You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This repository contains the IaC ([Infrastructure as Code](https://en.wikipedia.org/wiki/Infrastructure_as_code)) configuration for my homelab.
38
38
39
-
Most of my homelab runs on **Proxmox**, with VMs managed and maintained using [OpenTofu](https://opentofu.org/). All VMs are cloned from templates I created with [Packer](https://www.packer.io/).
39
+
My homelab runs two infrastructure stacks: Kubernetes nodes provisioned with Talos Linux, and Proxmox VMs running Docker. All VMs are cloned from templates I created with [Packer](https://www.packer.io/). My Kubernetes nodes are all defined as code using Talos Linux. I have been migrating my Ubuntu VM's over to NixOS, see Nix config [here](https://github.com/Mafyuh/nixos) and going forward all VM's will be NixOS
40
40
41
-
All services are **containerized**, either managed with **Docker Compose** or **orchestrated with Kubernetes**. Over time, I've been migrating everything to Kubernetes using **[GitOps](https://en.wikipedia.org/wiki/DevOps) practices**, which is my long-term goal.
41
+
Everything is containerized — either managed with Docker Compose or orchestrated through Kubernetes. My long-term goal is to move it all to Kubernetes using **[GitOps](https://en.wikipedia.org/wiki/DevOps) practices**, and the migration is ongoing. Docker Compose sticks around mainly due to hardware limitations; scaling a homelab Kubernetes cluster means buying alot of hardware.
42
42
43
43
To automate infrastructure updates, I use **Github Actions**, which trigger workflows upon changes to this repo. This ensures seamless deployment and maintenance across my homelab:
44
44
@@ -53,24 +53,24 @@ For Secret management I use [Bitwarden Secrets](https://bitwarden.com/products/s
53
53
54
54
> Kubernetes is using External Secrets implementation of BWS, not official. BWS Access Key is SOPS encrypted.
55
55
56
-
**[GitGuardian](https://www.gitguardian.com/)** makes sure to alert me if I do accidentally push a secret
56
+
**[GitLeaks](https://github.com/gitleaks/gitleaks)** makes sure before every commit no secrets are exposed, **[GitGuardian](https://www.gitguardian.com/)** makes sure to alert me if something slips through GitLeaks.
57
57
58
58
Each container image is automatically scanned by **[Trivy](https://trivy.dev/latest/)**, with detected vulnerabilities published to **[Github Security](https://github.com/security)**
59
59
60
-
I use **Oracle Cloud** for their [Always-Free](https://www.oracle.com/cloud/free/) VM's and deploy Docker services that require uptime here. [Twingate](https://www.twingate.com/) is used to connect my home network to the various VPS's securely using [Zero Trust architecture](https://en.wikipedia.org/wiki/Zero_trust_architecture).
60
+
I use **RackNerd** for their very reasonably priced VPS and deploy Docker services that require uptime here. [Tailscale](https://www.tailscale.com/) is used to connect my home network to the various VPS's securely using [Zero Trust architecture](https://en.wikipedia.org/wiki/Zero_trust_architecture).
61
61
62
62
I use [**Cloudflare**](https://www.cloudflare.com/) for my DNS provider with [**Cloudflare Tunnels**](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/) to expose some of the services to the world. [**Cloudflare Access**](https://www.cloudflare.com/access/) is used as Zero Trust for public websites, this is paired with [**Fail2Ban**](https://www.fail2ban.org/) looking through all my reverse proxy logs for malicious actors who made it through [**Access**](https://www.cloudflare.com/access/) and banning them via [**Cloudflare WAF**](https://www.cloudflare.com/web-application-firewall/).
63
63
64
64
I also utilize Unifi's IDS/IPS for intrusion detection on my home network, and use **[Wazuh](https://wazuh.com/)** as a SIEM to monitor and generate security alerts across all my hosts.
65
65
66
66
### **📊 Monitoring & Observability**
67
67
68
-
I use a combination of **Grafana, Loki, Alloy, and Prometheus** with various exporters to collect and visualize system metrics, logs, and alerts. This helps maintain visibility into my infrastructure and detect issues proactively.
68
+
I use a combination of **Grafana, fluent-bit, VictoriaLogs and Prometheus** with various exporters to collect and visualize system metrics, logs, and alerts. This helps maintain visibility into my infrastructure and detect issues proactively.
69
69
70
70
-**Prometheus** – Metrics collection and alerting
71
-
-**Loki** – Centralized logging for containers and VMs
71
+
-**Victoria Logs** – Centralized logging
72
72
-**Grafana** – Dashboarding and visualization
73
-
-**Exporters** – Alloy, Blackbox Exporter, Speedtest Exporter, etc.
73
+
-**Exporters** – Blackbox Exporter, Speedtest Exporter, etc.
74
74
75
75
### ☁️ **Cloud Dependencies**
76
76
@@ -83,7 +83,7 @@ Although I try to self-host everything I can, my infra still relies on the cloud
83
83
|[OneDrive](https://www.microsoft.com/en-us/microsoft-365/onedrive/online-cloud-storage)| Takes backups of Proxmox VM's, Kubernetes PV's (will migrate to Proton Drive once there's proper Linux support) | Free (e5 dev) |
0 commit comments