Bare metal / GitOps / InfraSecOps

Homelab.

A four-node bare-metal Kubernetes platform for learning, testing security boundaries, and operating infrastructure through GitOps.

Explore the repository Read field notes
Architecture diagram: GitHub and Flux CD reconcile platform, services, infrastructure and workloads onto a four-node Kubernetes cluster, with secrets, identity and observability across the layers.
Repository architecture snapshot, 17 October 2026 · Declared state, not live cluster health · Open scalable diagram ↗

I use my homelab to test how infrastructure behaves after deployment: authentication, storage, upgrades, network policy, logging and recovery. The diagram above captures the declared architecture in Git rather than a live health or compliance assessment.

Four layers, separate responsibilities

  • Platform — Calico networking, MetalLB, Longhorn storage, KubeVirt, certificates, secret delivery and monitoring.
  • Services — Kong for API, LLM and MCP traffic, Authentik for OIDC, Cloudflare Tunnel, Pi-hole, Unbound and telemetry exporters.
  • Infrastructure — Vault, Argo CD, Headlamp, Portainer, SemaphoreUI, Ansible and the OpenClaw operations agent.
  • Workloads — Open WebUI, n8n, Forgejo, Vaultwarden, Homebox and other applications, plus KubeVirt virtual machines.

Built to change safely

The main cluster runs on four HP EliteDesk 800 G9 Mini PCs with Arch Linux: one control-plane node and three workers. Flux CD reconciles most Kubernetes resources. Argo CD ApplicationSet handles separate development, staging and production environments for Firewall Manager. Terraform and Ansible cover supporting configuration and lifecycle automation.

Identity and traffic pass through shared services rather than being repeated inside every workload. Vault supplies secrets through External Secrets; Prometheus, Loki and Grafana provide observability and alerts. The wider homelab also includes Synology and Raspberry Pi services, outside the main cluster shown here.

The source of truth, implementation details and operating notes are available in the homelabs GitHub repository . For specific problems and design decisions, see my field notes .