home-cluster - GitLite

KO | EN

gitlite — search

#hacktoberfest #ai #typescript #android #machine-learning #nodejs #windows #kubernetes #awesome-list #security #mcp #ios #openai #open-source

home-cluster

(★ 152)

Talos cluster using gitops and renovate automation

파일 탐색기

최종 버전 다운로드 (.zip)

- - actionlint.yaml
- - jscpd.json
- - labeler.yaml
- - .markdownlint.yaml
- - .prettierignore
  - .prettierrc.yaml
- - .yamllint.yaml
- - autoMerge.json5
  - customManagers.json5
  - disabledDatasources.json5
  - grafanaDashboards.json5
  - groups.json5
  - semanticCommits.json5
  - versioning.json5
- - flux-hr-image-test.yaml
  - lint.yaml
  - meta-labeler.yaml
  - terraform-publish.yaml
  - terraform.yaml
- CODEOWNERS
- renovate.json5
- - docker-compose.yaml
  - generate.sh
- - age-key.yaml
  - github-app.yaml
  - github-deploy-key.yaml
  - onepassword.yaml.j2
- bootstrap.sh
- README.md
- - .gitignore
- helmfile.yaml
- README.md
- talconfig.yaml
- talenv.yaml
- talsecret.sops.yaml
.gitignore
.mise.toml
.sops.yaml
LICENSE
README.md

# 설치 가이드

1. 코드 내려받기

git clone https://github.com/larivierec/home-cluster

깃허브에서 프로젝트 코드 전체를 내 컴퓨터로 내려받습니다.

cd home-cluster

방금 내려받은 프로젝트 폴더 안으로 이동합니다.

2. Docker

쉬움 추천

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
Docker Desktop 컨테이너를 빌드하고 실행하려면 필요합니다. 설치 후 실행해서 백그라운드에 켜두세요.

⚠️ 이 프로젝트는 규모가 큰 저장소라, 이 방법이 실제 핵심 제품이 아니라 내부 하위 패키지를 가리키는 것일 수 있습니다. README 전체를 함께 확인해보세요.

docker compose -f bootstrap/bitwarden-sdk/docker-compose.yaml up -d --build

compose 설정 파일에 정의된 서비스들을 대상으로 명령을 실행합니다.

✅ 터미널에 docker compose ps 를 입력해 컨테이너들이 Up 상태인지 확인하세요. README에 포트 번호가 적혀있다면 브라우저에서 http://localhost:포트번호 로 접속해보세요.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

<div align="center">

<img src="https://avatars.githubusercontent.com/u/61287648?s=200&v=4" align="center" width="144px" height="144px" alt="kubernetes"/>

## Home Kubernetes cluster

</div>

<br/>

<div align="center">

[![Talos](https://kromgo.garb.dev/badges/talos_version)](https://www.talos.dev/)&nbsp;&nbsp;
[![Kubernetes](https://kromgo.garb.dev/badges/kubernetes_version)](https://www.talos.dev/)&nbsp;&nbsp;

[![Discord](https://img.shields.io/discord/673534664354430999?color=7289da&label=DISCORD&style=for-the-badge)](https://discord.gg/home-operations)&nbsp;&nbsp;
[![renovate](https://img.shields.io/badge/renovate-enabled-brightgreen?style=for-the-badge&logo=renovatebot&logoColor=white)](https://github.com/renovatebot/renovate)

</div>

<div align="center">

[![Age](https://kromgo.garb.dev/badges/cluster_age_days)](https://github.com/home-operations/kromgo/)&nbsp;&nbsp;
[![Uptime](https://kromgo.garb.dev/badges/cluster_uptime_days)](https://github.com/home-operations/kromgo/)&nbsp;&nbsp;
[![Nodes](https://kromgo.garb.dev/badges/cluster_node_count)](https://github.com/home-operations/kromgo/)&nbsp;&nbsp;
[![Pods](https://kromgo.garb.dev/badges/cluster_pod_count)](https://github.com/home-operations/kromgo/)&nbsp;&nbsp;
[![CPU](https://kromgo.garb.dev/badges/cluster_cpu_usage)](https://github.com/home-operations/kromgo/)&nbsp;&nbsp;
[![Memory](https://kromgo.garb.dev/badges/cluster_memory_usage)](https://github.com/home-operations/kromgo/)&nbsp;&nbsp;
[![Power](https://kromgo.garb.dev/badges/cluster_power_usage)](https://github.com/home-operations/kromgo/)

</div>

---

# Overview

A monorepo that collects the pieces needed to run my homelab Kubernetes cluster and services. It contains infrastructure, cluster manifests, helper scripts and small service projects. The repo is organized to keep infra, apps and bootstrap tooling together so a single place holds the canonical manifests and generation scripts.

## High level

- Monorepo: infra, Kubernetes manifests, bootstrap helpers and service code live together.
- Goal: reproducible, git-driven cluster configuration (Flux + sops) with a small Bootstrap helper to generate local TLS material and secrets.
- Primary features used: Cilium for networking, Gateway API driven by Envoy (envoy-gateway) for ingress & edge, and 1Password as the external secrets provider.

## Kubernetes

### Core components

- Kubernetes manifests
	- Path: `kubernetes/main/...` — apps and components are organized per-namespace and per-app.
	- Flux and GitOps friendly YAML layout (Flux will pick manifests from the cluster repo).

- Networking: Cilium
	- Cluster CNI: Cilium handles L3/L4 networking, policy and load-balancing.

- Ingress / edge: Gateway API + Envoy (envoy-gateway)
	- Gateway resources live under `kubernetes/main/apps/networking/gateway/envoy/manifests`.
	- Uses Gateway API (Gateway, HTTPRoute, Backend, BackendTLSPolicy, BackendTrafficPolicy, ClientTrafficPolicy) to explicitly configure client TLS and upstream TLS.

- Secrets & Secrets provider
	- ExternalSecrets configuration lives under `kubernetes/main/apps/kube-system/external-secrets/...`.
	- A ClusterSecretStore is configured to use 1Password Connect as the secrets provider.

### External Secrets flow

- The external-secrets operator pulls secrets from 1Password Connect.
- The ClusterSecretStore config points at the 1Password Connect server:
	- File: `kubernetes/main/apps/kube-system/external-secrets/stores/secret-store.yaml`
	- Note: 1Password Connect credentials are stored as Kubernetes secrets and referenced by the ClusterSecretStore.

### TLS, certificates and common pitfalls

- Two separate TLS problems commonly show up:
	1. Client TLS (client → Gateway): configure the Gateway listener with `certificateRefs` pointing at a TLS secret in the Gateway's namespace (e.g., `networking`).
	2. Upstream TLS (Gateway/Envoy → backend): configure `Backend` and `BackendTLSPolicy` to instruct Envoy how to speak TLS to upstream services: trust/CA, SNI/hostname, min/max TLS versions. Secrets referenced for upstream trust must be accessible to the Gateway/controller namespace.

### Where to look (quick map)
- Bootstrap
	- `bootstrap/bootstrap.sh` (creates Flux secrets including age key and GitHub credentials)

- Gateway (Envoy)
	- `kubernetes/main/apps/networking/gateway/envoy/manifests/gateway.yaml`
	- `kubernetes/main/apps/networking/gateway/envoy/manifests/backend-policy.yaml`

- ExternalSecrets store
	- `kubernetes/main/apps/kube-system/external-secrets/stores/secret-store.yaml`

### Quick commands
- Bootstrap Flux secrets:
```bash
bash bootstrap/bootstrap.sh
```

# Nodes/Hardware

| Device                    | Count | OS Disk Size            | Data Disk Size              | Ram  | Operating System | Purpose              |
| --------------------------|-------|-------------------------|-----------------------------|------|------------------|--------------------- |
| MS-01                     | 3     | 250Gi NVMe              | 1Ti U.2 NVMe                | 64Gi | Talos            | Kubernetes           |
| Synology RS1221+          | 1     | 36Ti  HDD / 2Ti NVMe    | -                           | 4Gi  | DSM 7            | NAS                  |
| UDM Pro Max               | 1     |                         | -                           |  -   |                  | Router / Gateway     |
| Unifi Core Switch XG-16   | 1     |            -            | -                           |  -   |                  | Switch               |
| Unifi Enterprise 24 PoE   | 1     |            -            | -                           |  -   |                  | Switch               |
| Unifi Flex 2.5G PoE       | 1     |            -            | -                           |  -   |                  | Switch               |
| Unifi Flex 2.5G Mini      | 1     |            -            | -                           |  -   |                  | Switch               |
| Unifi PDU Pro             | 1     |            -            | -                           |  -   |                  | Power Delivery       |

---

#### Extra Documentation

1. [frigate](kubernetes/main/apps/home/frigate/README.md)
2. [scrypted](kubernetes/main/apps/home/scrypted/README.md)

## ⭐ Stargazers

[![Star History Chart](https://api.star-history.com/svg?repos=larivierec/home-cluster&type=Date)](https://www.star-history.com/#larivierec/home-cluster&Date)

## 🤝 Gratitude and Thanks

Thanks to all the people who donate their time to the [Home Operations](https://discord.gg/home-operations) Discord community. Be sure to check out [kubesearch.dev](https://kubesearch.dev/) for ideas on how to deploy applications or get ideas on what you may deploy.

- onedr0p
- bernd-schorgers / bjw-s
- buroa
- joryirving
- [home-operations](https://github.com/home-operations)

For all their hard work and dedication