Three Talos Kubernetes clusters today: core, dev, and prod. A fourth is coming once the second site is live. Etcd has three votes everywhere. DNS rides a VIP. The edge splits into internal and public gateways. The whole thing is declared in git, delivered by ArgoCD, watched by a self-hosted LGTM stack. This site is served from it.
Four design principles run through the lab. The rest of the page shows how each one is wired up.
Every Talos cluster runs a three-node etcd quorum. Three Technitium DNS instances sit behind a keepalived VIP with AXFR replication. Storage replication and LGTM HA aren’t there yet — the HA diagram below shows where each one stands.
Services self-heal through Kubernetes. The edge is split: internal and public traffic land on separate Envoy Gateways, each with its own IPs and policies. Per-cluster Cloudflare tunnels run two replicas. Private PKI and observability are still single-instance, and both are queued for HA work.
Every change is a commit. ArgoCD reconciles workloads, Talos holds cluster state, Ansible holds host state. Rollbacks are a git revert and a webhook. Production promotions go through an auto-generated PR that a human still has to merge.
A second AZ is wired up over a UniFi site-to-site VPN. The hardware is mid-move between sites right now, so production is on one AZ until it lands. DNS zones, cluster naming, and storage all already assume a second site, so adding it back is an addition rather than a rewrite.
Five layers between bare metal and a running pod. Every one of them is boring, which is the point. Adding a new app on top barely touches the stack below.
Every app ships the same way. Push to main, CI builds and publishes an image, a dispatch event tells the homelab repo to bump the tag, ArgoCD reconciles, Talos rolls. Prod promotions go through an auto-generated PR that a human still has to merge.
Three tiers of physical compute. Production runs straight on bare-metal EliteDesks, so there's no hypervisor in the critical path. The Proxmox hosts carry the core and dev clusters as VMs. Edge services like DNS and load balancing, plus storage, sit on Raspberry Pis and TrueNAS boxes. The second AZ's bare-metal tier will mirror this one once the move finishes.
Web traffic only enters through a Cloudflare Tunnel that opens outbound. No HTTP service has an inbound port forward. Six VLANs segment by trust tier. The firewall denies between tiers by default and only allows what's needed (Trusted Clients → Servers, plus a few IoT exceptions).
Reliability is never finished. The left column is what's already redundant. The right column is what still runs as a single instance, with the next step lined up for each one.
Bare-metal Talos nodes are configured through talosctl, so they show up in the cluster topology above but not in this roster. The roster below is generated from the homelab's inventory file, so it reflects whatever is actually deployed.
Media library automation on a dedicated VM.
Technitium DNS — 3 instances behind a keepalived VIP. rpi-n1 is the primary; dns-n2 + dns-n3 are secondaries.
Self-hosted Loki + Grafana + Tempo + Mimir stack.
ZFS storage with Cloud Sync + RSync for 3-2-1 backup.
Hypervisor hosts running most VM-backed clusters.
Low-power utility nodes — rpi-n1 runs the DNS primary; rpi-n2 is the edge load balancer.
Pelican game-server control plane on the untrusted VLAN.
Physical hosts, hypervisor, networking
Immutable OS, 3 Talos clusters, MetalLB L2
The cloud-native plane that ties it all together
LGTM stack, self-hosted
GitOps end-to-end, PRs promote dev → prod
Workloads shipped from personal repos