{"id":13820345,"url":"https://github.com/ishioni/homelab-ops","last_synced_at":"2025-05-16T07:34:00.622Z","repository":{"id":61803664,"uuid":"551654775","full_name":"ishioni/homelab-ops","owner":"ishioni","description":"Family-friendly HomeOps driven by Kubernetes and GitOps using Flux ","archived":false,"fork":false,"pushed_at":"2025-05-15T12:14:47.000Z","size":7446,"stargazers_count":132,"open_issues_count":1,"forks_count":14,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-05-15T13:25:04.021Z","etag":null,"topics":["authentik","cert-manager","external-dns","flux","helm","k8s-at-home","kubernetes","sops","talos"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ishioni.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2022-10-14T20:35:03.000Z","updated_at":"2025-05-15T12:14:50.000Z","dependencies_parsed_at":"2023-10-17T10:29:04.380Z","dependency_job_id":"931451e3-a0bd-4c00-a7d1-c7f01559a4c0","html_url":"https://github.com/ishioni/homelab-ops","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ishioni%2Fhomelab-ops","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ishioni%2Fhomelab-ops/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ishioni%2Fhomelab-ops/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ishioni%2Fhomelab-ops/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ishioni","download_url":"https://codeload.github.com/ishioni/homelab-ops/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254488796,"owners_count":22079500,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["authentik","cert-manager","external-dns","flux","helm","k8s-at-home","kubernetes","sops","talos"],"created_at":"2024-08-04T08:01:01.776Z","updated_at":"2025-05-16T07:33:55.602Z","avatar_url":"https://github.com/ishioni.png","language":"Shell","funding_links":[],"categories":["kubernetes","Categories","CSS","YAML"],"sub_categories":["Kubernetes"],"readme":"\u003cdiv align=\"center\"\u003e\n\n\n### My Kubernetes Lab cluster ⛵️\n\n_... managed with Flux and Renovate_ :robot:\n\n\u003c/div\u003e\n\n\u003cbr/\u003e\n\n\u003cdiv align=\"center\"\u003e\n\n[![Talos](https://img.shields.io/badge/v1.31-blue?style=for-the-badge\u0026logo=kubernetes\u0026logoColor=white)](https://talos.dev/)\n[![Renovate](https://img.shields.io/github/actions/workflow/status/ishioni/homelab-ops/renovate.yaml?branch=master\u0026label=\u0026logo=renovatebot\u0026style=for-the-badge\u0026color=blue)](https://github.com/ishioni/homelab-ops/actions/workflows/renovate.yaml)\n\n\u003c/div\u003e\n\n---\n\n## 📖 Overview\n\nThis is home to my personal Kubernetes lab cluster. [Flux](https://github.com/fluxcd/flux2) watches this Git repository and makes the changes to my cluster based on the manifests in the [kubernetes](./kubernetes/) directory. [Renovate](https://github.com/renovatebot/renovate) also watches this Git repository and creates pull requests when it finds updates to Docker images, Helm charts, and other dependencies.\n\n---\n\n## ⛵ Kubernetes\n\nThere is a template over at [onedr0p/flux-cluster-template](https://github.com/onedr0p/flux-cluster-template) if you wanted to try and follow along with some of the practices I use here.\n\n### Installation\n\nMy cluster is [talos](https://talos.dev/) running on proxmox VMs. This is a semi hyper-converged cluster, workloads are sharing the same available resources on my nodes while I have a separate server for data storage.\n\n🔸 _[Click here](./infrastructure/ansible/) to see my Ansible playbooks and roles._\n\n### Core Components\n\n- [cilium](https://cilium.io): Internal Kubernetes networking plugin\n- [cert-manager](https://cert-manager.io/docs/): Creates SSL certificates for services in my Kubernetes cluster\n- [external-dns](https://github.com/kubernetes-sigs/external-dns): Automatically manages DNS records from my cluster in a cloud DNS provider\n- [external-secrets](https://github.com/external-secrets/external-secrets/): Managed Kubernetes secrets using [1Password Connect](https://github.com/1Password/connect)\n- [ingress-nginx](https://github.com/kubernetes/ingress-nginx/): Ingress controller to expose HTTP traffic to pods over DNS\n- [sops](https://toolkit.fluxcd.io/guides/mozilla-sops/): Managed secrets for Kubernetes, Ansible and Terraform which are commited to Git\n- [Democratic CSI](https://github.com/democratic-csi/democratic-csi): Provides block and NFS storage provisioning\n- [volsync](https://github.com/backube/volsync): Backup and recovery of persistent volume claims\n\n### GitOps\n\n[Flux](https://github.com/fluxcd/flux2) watches my [kubernetes](./kubernetes/) folder (see Directories below) and makes the changes to my cluster based on the YAML manifests.\n\n[Renovate](https://github.com/renovatebot/renovate) watches my **entire** repository looking for dependency updates, when they are found a PR is automatically created. When some PRs are merged [Flux](https://github.com/fluxcd/flux2) applies the changes to my cluster.\n\n### Directories\n\nThis Git repository contains the following directories under [kubernetes](./kubernetes/).\n\n```sh\n📁 kubernetes      # Kubernetes cluster defined as code\n├── 📁 talos           # main cluster\n│   ├─📁 apps          # applications\n│   ├─📁 bootstrap     # bootstrap procedures\n│   └─📁 flux          # core flux configuration\n└── 📁 truenas     # Truenas k3s\n    ├─📁 apps          # applications\n    ├─📁 bootstrap     # bootstrap procedures\n    └─📁 flux          # core flux configuration\n```\n\n### Networking\n\n| Name                               | CIDR             |\n| ---------------------------------- | ---------------- |\n| Network VLAN                       | `10.1.1.0/24`    |\n| Servers VLAN                       | `10.1.2.0/24`    |\n| Talos external services (BGP)      | `10.84.2.0/24`   |\n| Kubernetes pods                    | `172.16.0.0/16`  |\n| Kubernetes services                | `10.100.0.0/16`  |\n\n---\n\n## ☁️ Cloud Dependencies\n\nWhile most of my infrastructure and workloads are selfhosted I do rely upon the cloud for certain key parts of my setup. This saves me from having to worry about two things. (1) Dealing with chicken/egg scenarios and (2) services I critically need whether my cluster is online or not.\n\nThe alternative solution to these two problems would be to host a Kubernetes cluster in the cloud and deploy applications like [HCVault](https://www.vaultproject.io/), [Vaultwarden](https://github.com/dani-garcia/vaultwarden), [ntfy](https://ntfy.sh/), and [Gatus](https://gatus.io/). However, maintaining another cluster and monitoring another group of workloads is a lot more time and effort than I am willing to put in and only saves me roughly $18/month.\n\n| Service                                      | Use                                                            | Cost             |\n| -------------------------------------------- | -------------------------------------------------------------- | ---------------- |\n| [1Password](https://1password.com/)          | Secrets with [External Secrets](https://external-secrets.io/)  | 73Eur/yr         |\n| [Cloudflare](https://www.cloudflare.com/)    | Domain, DNS and proxy management                               | Free             |\n| [Fastmail](https://fastmail.com/)            | Email hosting                                                  | $75/yr           |\n| [GitHub](https://github.com/)                | Hosting this repository and continuous integration/deployments | Free             |\n|                                              |                                                                | Total: $12.75/mo |\n\n---\n\n## 🌐 DNS\n\n### Home DNS\n\nIn my cluster there are two [ExternalDNS](https://github.com/kubernetes-sigs/external-dns) instances deployed. One is deployed with the [ExternalDNS webhook provider for UniFi](https://github.com/kashalls/external-dns-unifi-webhook) which syncs DNS records to my UniFi router. The other ExternalDNS instance syncs DNS records to Cloudflare only when the ingresses and services have an ingress class name of `external` and contain an ingress annotation `external-dns.alpha.kubernetes.io/target`. All local clients on my network use my UniFi router as the upstream DNS server.\n\n---\n\n## 🔧 Hardware\n\n| Device                     | Count | OS Disk Size | Data Disk Size          | Ram  | Operating System | Purpose             |\n| -------------------------- | ----- | ------------ | ----------------------- | ---- | ---------------- | ------------------- |\n| Unifi Cloud Gateway         | 1     | -            | -                       | -    |                  | Router              |\n| Unifi USW-Enterprise-24-POE | 1     | -            | -                       | -    | -                | Network Switch      |\n| Dell Optiplex 7040         | 4     | 512GB NVMe   | -                       | 64GB | Debian 12 (PVE)  | Virtualization Host |\n| Cyberpower OR600ERM1U      | 1     | -            | -                       | -    | -                | UPS                 |\n| QNAP TVS-682               | 1     | 2x256GB SATA | 2x512GB SSD + 4x4TB HDD | 32GB | TrueNAS Scale    | NAS                 |\n| ESP32+Ebyte 72 POE adapter | 1     | -            | -                       | -    | ESPHome          | Zigbee adapter      |\n\n---\n\n## ⭐ Stargazers\n\n\u003cdiv align=\"center\"\u003e\n\n[![Star History Chart](https://api.star-history.com/svg?repos=ishioni/homelab-ops\u0026type=Date)](https://star-history.com/#ishioni/homelab-ops\u0026Date)\n\n\u003c/div\u003e\n\n---\n\n## 🤝 Gratitude and Thanks\n\nThanks to all the people who donate their time to the [Home Operations](https://discord.gg/home-operations) Discord community. A lot of inspiration for my cluster comes from the people that have shared their clusters using the [k8s-at-home](https://github.com/topics/k8s-at-home) GitHub topic. Be sure to check out the [kubesearch.dev](kubesearch.dev) for ideas on how to deploy applications or get ideas on what you can deploy.\n\n---\n\n## 📜 Changelog\n\nSee the _awful_ [commit history](https://github.com/ishioni/homelab-ops/commits/master)\n\n---\n\n## 🔏 License:\n\nSee [LICENSE](./LICENSE)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fishioni%2Fhomelab-ops","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fishioni%2Fhomelab-ops","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fishioni%2Fhomelab-ops/lists"}