shutthegoatup/homelab

homelab config. sdlc tooling in kubernetes

homelab

This is my homelab configuration.

It's a bunch of pet services in an on-prem KIND kubernetes cluster configured with terraform acting as an SDLC tooling cluster. I use this to bootstrap full automation for other projects, but as I'm the only user, services tend to have fairly liberal permissions, i.e. cluster-admin.

This repo should serve as an educational example of how you bootstrap the world when you're starting from scratch.

Configured services

The following services should:

• cleanly install
• avoid / not expose static secrets
• use single sign-on ( where applicaible )

They may have:

• a HA configuration
• service monitors
• testing suite

terraform/01_init_secrets

This stage loads secrets from external services into k8s.

These are:

• Google OIDC secrets for Workspace SSO.
• Github app secrets for various services.
• Cloudflare for DNS ( letsencrypt and external-dns )

I note the following concessions:

• We wanted to avoid static secrets. You can of course have vault mint tokens for these services, but in order to have a vault, you need to bootstrap it. The trick is to contain these secrets so they're shared with few people and easy to rotate.
• "From scatch" but I just dropped 3 cloud services. Pragmatism. If you do want to go full on-prem, I'll drop some solid alternatives. More likely you'll need a strategy to connect providers.

terraform/02_network

Services required to bootstrap the cluster to serve traffic.

• cilium
• ingress-nginx
• metallb
• cert-manager
• vault

terraform/03_observability

Services required to observe, monitor & autoscale other services.

• kube-prometheus
• metrics-server
• vertical-pod-autoscaler
• parca
• vault-config
• vault-secrets-operator

There's a bug with the vault provider where you can't configure and use it in the same run.

terraform/04_operators

Install operators used by other services

• postgres
• redis
• minio

Consumed by both cicd step a

terraform/05_cicd

Services required to bootstrap the cluster to serve traffic.

• argo (cd, events, rollouts)
• atlantis
• github actions runner controller
• harbor

We can now automatically run tests, deploy ephemeral environments, and promote production ready services.

homelab's Issues

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• Update Terraform harbor to v3.10.10
• Update Helm release cilium to v1.15.5
• Update Helm release tigera-operator to v3.28.0
• Update Terraform helm to v2.13.2
• Update Terraform kubernetes to v2.30.0
• Update Terraform vault to v3.25.0
• Update ghcr.io/bank-vaults/bank-vaults Docker tag to v1.31.0
• Update Terraform vault to v4
• Click on this checkbox to rebase all open PRs at once

Detected dependencies

github-actions

.github/workflows/manual.yaml

• actions/checkout v4

.github/workflows/pr.yaml

• actions/checkout v4

.github/workflows/scheduled.yaml

• actions/checkout v4

terraform

terraform/01_init_secrets/provider.tf

• helm 2.11.0
• kubernetes >= 2.11.0
• vault 3.20.1

terraform/02_network/main.tf

terraform/02_network/provider.tf

• helm 2.11.0
• kubernetes >= 2.11.0

terraform/03_observability/main.tf

terraform/03_observability/provider.tf

• helm 2.11.0
• kubernetes >= 2.11.0
• vault 3.20.1

terraform/04_operators/main.tf

terraform/04_operators/provider.tf

• helm 2.11.0
• kubernetes >= 2.11.0

terraform/05_cicd/main.tf

terraform/05_cicd/provider.tf

• harbor 3.10.2
• helm 2.11.0
• kubernetes >= 2.11.0
• vault 3.20.1

terraform/modules/actions-runner-controller/main.tf

• raw v0.3.2

terraform/modules/amd-gpu/main.tf

terraform/modules/argoproj/main.tf

terraform/modules/atlantis/main.tf

terraform/modules/calico/main.tf

• tigera-operator v3.26.1

terraform/modules/cert-manager/certmanager.tf

terraform/modules/cilium/main.tf

• cilium 1.14.2

terraform/modules/concourse/concourse.tf

terraform/modules/couchpotato/main.tf

terraform/modules/csi-driver-nfs/main.tf

terraform/modules/downloads/main.tf

terraform/modules/echoserver/main.tf

terraform/modules/external-dns/main.tf

terraform/modules/falco/main.tf

terraform/modules/foodnow/main.tf

terraform/modules/gitea/main.tf

terraform/modules/gitlab/main.tf

terraform/modules/harbor/main.tf

terraform/modules/harbor/versions.tf

• harbor >=3.10.0
• helm >=2.10.1
• kubernetes >= 2.11.0
• vault >=3.19.0
• hashicorp/terraform >= 1.0

terraform/modules/ingress/main.tf

• raw v0.3.2

terraform/modules/istio/main.tf

terraform/modules/kong/main.tf

terraform/modules/kube-prometheus-crds/main.tf

terraform/modules/kube-prometheus/main.tf

terraform/modules/loki/main.tf

terraform/modules/mailhog/main.tf

terraform/modules/matrix/main.tf

terraform/modules/metallb/main.tf

• raw v0.3.2

terraform/modules/metrics-server/main.tf

terraform/modules/minio-operator/main.tf

terraform/modules/oauth2-proxy/main.tf

terraform/modules/openebs/main.tf

terraform/modules/parca/main.tf

terraform/modules/plex/main.tf

terraform/modules/postgres-operator/main.tf

terraform/modules/redis-operator/main.tf

terraform/modules/secrets-management/main.tf

terraform/modules/secrets-management/modules/vault-config-manager/main.tf

• ghcr.io/bank-vaults/bank-vaults 1.20.4
• ghcr.io/bank-vaults/bank-vaults 1.20.4

terraform/modules/secrets-management/modules/vault-secrets-operator/main.tf

terraform/modules/secrets-management/modules/vault/main.tf

terraform/modules/unifi/main.tf

terraform/modules/vaultwarden/main.tf

• vaultwarden 5.3.2

terraform/modules/vertical-pod-autoscaler/main.tf

---

• Check this box to trigger a request for Renovate to run again on this repository