Homelab & Infrastructure Architecture #
An overview of my homelab infrastructure, private cloud clusters, virtualization environments, and GitOps delivery pipelines.
Cloud & Kubernetes Architecture #
For a more detailed look, navigate to this page.
1. Zero Trust Ingress & Security #
Traffic reaches cluster workloads and administrative interfaces via Cloudflare Zero Trust tunnels without exposing public IP addresses on nodes or opening inbound firewall ports.
flowchart TB
VISITOR(["Public visitors"])
ADMIN(["Engineer
SSO-authenticated"])
EDGE["Cloudflare Edge
DNS · WAF · TLS · Access"]
TUNNEL["Cloudflare Tunnel
Outbound-only connection"]
APPS["Private & public services
Zero inbound ports on nodes"]
VISITOR --> EDGE --> TUNNEL --> APPS
ADMIN --> EDGE
classDef entry fill:#e0f2fe,stroke:#0284c7,color:#0f172a,stroke-width:1.5px;
classDef security fill:#fef3c7,stroke:#d97706,color:#0f172a,stroke-width:1.5px;
classDef workload fill:#ecfdf5,stroke:#059669,color:#0f172a,stroke-width:1.5px;
class VISITOR,ADMIN entry;
class EDGE,TUNNEL security;
class APPS workload;
2. GitOps Delivery Pipeline #
All application manifests and project boundaries are declaratively defined in GitHub. Argo CD automatically reconciles desired state against the cluster while pulling containers from GitHub Container Registry (GHCR).
flowchart TB
GIT["GitHub
Application & infrastructure source"]
CI["GitHub Actions
Build · test · publish"]
REGISTRY["GHCR
Versioned container image"]
ARGO["Argo CD
GitOps reconciliation"]
CLUSTER["Kubernetes workloads
Desired state applied"]
GIT --> CI --> REGISTRY --> CLUSTER
GIT -.-> ARGO --> CLUSTER
classDef source fill:#e0f2fe,stroke:#0284c7,color:#0f172a,stroke-width:1.5px;
classDef delivery fill:#ede9fe,stroke:#7c3aed,color:#0f172a,stroke-width:1.5px;
classDef workload fill:#ecfdf5,stroke:#059669,color:#0f172a,stroke-width:1.5px;
class GIT source;
class CI,REGISTRY,ARGO delivery;
class CLUSTER workload;
3. Cluster Runtime & Namespace Isolation #
Workloads are segregated across dedicated namespaces with granular RBAC policies and resource whitelisting enforced by Argo CD AppProjects.
flowchart LR
EDGE["Cloudflare Tunnel
Authenticated ingress"]
subgraph LXCS["Dedicated LXC"]
N8N["n8n
Private workflows"]
end
subgraph K3S["K3s Services"]
WEBUI["Open WebUI
Private AI workspace"]
LITELLM["LiteLLM
Scoped model gateway"]
MCP["MCP services
Read-only notes & cluster tools"]
OBS["Prometheus · Loki · Grafana
Observability"]
WEBUI --> LITELLM
WEBUI --> MCP
end
EDGE --> WEBUI
N8N --> LITELLM
classDef edge fill:#fef3c7,stroke:#d97706,color:#0f172a,stroke-width:1.5px;
classDef app fill:#e0f2fe,stroke:#0284c7,color:#0f172a,stroke-width:1.5px;
classDef service fill:#ecfdf5,stroke:#059669,color:#0f172a,stroke-width:1.5px;
class EDGE edge;
class WEBUI,N8N app;
class LITELLM,MCP,OBS service;
Physical Hardware #
- Lenovo Mini-PC: Primary Proxmox VE hypervisor node for local workloads and VMs.
- HP Envy Laptop (2015): Secondary Proxmox compute node.
- Raspberry Pi 4: Lightweight edge services and DNS.
- HP ProLiant DL360p Gen8: High-capacity virtualization server (on-demand storage/testing).
Software & Virtualization #
- Hypervisors & OS: Proxmox VE, NixOS (declarative host configuration), Debian.
- Orchestration: Kubernetes (UpCloud managed & hybrid edge nodes), Docker, LXC containers.
- Networking: Cloudflare Zero Trust, WireGuard, private VLANs.
- Private services: Open WebUI and LiteLLM in K3s, with n8n in a dedicated LXC for private workflows.
Current Projects & Roadmap #
- Cloudflare Zero Trust + UpCloud K8s deployment
- Argo CD GitOps pipeline with AppProject security boundaries
- Centralized Prometheus + Grafana observability stack
- Private AI and automation services with scoped model access
- Isolated CTF and security testing playground
- Identity Stack