mirror of
https://github.com/vhaudiquet/homeprod.git
synced 2026-09-25 10:23:31 +00:00
kosmosandvhaudiquet
e242b2ddce
The operator's managed policy is default-deny with egress limited to DNS and TCP 443, so reaching a LAN service on any other port is dropped. Measured against 10.4.1.222 from inside the pod: 443 returns RST while 7020 times out, so routing is fine and the port is what gets refused. Add a supplementary egress policy admitting 10.0.0.0/8, excluding the service (10.96.0.0/12) and pod (10.244.0.0/16) CIDRs so this does not grant every pod a path out. No port list: the point is arbitrary LAN services. Registered in the directory kustomization alongside the existing mail and radicale egress policies.
homeprod
Personal home production environment mono-repo
Hardware and operating systems
Dell R740
Specifications :
2* Intel Xeon Gold 6138 @ 2GHz (20 cores, 40 threads)
144 GiB DDR4 ECC RAM
2* 2 TiB SAS SSD (mirror)
10Gbps 4* RJ45 network card
H730P, 16* SFF 2.5 drive bays
SAS9300-8E external SAS card
NVIDIA RTX 3060 12G graphics card
Running as single-node Proxmox, with multiple VMs and LXC containers.
Lenovo P330
Running as a Talos/Kubernetes cluster node, for failover deployment.
Raspberry Pi 4
Running as a Talos/Kubernetes cluster node, for quorum only.
Software stack(s)
Docker swarm machine
| Icon | Software | Description |
|---|---|---|
 |
Debian Linux | Operating system |
 |
Docker Swarm | Container orchestrator |
  |
Infrastructure applications | Authentik, Stalwart Mail for authentication and internal emails |
  |
Repository applications | Gitea, Harbor to store code and images |
  |
Production applications | Personal applications running on the server |
Debian and docker / docker swarm are deployed by Terraform, which also deploys SwarmCD ; then the stacks are deployed by SwarmCD.
Kubernetes one-node cluster
| Icon | Software | Description |
|---|---|---|
 |
Talos Linux | Kubernetes operating system |
 |
Kubernetes | Container orchestrator |
 |
Cilium | Container Network solution |
 |
Flux | GitOps CD controller |
 |
csi-driver-nfs | NFS Container Storage solution |
 |
external-dns | Automatic ingress DNS mapping |
|
Infrastructure applications | Authentik, Stalwart Mail for authentication and internal emails |
|
Repository applications | Gitea, Harbor to store code and images |
| |
Production applications | Personal applications running on the cluster |
Talos Linux, Cilium and Flux are deployed using Terraform; then Flux takes over and deploys the whole kubernetes folder of this repository.
Production/personal applications
This setup allows running multiple applications, either self-hosted applications for home/self usage or to run my own applications as production.
Production
| Icon | Software | Description |
|---|---|---|
|
BuildPath | https://buildpath.win, website for League of Legends champion builds |
 |
vhaudiquet.fr | https://vhaudiquet.fr, personal website |
Personal applications
| Icon | Software | Description |
|---|---|---|
|
Home Assistant | Home automation software |
 |
Jellyfin | Personal media system |
 |
Paperless | Personal document manager |
 |
Photoprism | Personal photo gallery |
 |
Hedgedoc | Shared markdown notes |
 |
Excalidraw | Hand-draw like diagrams |
 |
Stirling PDF | PDF multi-tool |
 |
Tandoor Recipes | Personal recipes manager |
 |
Syncthing | File synchronization |
 |
Gramps | Personal genealogical tool |
 |
Navidrome | Personal music streaming service |
 |
TubeArchivist | YouTube archiver |
 |
Radicale | Calendar and contacts server |
Docs (internal, using this repository)
This repository uses pre-commit hooks to automate tasks like file encryption and configuration generation.
After cloning, install the pre-commit hooks:
pre-commit install