mitch/homelab
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
No description
19 commits 1 branch 0 tags 124 KiB
  • HCL 46.9%
  • Shell 35.3%
  • Jinja 10.7%
  • Nix 7.1%
Find a file
Exact
Mitch Mikusek ff683b9068 Fix excalidraw TLS: use cert-manager instead of cross-namespace wildcard 
The wildcard-coldcat-net-tls secret lives in system namespace but the
excalidraw ingress is in public namespace. Traefik can't read secrets
across namespaces, so it fell back to its default self-signed cert.
Switch to per-ingress cert-manager annotation like all other services.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-05 14:21:10 -08:00
.forgejo/workflows Initial homelab infrastructure scaffold 2026-03-03 22:30:38 -08:00
infrastructure Fix bootstrap issues and add sealed secrets 2026-03-05 09:38:16 -08:00
kubernetes Fix excalidraw TLS: use cert-manager instead of cross-namespace wildcard 2026-03-05 14:21:10 -08:00
scripts Initial homelab infrastructure scaffold 2026-03-03 22:30:38 -08:00
tailscale Remove Caddy, replace Tailscale with Headscale, add MetalLB and new apps 2026-03-05 00:32:44 -08:00
.gitignore Remove Caddy, replace Tailscale with Headscale, add MetalLB and new apps 2026-03-05 00:32:44 -08:00
CLAUDE.md Remove Caddy, replace Tailscale with Headscale, add MetalLB and new apps 2026-03-05 00:32:44 -08:00
flake.lock Fix bootstrap issues and add sealed secrets 2026-03-05 09:38:16 -08:00
flake.nix Add Nix flake dev shell 2026-03-04 20:09:48 -08:00
README.md Remove Caddy, replace Tailscale with Headscale, add MetalLB and new apps 2026-03-05 00:32:44 -08:00

README.md

Homelab

GitOps-driven Kubernetes homelab on a Dell R730 running Proxmox VE.

Stack

  • Proxmox VE — hypervisor
  • TrueNAS — storage (4x10TB WD Red Pro, IOMMU passthrough)
  • Talos Linux — immutable Kubernetes
  • ArgoCD — GitOps controller
  • Traefik — dual Kubernetes ingress (public + internal)
  • MetalLB — bare-metal load balancer
  • CloudNativePG — managed PostgreSQL
  • Headscale — self-hosted mesh VPN (Tailscale-compatible)

Services

Public (*.coldcat.net): Nextcloud, Immich, Forgejo, Conduit (Matrix), Stalwart (email), Prosody (XMPP), Excalidraw

Internal (*.internal.coldcat.net): Home Assistant, Obsidian LiveSync, ArgoCD, Grafana, Prometheus, Uptime Kuma

Media: Jellyfin, Sonarr, Radarr, Prowlarr, Bazarr, qBittorrent (VPN via Gluetun)

Quick Start

  1. Provision VMs: cd infrastructure/terraform && tofu apply
  2. Bootstrap Talos: talosctl gen config homelab https://10.10.10.20:6443
  3. Bootstrap cluster: ./scripts/bootstrap.sh
  4. ArgoCD syncs everything from kubernetes/apps/

Structure

infrastructure/     Terraform, Talos, Ansible
kubernetes/         K8s manifests (ArgoCD apps, base resources)
tailscale/          Headscale ACL policies
scripts/            Helper scripts
.forgejo/           CI workflows