Infrastructure atlas / current production

Homelab Architecture

Public and private traffic enter the Talos cluster directly. Application services run in Kubernetes; only named recovery and hardware integrations remain outside it.

Ingress VIP192.168.20.30

API VIP192.168.20.20

ClusterTalos / K8s v1.36

IngressTraefik / 3 replicas

Highlight routes All paths visible

Public edge

Cloudflare

Public DNS, proxy, TLS edge, and origin protection.

Ingress

Traefik VIP

192.168.20.30 via MetalLB. WAN forwards directly here; private home.eoleedi.com DNS also resolves here.

3 replicas

Talos Kubernetes v1.36

API VIP 192.168.20.20 Wildcard TLS cert-manager Ingress MetalLB .30 Access Authentik forward auth

Raven

192.168.20.21

Physical control-plane and worker node.

Longhorn data

Merlin

192.168.20.23

Physical Talos control-plane and worker on Falcon.

Longhorn data

Supernova

192.168.20.24

Physical control-plane and worker node.

Longhorn data

Identity and platform

Authentik

SSO, policies, forward auth, and private LDAPS on 636.

PostgreSQL

Traefik

Three ingress replicas behind the MetalLB VIP.

cert-manager TLS

Cupola

Fallback response for unmatched homelab routes.

Longhorn

PVC replication on Raven, Merlin, and Supernova.

Encrypted NFS backup

Monitoring

Prometheus

Cluster and infrastructure metrics.

Longhorn PVC

Grafana

Dashboards and observability interface.

PostgreSQL

Loki

Central log storage and queries.

Longhorn PVC

Alloy

Metrics and log collection agents.

Monitoring DB

PostgreSQL backing Grafana state.

Longhorn PVC

Alertmanager

Internal-only alert routing and delivery.

No public route

Applications

Paperless

Document ingestion, OCR, and archive.

PostgreSQLPVCs

Shlink

Public short-link service.

MariaDB

WordPress

Blog and publishing platform.

MariaDB

ESPHome

Runs on Merlin or Supernova with PVC-only configuration.

Longhorn PVC

Twitch Miner

Channel points automation.

Longhorn PVC

Uptime Kuma

Service availability monitoring.

Longhorn PVC

Synology / Nebula

Home Assistant

HAOS VM on Nebula, routed through Kubernetes Traefik.

DSM

Synology management proxied by Kubernetes.

WebDAV

Synology-hosted file access service.

Nebula storage

NFS backup target

Encrypted Longhorn backups stored on Nebula.

Encrypted

Technitium DNS

Primary DNS service on Nebula at 192.168.60.10.

Private

Blackberry / independent

Technitium DNS 02

Secondary DNS service on Blackberry at 192.168.60.11.

Private

MeshCentral

Remote management via its own Cloudflare Tunnel.

Dedicated tunnel

Cluster data

Longhorn replicas

Workload PVC data resides on Raven .21, Merlin .23, and Supernova .24.

Replicated data

Nebula backup tier

Backup target

Encrypted NFS backup destination on Nebula.

Daily / weekly protection