mirror of
https://github.com/gwg313/homelab-gitops.git
synced 2026-06-05 21:41:03 +00:00
89 lines
2.2 KiB
Markdown
89 lines
2.2 KiB
Markdown
# Homelab Kubernetes – GitOps Repository
|
||
|
||
**Currently in process of major overhaul, so things may be a bit messy for a few days**
|
||
This repository contains the Kubernetes manifests and Helm configurations used to operate my self-hosted infrastructure.
|
||
|
||
The cluster runs on **Talos OS** and is fully managed using **ArgoCD** with the App-of-Apps pattern.
|
||
|
||
---
|
||
|
||
## Overview
|
||
|
||
All infrastructure and applications are declaratively defined in this repository.
|
||
|
||
Core components:
|
||
|
||
- Talos OS (Kubernetes distribution)
|
||
- ArgoCD (GitOps controller)
|
||
- Sealed Secrets (encrypted secret management)
|
||
- cert-manager (certificate automation)
|
||
- Istio (Gateways for ingress and reverse proxy)
|
||
- MetalLB (bare-metal load balancing)
|
||
|
||
---
|
||
|
||
## Repository Structure
|
||
|
||
```
|
||
├── apps/
|
||
├── audiobookshelf/
|
||
├── bytestash/
|
||
├── cert-manager/
|
||
├── cluster-issuer/
|
||
├── focalboard/
|
||
├── forgejo/
|
||
├── harbor-config/
|
||
├── hedgedoc/
|
||
├── karakeep/
|
||
├── linkwarden/
|
||
├── metallb/
|
||
├── minio/
|
||
├── navidrome/
|
||
├── sealed-secrets/
|
||
├── security/
|
||
├── stirling-pdf/
|
||
├── woodpecker/
|
||
├── yopass/
|
||
└── root-app.yaml
|
||
```
|
||
|
||
Each application directory contains the manifests or Helm values required to deploy the service.
|
||
|
||
`root-app.yaml` bootstraps all applications via ArgoCD.
|
||
|
||
---
|
||
|
||
## GitOps Structure
|
||
|
||
- `root-app.yaml` defines the parent ArgoCD application.
|
||
- Child applications are defined under `apps/`.
|
||
- Infrastructure components and services are separated by directory.
|
||
- The repository represents the desired state of the cluster.
|
||
|
||
---
|
||
|
||
## Secrets Management
|
||
|
||
Secrets are managed using **Bitnami Sealed Secrets**.
|
||
|
||
- Plain Kubernetes Secrets are sealed using `kubeseal`.
|
||
- Only encrypted SealedSecret resources are committed to Git.
|
||
- The Sealed Secrets controller decrypts them inside the cluster.
|
||
|
||
No unencrypted secrets are stored in this repository.
|
||
|
||
---
|
||
|
||
## Networking
|
||
|
||
### Load Balancing
|
||
|
||
MetalLB provides external IP addresses for services in the bare-metal cluster.
|
||
|
||
### Ingress & Reverse Proxy
|
||
|
||
Istio Gateways are used to expose services externally and handle reverse proxy functionality.
|
||
|
||
### TLS
|
||
|
||
cert-manager manages certificate issuance and renewal using configured ClusterIssuers.
|