Kubernetes Home Lab
Raspberry Pi 5 · K3s · GitOps · Cloudflare
Production-style platform migrated from Docker to a K3s cluster with zero downtime for critical services — declarative GitOps with ArgoCD, automated TLS, and a full observability stack. This site is served from that cluster.
Kubernetes Home Lab
Self-hosted platform · Raspberry Pi 5 · K3s · GitOps · Cloudflare
Overview
A production-style self-hosted platform running on a K3s cluster (Raspberry Pi 5, NVMe storage), migrated progressively from a Docker-based setup with zero downtime for critical services like the password manager. Every workload is declared as Kubernetes manifests in a Git repository and reconciled by ArgoCD — the same GitOps workflow used in real production platforms. This very CV is one of the applications deployed on the cluster.
Architecture — hybrid by design
-
K3s single-node cluster with Traefik as
Ingress Controller and
local-pathpersistent volumes on NVMe — designed with multi-node expansion in mind (namespaces, affinity, storage strategy). - Automated TLS with cert-manager and Cloudflare DNS-01 challenges; DNS records kept in sync with dynamic-DNS deployments running in the cluster.
- Failure-domain separation: WireGuard VPN and Pi-hole (with Unbound as recursive resolver) stay outside the cluster on purpose — remote access and DNS survive even if Kubernetes goes down.
- Docker retained at the edge for network-adjacent services: Nginx Proxy Manager, Unbound, WireGuard UI, Portainer, and Watchtower for automated image updates.
GitOps workflow
- CI with GitHub Actions: every push builds an ARM64 image tagged with the commit hash, seals cache-busting versions at build time, and writes the new tag back to the manifests repo — ArgoCD does the rest. Zero manual deploys.
- ArgoCD app-of-apps pattern: separate Application sets for apps, infrastructure, and web apps, all synced automatically from GitHub.
-
Secrets never touch Git —
secret.example.yamltemplates document each required Secret, real values live only in the cluster. - Repository organized as a platform: manifests per app, core cluster config, runbooks, and backup/install scripts.
Workloads
Stateful and stateless services with PVCs on NVMe: Vaultwarden (passwords), Firefly III + Importer (personal finance, with MySQL), n8n (automation), Wiki.js, Trilium, Stirling-PDF, and this portfolio site.
Observability
- kube-prometheus-stack (Prometheus + Grafana) deployed via Helm with version-controlled values.
- Centralized logging with Loki + Promtail (DaemonSet), plus cAdvisor for container metrics.
- Alertmanager routing cluster alerts to Slack.
Stack & tooling
Highlights
- Phased Docker → K3s migration (stateless first, then stateful, then databases) with backups and runbooks before every risky step — no data loss, no downtime.
-
Full GitOps: the cluster state is reproducible from the
repository; manual
kubectl applyis the exception, not the rule. - Wildcard TLS automated end-to-end with cert-manager + Cloudflare — no manual certificate handling.
- Deliberate reliability engineering: core network services (VPN, DNS) isolated from the cluster's failure domain.
- Encrypted remote administration over WireGuard only; hardening baseline with SSH key-only auth, Fail2Ban, and network-wide ad/tracker blocking via Pi-hole → Unbound.