Homelab Infrastructure

GitOps-managed Kubernetes homelab built on Talos Linux, Sidero Omni, and ArgoCD.

           

---

Components

Platform

Component	Description
Talos Linux	Secure, immutable Kubernetes OS
Sidero Omni	Kubernetes cluster management
ArgoCD	GitOps continuous delivery

Networking

Component	Description
Cilium	eBPF CNI with BGP & Gateway API
cert-manager	TLS certificate automation
External DNS	DNS record management
Tailscale	VPN mesh networking

Storage

Component	Description
Rook Ceph	Distributed storage
Local Path Provisioner	Node-local storage
CSI Driver NFS	NFS storage provisioning

Observability

Component	Description
Prometheus	Metrics & alerting
Grafana	Visualization & dashboards
Loki	Log aggregation
Thanos	Long-term metrics storage

Security

Component	Description
External Secrets	Secret sync from Infisical
Velero	Backup & disaster recovery

Data & Compute

Component	Description
CloudNative PG	PostgreSQL operator
ClickHouse	Analytics database
GPU Operator	NVIDIA GPU support
vLLM	LLM inference server

---

Clusters

Cluster	Type	Purpose	Nodes
omni-local	Talos (Single Node)	Omni management cluster	1 CP
zendo	Talos (Omni-managed)	Production workloads	3 CP + 4 Workers
spark	RKE2	Edge/experimental	Variable

---

Repository Structure

homelab/
├── apps/                      # Application configs & Helm values
│   ├── argocd/                # ArgoCD + bootstrap chart
│   ├── argocd-apps/           # App-of-apps definitions
│   ├── cilium/                # CNI + BGP/Gateway config
│   ├── omni/                  # Self-hosted Omni + BMIP
│   └── .../                   # Other applications
└── clusters/                  # Cluster-specific configs
    ├── omni-local/            # Talos config (talhelper)
    └── zendo/                 # Omni-managed cluster

---

Omni Single-Node Cluster

Day 0 — Preparation

1. Install tools: talosctl, kubectl, talhelper, helm, infisical
2. Store secrets in Infisical at /omni/omni-local-cluster
3. Configure clusters/omni-local/talos-config/talconfig.yaml
4. Generate configs: just generate

Day 1 — Bootstrap

1. Boot node with Talos media
2. Apply config: talosctl apply-config --insecure --nodes <ip> --file <config>
3. Bootstrap cluster: talosctl bootstrap -n <ip>
4. Get kubeconfig: talosctl kubeconfig
5. Install CNI: Gateway API CRDs → Cilium → Cilium Config
6. Install External Secrets: Helm chart → Infisical auth secret → ClusterSecretStore
7. Install ArgoCD: Helm chart → argocd-init bootstrap chart

Day 2 — GitOps

ArgoCD manages everything via app-of-apps pattern:

argocd-init → argocd-apps → [all applications]

To add/update apps: Modify files in apps/, commit, push — ArgoCD auto-syncs.

---

Omni-Managed Bare Metal Cluster

Day 0 — Preparation

Option A: Download Talos image from Omni UI
Option B: Configure Bare Metal Infrastructure Provider for PXE boot

Day 1 — Build Cluster

1. Boot machines with Omni media — machines auto-register via SideroLink
2. Create cluster in Omni UI — assign control planes and workers
3. Apply config via Omni (automatic with patches)
4. Bootstrap components: Label nodes → Install Cilium → External Secrets → ArgoCD

Day 2 — GitOps

Same as omni-local. ArgoCD syncs cluster-specific values from apps/*/settings/zendo/.

---

Quick Reference

Cluster	Pod CIDR	Service CIDR	VIP
omni-local	10.11.0.0/16	10.12.0.0/16	10.96.10.100
zendo	10.111.0.0/16	10.112.0.0/12	10.96.10.150

Detailed bootstrap instructions: See clusters/omni-local/README.md

---

Resources

• Talos Linux · Sidero Omni · ArgoCD · Cilium