Bare-Metal Topology & Systems

Kubernetes Homelab

3-node bare-metal Kubernetes cluster (humberto, dosberto, tresberto) managed declaratively via GitOps with Argo CD, Oracle VPS WireGuard hybrid ingress, and resilient ZFS RAID-1 storage.

System Topology

Cluster Architecture & Ingress

Open full viewer (Guided tours, probe & export)

Bare-Metal Infrastructure

Physical Server Nodes

Live Status

Dedicated Hosts

3 Nodes

100% etcd Quorum

Compute Capacity

28 vCPUs

Intel 6th • 7th • 13th Gen

Cluster RAM

108 GB

DDR4 Host Memory

Usable ZFS Pool

3.6 TB

ZFS RAID-1 (2x 4TB HDDs)

#tresberto 03 Compute & Storage Primary

Controller + Worker

Chassis

Custom Tower Server x86_64

Processor 20 Threads

13th Gen Intel Core i5-13500 (14C/20T: 6P+8E)

Memory

64 GB DDR4

Storage SSD + HDD

1TB Kingston NVMe + 2x 4TB Seagate IronWolf

#humberto 01

Controller + Worker

Chassis

Intel NUC x86_64

Processor 4 Threads

Intel Core i3-6100U (2C/4T @ 2.30 GHz)

Memory

12 GB DDR4

Storage SSD

128 GB Kingston SSD (Boot & Local OS)

#dosberto 02

Controller + Worker

Chassis

Intel NUC x86_64

Processor 4 Threads

Intel Core i5-7260U (2C/4T @ 2.20 GHz)

Memory

32 GB DDR4

Storage SSD

128 GB Kingston SSD (Boot & Local OS)

Attached Device

Silicon Labs Zigbee 3.0 Coordinator

Data Sovereignty & Privacy

Zero Vendor Lock-In: Self-Hosted Cloud Alternatives

Photos & Media AI

Google Photos Immich

Self-hosted photo and video backup running on bare-metal with local OpenVINO machine learning pipelines for automated face recognition and CLIP semantic search.

Zero cloud telemetry, zero subscription fees, and complete media privacy.

Nextcloud replaces Google Drive

100% data sovereignty hosted on local ZFS storage pools.
Vaultwarden replaces 1Password

Master passwords and vaults never touch third-party cloud infrastructure.
MinIO replaces AWS S3

Standardized S3 API with zero egress bandwidth charges.
CloudNativePG replaces AWS RDS

Production-grade HA database without managed database lock-in.
AdGuard Home replaces Cloudflare 1.1.1.1

Blocks trackers across all IoT devices without client configuration.

Storage Subsystem

3-Tier Storage Engine

Durable block storage • NVMe cache • ZFS RAID-1 mirrors

Tier 01 Direct Local SSD

local-path Provisioner

Host SSD Folders • Node SSDs

Direct SSD I/O for PostgreSQL & local DBs

Tier 02 HA 3-Replica

Longhorn Block Storage

Replicated HA Block • 3-Node Quorum

Synchronous 3-node replica failover & snapshots

Tier 03 3.6 TB ZFS RAID-1

ZFS Mass Storage Pool

RAID-1 Mirror (2x 4TB) • tresberto (/media/zfs)

Resilient mass storage for Immich photos & docs

Reliability & Telemetry

Observability as Code

Declarative PrometheusRules • Grafana ConfigMaps • Telegram dispatch

Dashboards as Code

Declarative Grafana

Node Exporter • K8s Workloads • ZFS Telemetry

ConfigMap provisioned via GitOps

Alerts as Code

PrometheusRules & SLOs

Node Pressure • Pod CrashLoops • SMART Disks

Standardized declarative Alertmanager

Instant Dispatch

Telegram Real-Time Alerts

Instant Delivery • Firing & Resolved States

Direct Telegram bot contact points

Cluster Workloads

Workloads Directory

34 containerized applications in production

Security & Edge Ingress

Envoy Gateway

Triple Gateway API (vps-ingress, cloudflare-tunnel & internal)

WireGuard & HAProxy

Oracle VPS TCP SNI passthrough bastion

cert-manager

Automated Let's Encrypt TLS via DNS-01 webhook

external-dns

Dual sync: Public VPS (Bypass) & Cloudflare Tunnel (Zero Trust)

MetalLB

Layer 2 VIPs (.201 external / .200 internal)

Vaultwarden

Bitwarden-compatible self-hosted password vault

AdGuard Home

Network DNS sinkhole & encrypted upstream DoH

Sealed Secrets

Asymmetric GitOps secret decryption controller

Data Sovereignty & Storage

Immich (with ML)

Local OpenVINO AI face recognition & CLIP search

Nextcloud

Document sync, calendars, and private file storage

MinIO S3

High-throughput local S3-compatible object storage

CloudNativePG

High-availability PostgreSQL with S3 WAL archiving

Longhorn

Synchronous 3-replica distributed block storage

Observability & Alerting

Prometheus & Alertmanager

Node & pod metrics with Telegram alerts

Grafana & Loki

Centralized dashboards & structured cluster logs

Gatus

Real-time automated service health checks & SLA

smartctl-exporter

Direct SMART hard-drive health telemetry

GitOps Lifecycle & Automation

Argo CD

Declarative sync-waves & automated reconciliation

Ansible

Bare-metal OS provisioning, microcode & ZFS setup

kured

Disruption-free live kernel upgrades & node reboots

Renovate

Automated dependency updates via PR verification