Raven
192.168.20.21
Physical control-plane and worker node.
Longhorn dataInfrastructure atlas / current production
Homelab Architecture
Public and private traffic enter the Talos cluster directly. Application services run in Kubernetes; only named recovery and hardware integrations remain outside it.
Ingress VIP192.168.20.30
API VIP192.168.20.20
ClusterTalos / K8s v1.36
IngressTraefik / 3 replicas
Cloudflare
Public DNS, proxy, TLS edge, and origin protection.
Traefik VIP
192.168.20.30 via MetalLB. WAN forwards directly here; private home.eoleedi.com DNS also resolves here.
3 replicas
Kestrel
192.168.20.22
Control-plane and worker VM on Nebula.
Merlin
192.168.20.23
Control-plane and worker VM on Falcon.
Longhorn dataIdentity and platform
Authentik
SSO, policies, forward auth, and private LDAPS on 636.
PostgreSQL
Traefik
Three ingress replicas behind the MetalLB VIP.
cert-manager TLS
Cupola
Fallback response for unmatched homelab routes.
Longhorn
PVC replication on Raven and Merlin.
Encrypted NFS backupMonitoring
Prometheus
Cluster and infrastructure metrics.
Longhorn PVC
Grafana
Dashboards and observability interface.
PostgreSQL
Loki
Central log storage and queries.
Longhorn PVC
Alloy
Metrics and log collection agents.
Monitoring DB
PostgreSQL backing Grafana state.
Longhorn PVC
Alertmanager
Internal-only alert routing and delivery.
No public routeApplications
Paperless
Document ingestion, OCR, and archive.
PostgreSQLPVCs
Shlink
Public short-link service.
MariaDB
WordPress
Blog and publishing platform.
MariaDB
ESPHome
Runs on Merlin with PVC-only configuration.
Longhorn PVC
Twitch Miner
Channel points automation.
Longhorn PVC
Uptime Kuma
Service availability monitoring.
Longhorn PVC
Compatibility proxy
Falcon's only proxy exception; not the WAN ingress path.
Docker exception
Home Assistant
Kubernetes Traefik proxies this service through Falcon.
Docker exception
DSM
Synology management proxied by Kubernetes.
WebDAV
Synology-hosted file access service.
Nebula storage
NFS backup target
Encrypted Longhorn backups stored on Nebula.
Encrypted
Technitium DNS
Primary DNS service on Nebula at 192.168.60.10.
Private
Pi-hole
Independent DNS and recovery path.
Technitium DNS 02
Secondary DNS service on Blackberry at 192.168.60.11.
Private
MeshCentral
Remote management via its own Cloudflare Tunnel.
Dedicated tunnel
Longhorn replicas
Workload PVC data resides on Raven .21 and Merlin .23.
Replicated data
Backup target
Encrypted NFS backup destination on Nebula.
Daily / weekly protection