Carlos' Homelab Topology

Bare-Metal k0s Cluster, 3-Gateway Ingress Architecture & GitOps

Carlos' Homelab Topology Bare-Metal k0s Cluster, 3-Gateway Ingress Architecture & GitOps Internet Clients · WAN & Zero Trust · Architecture component · Remote Users Internet Clients WAN & Zero Trust Remote Users LAN & Trusted VPN · 192.168.0.0/24 · Architecture component · Private Subnet LAN & Trusted VPN 192.168.0.0/24 Private Subnet Oracle VPS Ingress · HAProxy TCP Passthrough · Oracle Cloud (Madrid eu-madrid-1) · Madrid eu-madrid-1 · oracle.github.io Oracle VPS Ingress HAProxy TCP Passthrough Madrid eu-madrid-1 UniFi UDM Pro · WireGuard Gateway · Perimeter Gateway · 0 Open Router Ports · www.wireguard.com UniFi UDM Pro WireGuard Gateway 0 Open Router Ports Cloudflare Zero Trust · SSO & mTLS Challenge · Cloudflare Edge · Proxied Edge · Cloudflare Cloudflare Zero Trust SSO & mTLS Challenge Proxied Edge envoy-vps-ingress · MetalLB 192.168.0.201 · Triple Envoy Gateway API · Direct VPS Ingress · www.envoyproxy.io envoy-vps-ingress MetalLB 192.168.0.201 Direct VPS Ingress envoy-cloudflare-tunnel · cloudflared Pod In-Cluster · Triple Envoy Gateway API · Zero Trust Ingress · www.envoyproxy.io envoy-cloudflare-tunnel cloudflared Pod In-Cluster Zero Trust Ingress envoy-internal · MetalLB 192.168.0.200 · Triple Envoy Gateway API · *.internal.cspaez.org · www.envoyproxy.io envoy-internal MetalLB 192.168.0.200 *.internal.cspaez.org Public Web Apps · Portfolio & Web Services · Cluster Workloads & Microservices · Bypass Ingress Public Web Apps Portfolio & Web Services Bypass Ingress Smart Home & IoT · Home Assistant & Z2M · Cluster Workloads & Microservices · Zero Trust / LAN · www.home-assistant.io Smart Home & IoT Home Assistant & Z2M Zero Trust / LAN Media Stack & Cloud · Immich, Nextcloud, Vault · Cluster Workloads & Microservices · Zero Trust / LAN · nextcloud.com Media Stack & Cloud Immich, Nextcloud, Vault Zero Trust / LAN Observability · Grafana, Prometheus, Loki · Cluster Workloads & Microservices · Zero Trust / LAN · Grafana Observability Grafana, Prometheus, Loki Zero Trust / LAN ArgoCD GitOps · App-of-Apps Sync · GitOps & Secret Management · Continuous Delivery · Argo ArgoCD GitOps App-of-Apps Sync Continuous Delivery Sealed Secrets · Bitnami Controller · GitOps & Secret Management · Asymmetric Crypt Sealed Secrets Bitnami Controller Asymmetric Crypt 3-Node Control Plane · humberto · dosberto · tresberto · Cluster Nodes & Control Plane · k0s v1.35.4 · Kubernetes 3-Node Control Plane humberto · dosberto · tresberto k0s v1.35.4 Ansible Orchestrator · OS & Ingress Playbooks · Cluster Nodes & Control Plane · Infra as Code · Ansible Ansible Orchestrator OS & Ingress Playbooks Infra as Code CloudNativePG · HA 3-Instance Primary/Replica · Tiered Persistence & Storage · Durable DB · PostgreSQL CloudNativePG HA 3-Instance Primary/Replica Durable DB Storage Fabric · Longhorn RWO & ZFS LocalPV · Tiered Persistence & Storage · NVMe / ZFS Pool · longhorn.io Storage Fabric Longhorn RWO & ZFS LocalPV NVMe / ZFS Pool WireGuard Oracle Cloud (Madrid eu-madrid-1) Perimeter Gateway Cloudflare Edge Triple Envoy Gateway API Cluster Workloads & Microservices GitOps & Secret Management Cluster Nodes & Control Plane Tiered Persistence & Storage Legend Ingress / Gateway Workload & Service Storage & DB Cloud & Nodes Security & GitOps External

3-Gateway Ingress & Zero Trust Edge

  • • envoy-vps-ingress (192.168.0.201): Direct DNS bypass (Grey Cloud) via Oracle Cloud VPS and WireGuard for public web workloads
  • • envoy-cloudflare-tunnel: Proxied Zero Trust traffic (Orange Cloud) with SSO authentication and mTLS challenge
  • • envoy-internal (192.168.0.200): Private LAN & WireGuard VPN ingress strictly serving *.internal.cspaez.org locally
  • • HAProxy TCP Passthrough: Passes raw TLS on :80/:443 in Madrid eu-madrid-1 without terminating certificates on the cloud VPS

GitOps & Infrastructure Automation

  • • ArgoCD App-of-Apps: Declarative GitOps reconciliation from Git repositories across all cluster workloads
  • • Bitnami Sealed Secrets: Asymmetric public-key cryptography allowing safe storage of encrypted secrets in Git
  • • cert-manager: Automated Let's Encrypt wildcard certificate provisioning via DNS-01 challenges across all gateways
  • • ExternalDNS: Synchronizes Kubernetes HTTPRoutes with Cloudflare DNS records and appropriate proxying flags

Compute Nodes & Tiered Persistence

  • • 3-node High-Availability bare-metal cluster (humberto, dosberto, tresberto) running k0s v1.35.4
  • • CloudNativePG provides HA PostgreSQL clusters across all 3 nodes with automated replication and failover
  • • Longhorn distributed block storage handles resilient RWO persistent volumes with Recreate deployment strategies
  • • ZFS LocalPV yields raw high-throughput storage for Nextcloud, MinIO, and the 1.3TB+ Immich & Media pools