GitOps-managed Kubernetes cluster running on Talos Linux with Flux CD and Renovate
This is a GitOps-managed Kubernetes home server with the following stack:
- Nodes: 5-node hybrid cluster (4x ARM64, 1x x86_64)
- OS: Talos Linux v1.13.9 (immutable, API-configured)
- Kubernetes: v1.36.4
- GitOps: Flux CD manages all workloads from this repository
- Storage: Miroir for persistent volumes, CloudNativePG for PostgreSQL databases, Dragonfly for caching
- Networking: Cilium CNI, Envoy Gateway, Cloudflare DNS/DDNS, Tailscale VPN
- Secrets: SOPS with AGE encryption + 1Password via External Secrets Operator (mostly this, some former)
Selective tree of the current Kubernetes categories and applications; nested implementation directories and most files are omitted. archive/ contains historical manifests and is not reconciled by Flux.
.
├── archive/ # Historical, non-reconciled manifests
└── kubernetes/
├── ai/
│ ├── firecrawl/
│ ├── hermes/
│ ├── llmkube/
│ ├── openwebui/
│ └── searxng/
├── books/
│ ├── audiobookshelf/
│ ├── bookorbit/
│ ├── libation/
│ ├── opds-proxy/
│ ├── shelfmark/ # Shelfmark Lite image variant
│ └── suwayomi/
├── components/ # Reusable components consumed indirectly
│ ├── kopiur/
│ └── kopiur-standalone/
├── games/ # Namespace only
├── infra/
│ ├── descheduler/
│ ├── flux/
│ ├── node-feature-discovery/
│ ├── nvidia-device-plugin/
│ ├── reflector/
│ ├── reloader/
│ ├── spegel/
│ └── tuppr/
├── media/
│ ├── autobrr/
│ ├── bazarr/
│ ├── cleanuparr/
│ ├── croc/
│ ├── flaresolver/
│ ├── jellyfin/
│ ├── jellyseer/ # Seerr; historical directory name
│ ├── prowlarr/
│ ├── qbittorrent/
│ ├── radarr/
│ ├── recyclarr/
│ └── sonarr/
├── misc/
│ ├── immich/
│ ├── sure/
│ ├── syncthing/
│ ├── tandoor/
│ └── zerobyte/
├── networking/
│ ├── cert-manager/
│ ├── cilium/
│ ├── envoy-gateway/
│ ├── external-dns/
│ └── tailscale/
├── observability/
│ ├── exporters/
│ ├── gatus/
│ ├── grafana/
│ ├── homepage/
│ ├── karma/
│ ├── kromgo/
│ ├── kube-prometheus-stack/
│ ├── metrics-server/
│ ├── prometheus-adapter/
│ ├── promxy/
│ ├── silence-operator/
│ └── victoria-logs/
├── projects/
│ └── colwiki/ # OtterWiki
├── security/
│ ├── authentik/
│ └── secrets/
└── storage/
├── databases/
│ ├── cloudnative-postgres/
│ └── dragonfly/
├── garage/
├── kopiur/
├── miroir/
└── snapshot-controller/
This inventory describes software configured in the repository, not verified live health. It includes principal applications, chart components, and support services, which do not always have their own directories; it is not an exhaustive list of transitive dependencies.
| Software | Category | Purpose |
|---|---|---|
| Audiobookshelf | Books | Audiobook and podcast library server. |
| BookOrbit | Books | Ebook library management and reading. |
| Libation | Books | Download and organize an Audible library. |
| Kindle OPDS Proxy | Books | Kindle-friendly access to OPDS catalogs. |
| Shelfmark Lite | Books | Book search and download interface using Shelfmark's Lite image variant. |
| Suwayomi | Books | Manga reader server. |
| Firecrawl | AI | Web crawling and extraction for AI-ready content. |
| Hermes | AI | Tool-using AI assistant with persistent memory. |
| LLMKube | AI | Kubernetes operator for local LLM inference. |
| Open WebUI | AI | Web interface for AI models. |
| SearXNG | Search | Privacy-respecting metasearch engine. |
| autobrr | Media Automation | Automated release monitoring and download dispatch. |
| Bazarr | Media Automation | Subtitle management for movies and TV shows. |
| Cleanuparr | Media Automation | Queue and download cleanup for *arr apps and download clients. |
| croc | File Transfer | Encrypted file transfer with a self-hosted relay. |
| Flaresolverr | Media Automation | Proxy for handling Cloudflare challenges. |
| Jellyfin | Media | Media server for movies, TV shows, and music. |
| Seerr | Media | Media discovery and request management; manifests remain in media/jellyseer. |
| Prowlarr | Media Automation | Indexer manager and proxy. |
| qBittorrent | Media Automation | BitTorrent client with a web interface. |
| Radarr | Media Automation | Automated movie download and management. |
| Recyclarr | Media Automation | Quality profile and custom format synchronization for *arr apps. |
| Sonarr | Media Automation | Automated TV show download and management. |
| Homepage | Dashboard | Customizable dashboard for services. |
| Immich | Photos | Self-hosted photo and video backup and management. |
| OtterWiki | Wiki | Git-backed wiki; manifests live in projects/colwiki. |
| Sure | Finance | Personal finance and account tracking. |
| Syncthing | Files | Continuous file synchronization. |
| Tandoor | Recipes | Recipe management and meal planning. |
| Zerobyte | Backups | Web-based backup management. |
| Software | Category | Purpose |
|---|---|---|
| Flux CD | GitOps | Continuous delivery for Kubernetes. |
| Descheduler | Node Management | Evicts pods according to policies so they can be rescheduled. |
| Node Feature Discovery | Node Management | Detects and labels node hardware features. |
| NVIDIA Device Plugin | Node Management | Exposes NVIDIA GPUs to Kubernetes workloads. |
| Reflector | Configuration | Mirrors ConfigMaps and Secrets across namespaces. |
| Reloader | Configuration | Triggers workload restarts on ConfigMap and Secret changes. |
| Spegel | Images | Stateless cluster-local OCI registry mirror. |
| Tuppr | Upgrades | Coordinates Talos Linux and Kubernetes upgrades. |
| Cert-Manager | Networking | Automated certificate management. |
| Cilium | Networking | eBPF-based networking, security, and observability. |
| Envoy Gateway | Networking | Kubernetes-native gateway powered by Envoy. |
| External DNS | Networking | Synchronizes Kubernetes resources with DNS providers. |
| Cloudflare DDNS | Networking | Updates Cloudflare DNS records when public IP addresses change. |
| Tailscale | Networking | WireGuard-based VPN connectivity. |
| Authentik | Security | Identity provider for SSO and authentication. |
| External Secrets Operator | Security | Synchronizes external secret stores into Kubernetes Secrets. |
| 1Password Connect | Security | API access to 1Password vault secrets for integrations. |
| CloudNativePG | Storage | PostgreSQL operator for Kubernetes. |
| Dragonfly | Storage | Redis/Memcached-compatible in-memory datastore. |
| Garage | Storage | Distributed S3-compatible object storage. |
| Miroir | Storage | Replicated block storage for Kubernetes. |
| Kopiur | Backups | Kubernetes volume backup and restore orchestration. |
| CSI Snapshot Controller | Storage | Manages Kubernetes volume snapshot resources. |
The kube-prometheus-stack deployment uses the Prom++ image. Its bundled Grafana is disabled; a separate Grafana Operator manages the Grafana instance.
| Software | Purpose |
|---|---|
| kube-prometheus-stack | Monitoring operators, Alertmanager, rules, and bundled metrics exporters. |
| Prom++ | Prometheus-compatible metrics collection and storage. |
| Grafana / Grafana Operator | Dashboards and visualization with operator-managed configuration. |
| Grafana MCP | MCP access to Grafana for AI tools. |
| VictoriaLogs / collector | Centralized log storage, querying, and cluster log collection. |
| Gatus | Endpoint health checks and status reporting. |
| Karma | Alertmanager dashboard. |
| Kromgo | Exposes selected Prometheus metrics through an HTTP API. |
| promxy | Unified query proxy across Prometheus-compatible backends. |
| Prometheus Adapter | Exposes Prometheus metrics through Kubernetes metrics APIs for autoscaling. |
| Silence Operator | Declarative Alertmanager silence management. |
| Metrics Server | Resource usage metrics for Kubernetes. |
| Kube State Metrics | Kubernetes object metrics; bundled with kube-prometheus-stack. |
| Node Exporter | Hardware and OS metrics; bundled with kube-prometheus-stack. |
| NVIDIA DCGM Exporter | NVIDIA GPU telemetry. |
| smartctl Exporter | Disk health and SMART metrics. |
| Speedtest Exporter | Internet connection throughput and latency metrics. |
| Device | Count | OS Disk Size | Data Disk Size | Ram | Operating System | Purpose |
|---|---|---|---|---|---|---|
| Turing RK1 | 4 | 2TB NVMe | - | 16GB | Talos v1.13.9 | ARM64 Cluster Nodes |
| Turing Pi 2 | 1 | - | - | - | - | Baseboard and KVM |
| CWWK AMD-7940HS | 1 | 1TB NVMe | 8TB HDD (2x) | 32GB | Talos v1.13.9 | x86_64 Cluster Node |