retained as rollback capacity.\n- Legacy `home-dc-docker` still exists for `morpheus`; active service-host work is in `home-dc-service-hosts`.\n- Management VM `deep-thought-01` is defined but disabled by default.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffabricesemti80%2Fhome-dc","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffabricesemti80%2Fhome-dc","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffabricesemti80%2Fhome-dc/lists"}