Homelab Kubernetes Cluster
Self-hosted k3s cluster on bare-metal with Gitea CI/CD, multi-arch builds, Authentik SSO, and ~15 running workloads.
Overview
A self-hosted Kubernetes cluster running on bare-metal hardware at home. The cluster serves as a platform for running personal services, experimenting with cloud-native tooling, and learning operational patterns without a cloud bill.
Hardware
| Host | Role | Specs |
|---|---|---|
| Minisforum UM780 XTX | K3s control-plane | AMD Ryzen 7 8745H |
| HP ProDesk (nik-debian) | K3s storage agent | NFS server, mergerfs media pool |
| Mac Mini M2 | Standalone Docker host | ARM, outside the cluster |
Stack
- Distribution: k3s
- Ingress: Traefik v3
- TLS: cert-manager — Let’s Encrypt (public) + internal CA (LAN)
- Auth: Authentik SSO — OIDC + forwardAuth proxy, TOTP MFA enforced
- DNS: Pihole (primary + secondary, externalIPs)
- Storage: NFS (Debian) + local-path dynamic provisioner
- CI/CD: Gitea Actions + act_runner, Docker buildx multiarch (amd64 + arm64)
- Registry: Gitea built-in container registry
- Observability: Prometheus + Grafana + Loki + Promtail
- IaC: Ansible (host-level), Helm + raw manifests (cluster-level), all tracked in Gitea
Highlights
- All cluster state is managed as code in a Gitea monorepo — single-file manifests per service, organised by concern
- Authentik SSO protects all web-facing services via Traefik forwardAuth; OIDC integrated with Gitea and Grafana
- Multi-arch image builds (amd64 + arm64) via buildx on every push to
main, pushed to the self-hosted registry - Dual-cert TLS strategy: internal CA for
*.home.arpaservices, Let’s Encrypt for*.nik4nao.compublic services - Pihole running as primary + secondary with externalIPs for LAN-wide DNS and ad-blocking
- DDNS CronJob keeps the public A record in sync via the Porkbun API
Running Workloads
Traefik, cert-manager, Pihole, Authentik, Gitea, Prometheus, Grafana, Loki, Promtail, Jellyfin, qBittorrent, JDownloader, Photoview, Dashy, Glances, DDNS CronJob, this portfolio site.
Status
Active and in daily use.