Personal homelab Kubernetes cluster — a space for experimenting and running self-hosted workloads. Managed declaratively via GitOps: everything in this repo is what runs in the cluster. There are small exceptions I don't want to make public. These are placed in a quite similar, private repository.
01_k0s- k0s cluster configuration and setup scripts02_bootstrap- Core cluster components bootstrapped before ArgoCD takes over03_apps/apps- All application deployments, managed as ArgoCD app-of-appsscripts- Utility scripts
Conventions, patterns, and security architecture are documented in AGENTS.md, SECURITY.md, and PRINCIPLES.md.
The cluster runs k0s. Before ArgoCD can manage the rest, a few components are bootstrapped in order:
- Cilium — CNI, must be available before any workloads can run
- ArgoCD — takes over management of everything that follows
- Secrets — secrets for repository and bitwarden access
- Traefik — internal ingress controller instance
- Orchestration — ArgoCD manages all deployments. Changes to this repo are reconciled automatically into the cluster.
- Networking — Cilium as the CNI with eBPF-based network policies and L2 load balancing. Traefik handles ingress — a separate internal instance (IP allowlist) and an external instance (CrowdSec, rate limiting, GeoBlock).
- Storage — Longhorn for replicated block storage, local-path-provisioner for node-local volumes, and csi-driver-smb for NAS mounts.
- Databases — CloudNativePG operator for PostgreSQL.
- Secrets — External Secrets pulls secrets from Bitwarden at deploy time. No secrets are stored in git.
- TLS — step-ca acts as an internal CA; cert-manager handles certificate lifecycle and Let's Encrypt for public-facing services.
- Security — CrowdSec for threat detection, Kyverno for policy enforcement.
- helm-charts — custom Helm charts used by apps in this repo; simplifies interaction with core components
- gitops-private — private workload configurations, private repository