Homelab
Dig it out of the dirt
Ben Hogan believed the secret was in the dirt: you dig it out through practice. That's my motto for the lab. You have to play to get better. It's practice, but it's playing.
TODO: polish this in your own words.
This is where I play. It's a small enterprise platform, built with the same practices I'd expect at work. I learn something here, prove it, and bring it into the enterprise.
The shape: hybrid
Compute runs at home; AWS supplies the managed services.
| Where | What |
|---|---|
| Home | A 3-node k3s cluster (k3s-1 to k3s-3), plus an NFS server (nfs-1). Every workload runs here. |
| AWS | Route 53 for DNS, S3 for backups, IAM Identity Center for console and CLI access, and IAM roles that cluster workloads assume with no access keys. |
The pages in the sidebar follow the way an organization would split the work:
Platform: what every app gets for free.
Compute & networking: k3s, kube-vip, Traefik
Storage: NFS for files, local disk for databases
Data platform: a Postgres operator, with backups to S3
Identity: one login for people, and no keys for workloads
GitOps & CI: Argo CD, Tekton, Gitea
Secrets: Sealed Secrets
Observability: Prometheus, Grafana, and alerts to Slack (being built)
Apps: each one owns its own data decisions.
Zitadel: identity provider
Gitea: git server and registry
MCP gateways: AI tool access behind single sign-on
Principles
Everything in git. Argo CD deploys what's committed; changes are commits, not console clicks.
One login. Every app trusts Zitadel; access is a role, granted or removed in one place.
Backups you've restored. A backup isn't real until a restore drill has worked.
No secrets in plain text. Secrets are sealed before they're committed, never stored in the clear.
TODO: confirm these principles in your words, or replace them.
Roadmap
What comes next, from Crossplane to alerts in chat, is on the Roadmap.