- Shell 31.5%
- Jinja 27.8%
- HCL 23.7%
- Go Template 14.3%
- Python 2.7%
| .claude | ||
| .codex | ||
| .github | ||
| .woodpecker | ||
| ansible | ||
| apps | ||
| argocd | ||
| cluster/bootstrap | ||
| docs | ||
| root | ||
| tofu | ||
| tools | ||
| .dcignore | ||
| .editorconfig | ||
| .gitattributes | ||
| .gitignore | ||
| .gitleaks.toml | ||
| .gitmodules | ||
| .kube-linter.yaml | ||
| .pre-commit-config.yaml | ||
| .rumdl.toml | ||
| .sops.yaml | ||
| .supply-chain-allow.yaml | ||
| .yamllint | ||
| AGENTS.md | ||
| CLAUDE.md | ||
| mise.toml | ||
| README.md | ||
Infrastructure Repository
GitOps-managed infrastructure for the m0sh1.cc homelab and root server clusters.
Overview
Declarative infrastructure using ArgoCD (app-of-apps pattern), Helm wrapper charts, OpenTofu, and Ansible. All changes flow through Git; imperative cluster writes are reserved for explicit recovery work.
See AGENTS.md for the full enforcement contract.
Tech Stack
| Layer | Technology |
|---|---|
| Hypervisor | Proxmox VE (3-node cluster: pve-01/02/03, ZFS storage) |
| Orchestration | k3s homelab cluster (lab-ctrl + horse01-horse03) and standalone root cluster (root01), Debian 13 |
| GitOps | ArgoCD (automated sync, prune, self-heal) |
| CNI | Cilium (homelab native dual-stack; root VXLAN single-stack; kube-proxy replacement) |
| Load Balancer | Homelab Cilium LB-IPAM + L2 announcements (dual-stack, VLAN 30); root local ingress |
| Ingress | Traefik (wildcard TLS via Cloudflare Origin CA) |
| External Access | Cloudflare Tunnel + Tailscale subnet routing |
| Storage | Proxmox CSI, Longhorn, NFS CSI, OpenEBS ZFS, Garage S3, CloudNativePG, Valkey |
| Identity | Authentik (OIDC SSO for all user apps) |
| Secrets | Bitnami SealedSecrets (K8s), Ansible Vault (hosts) |
| IaC | OpenTofu (Proxmox and root01 contract state) |
| Config Mgmt | Ansible (host provisioning, k3s setup, OPNsense) |
| Observability | Prometheus, Grafana, Loki, Alloy, Hubble |
| Security | CrowdSec, Kyverno, CiliumNetworkPolicies, Harbor Trivy scanning |
| Registry | Harbor (vulnerability scanning, cosign signing, DHI images) |
| CI/CD | Woodpecker CI, Forgejo runners, Renovate |
| IPAM | NetBox/Diode historical data retained; live network intent is Git + OPNsense + Cilium LB-IPAM |
| Firewall | OPNsense (inter-VLAN routing, Suricata IDS, Unbound DNS) |
Network
4-VLAN architecture routed by OPNsense, with dual-stack IPv6 (ULA internal):
| VLAN | Subnet | Purpose |
|---|---|---|
| — | 10.0.0.0/24 | Home network |
| 10 | 10.0.10.0/24 | Infrastructure (Proxmox, DNS, PBS) |
| 20 | 10.0.20.0/24 | Kubernetes (control plane + workers) |
| 30 | 10.0.30.0/24 | Load balancers (Traefik, Garage RPC/S3, CrowdSec, Alloy syslog) |
The root cluster is a separate single-node Netcup k3s cluster (root01) with
public IPv4 159.195.76.186, Tailscale IPv4 100.120.69.1, and pod CIDR
10.244.0.0/16.
See docs/network-architecture.md for the comprehensive architecture.
Deployed Applications
Platform (cluster scope)
ArgoCD, ArgoCD Image Updater, Alloy, cert-manager, Cilium, Cilium policies, Cloudflared, CloudNativePG, CoreDNS, CrowdSec, CSI drivers (Proxmox, NFS, S3), descheduler, external-dns, Garage (cluster + operator), kube-prometheus-stack, Kured, Kyverno, Loki, Longhorn, OPNsense exporter, origin-ca-issuer, Prometheus CRDs, PVE exporter, Reflector, Renovate Operator, SealedSecrets, snapshot-controller, Tailscale Operator, Traefik, Valkey, and Velero.
Workloads (user scope)
AI stack (Ollama, Open WebUI, Qdrant), Basic Memory, Fail2ban UI, Garage WebUI, Harbor, Headlamp, Netzbremse, pgAdmin 4, Renovate, Wakapi, and Woodpecker CI.
Root cluster workloads
Authentik, Cloudflared, CNPG, CrowdSec, CSI-S3, Forgejo, Garage, Gotify, Grafana, Grafana MCP, Loki, OpenEBS ZFS, Prometheus Agent, Stalwart, Tailscale Operator, Traefik, Uptime Kuma, Valkey, Vaultwarden, and Velero.
Repository Structure
.
├── apps/ # Helm wrapper charts (cluster/ + user/)
├── argocd/ # ArgoCD Application manifests
├── cluster/ # Bootstrap and environment configs
├── root/ # Root server k3s manifests and ArgoCD apps
├── tofu/ # Infrastructure as Code (OpenTofu, Proxmox)
├── ansible/ # Configuration management
├── docs/ # Documentation
└── tools/ # CI scripts, guards, and DevOps automation
See docs/layout.md for the authoritative structure specification.
Documentation
- docs/getting-started.md — Bootstrap, workflows, validation
- docs/layout.md — Repository structure
- docs/network-architecture.md — Full network and cluster architecture
- docs/cluster-placement.md — Node scheduling and placement
- docs/authentik-contract.md — Authentik integration modes
- AGENTS.md — Automation rules and GitOps enforcement
- docs/TODO.md — Active tasks
- docs/done.md — Completed milestones
Security
See .github/SECURITY.md for the responsible disclosure process.