# Homelab Kubernetes – GitOps Repository

**Currently in process of major overhaul, so things may be a bit messy for a few days**
This repository contains the Kubernetes manifests and Helm configurations used to operate my self-hosted infrastructure.

The cluster runs on **Talos OS** and is fully managed using **ArgoCD** with the App-of-Apps pattern.

---

## Overview

All infrastructure and applications are declaratively defined in this repository.

Core components:

- Talos OS (Kubernetes distribution)
- ArgoCD (GitOps controller)
- Sealed Secrets (encrypted secret management)
- cert-manager (certificate automation)
- Istio (Gateways for ingress and reverse proxy)
- MetalLB (bare-metal load balancing)

---

## Repository Structure

```
├── apps/
├── audiobookshelf/
├── bytestash/
├── cert-manager/
├── cluster-issuer/
├── focalboard/
├── forgejo/
├── harbor-config/
├── hedgedoc/
├── karakeep/
├── linkwarden/
├── metallb/
├── minio/
├── navidrome/
├── sealed-secrets/
├── security/
├── stirling-pdf/
├── woodpecker/
├── yopass/
└── root-app.yaml
```

Each application directory contains the manifests or Helm values required to deploy the service.

`root-app.yaml` bootstraps all applications via ArgoCD.

---

## GitOps Structure

- `root-app.yaml` defines the parent ArgoCD application.
- Child applications are defined under `apps/`.
- Infrastructure components and services are separated by directory.
- The repository represents the desired state of the cluster.

---

## Secrets Management

Secrets are managed using **Bitnami Sealed Secrets**.

- Plain Kubernetes Secrets are sealed using `kubeseal`.
- Only encrypted SealedSecret resources are committed to Git.
- The Sealed Secrets controller decrypts them inside the cluster.

No unencrypted secrets are stored in this repository.

---

## Networking

### Load Balancing

MetalLB provides external IP addresses for services in the bare-metal cluster.

### Ingress & Reverse Proxy

Istio Gateways are used to expose services externally and handle reverse proxy functionality.

### TLS

cert-manager manages certificate issuance and renewal using configured ClusterIssuers.