homelab

Infrastructure-as-code homelab running on Proxmox VE; learning virtualization, configuration management, Kubernetes, and GitOps workflows

Summary

I started this homelab back in December and its had 3-4 different repositories since. I wanted to take the time to clean it up and start using Terraform/Ansible more consistently where possible, resulting in this repository being created in April.

In late May, I prototyped the cluster bootstrap in danninx/talos-ha-bootstrap, and once that was done I adapted a lot of those methods here along with some additional infrastructure.

Overview

• Terraform/OpenTofu for provisioning virtual machines on Proxmox and bootstraps Talos Linux Kubernetes clusters with Cilium CNI and FluxCD.
• Ansible for configuring infrastructure services (DNS, secrets management, databases, reverse proxy, git hosting, SSO) on non-Kubernetes VMs using roles, vault-encrypted secrets, and dynamic inventory.
• FluxCD (GitOps) holds Kubernetes resources for declarative management, including infrastructure add-ons (Cilium BGP, ExternalDNS, cert-manager, Gateway API) and application deployments.

A Nix flake provides a reproducible development environment with all required tooling.

Project Structure

homelab/
├── terraform/
│   ├── modules/talos_cluster/    # Reusable module: provisions a Talos Linux K8s cluster on Proxmox
│   └── environments/
│       ├── infrastructure/       # Core infrastructure VMs (CoreDNS, Caddy, OpenBao, Authentik, Forgejo, PostgreSQL, storage)
│       └── staging/              # Staging Kubernetes cluster + OpenBao secret engine setup
├── ansible/
│   ├── playbooks/                # Proxmox preparation + infrastructure site playbook
│   └── roles/                    # Roles: coredns, etcd, caddy_cloudflare, postgres, openbao, authentik, forgejo, k8s_storage
├── kubernetes/
│   ├── clusters/staging/         # FluxCD bootstrap + sync orchestration
│   ├── crds/staging/             # CRDs (Gateway API)
│   ├── infrastructure/staging/   # Helm releases: Cilium, ESO, ExternalDNS, cert-manager, gateways, BGP
│   └── apps/staging/             # Application deployments (draw.io proof-of-concept)
├── docs/                         # Infrastructure documentation and operational notes
├── flake.nix                     # Nix flake for reproducible dev tooling
├── CHANGELOG.md                  # Project change history
└── TODO.md                       # Outstanding tasks and roadmap

Highlights

• Talos Linux cluster bootstrapped end-to-end via Terraform with custom image builds through Sidero's image factory.
• Cilium as the CNI with kube-proxy replacement, Gateway API support, and BGP peering with OPNsense for LoadBalancer IP advertisement.
• OpenBao as a Vault-compatible secrets manager, integrated with Terraform via AppRole and with Kubernetes via External Secrets Operator.
• FluxCD GitOps with a layered dependency chain ensuring infrastructure components are deployed in the correct order.
• Dynamic DNS via CoreDNS + etcd backend, used by ExternalDNS for automatic service discovery.
• Automated TLS for Kubernetes services via cert-manager with Let's Encrypt and Cloudflare DNS-01 challenges.

Changelog

Recent development activity can be found in CHANGELOG.md. Notable milestones:

• Cilium BGP + ExternalDNS — Dynamic networking setup validated end-to-end with a draw.io proof-of-concept deployment.
• cert-manager — Automated certificate signing with Let's Encrypt via Gateway API.
• OpenBao Terraform integration — AppRole authentication for infrastructure provisioning, Kubernetes auth for in-cluster secret consumption.
• FluxCD bootstrapping — Full GitOps pipeline with ordered dependency resolution across infrastructure components.