HomeLab

GitOps HomeLab

One VPS, declared in git.

A GitOps Kubernetes platform running real production apps on a single 1 vCPU / 4 GB node. Everything is declared in one repository; ArgoCD keeps the cluster matching it.

View the repo ArgoCD Grafana

Architecture

Merge to the git repository is the only deploy action. ArgoCD reconciles the cluster; Traefik terminates TLS and routes every hostname; cert-manager issues certificates automatically.

Homelab architecture

Infrastructure

Single-node k3s

Lightweight Kubernetes with Traefik, CoreDNS, and local-path storage in one binary. No etcd, state in sqlite.

Hardened host

SSH key-only, fail2ban, a firewalled node-exporter, and 2 GB swap. The host hardening is part of the bootstrap script.

Reproducible

One script turns a fresh VPS into the full platform. Migrating machines takes about thirty minutes.

Technologies

Every layer is open source and declared in the repository.

Applications and platform services

ChessKernel

chesskernel.com

Real-time multiplayer chess with Stockfish analysis and Glicko-2 ratings.

PixelHub

pixelhub.lab

A Gather-style 2D world with movement, proximity chat, and proximity voice.

Mixtape

mixtape.lab

An open MP3 jukebox with interactive 3D sound equipment (an MP3 click wheel and a CD player) that anyone can browse, play, and add tracks to.

Sotto

sotto.lab

Live English and Brazilian Portuguese transcription from browser tab or microphone audio, with AI-generated session summaries.

9Router

9router.lab

A self-hosted AI gateway providing model routing and rate-limit fallback for Claude Code, also used for Sotto summaries.

ArgoCD

argo.lab

The GitOps control plane and a live dashboard of every deployed app.

Grafana

grafana.lab

The curated HomeLab Overview dashboard, node health to per-app metrics.

Monitoring and networking

Monitoring

One curated Grafana dashboard covers VPS and Kubernetes health, ChessKernel and PixelHub activity, and Sotto and 9Router resource usage. Prometheus scrapes cluster-internal ChessKernel, PixelHub, and LiveKit metrics every minute.

Networking

One wildcard DNS record serves any number of hosts. Traefik routes by hostname (SNI) and cert-manager issues a Let's Encrypt certificate per host automatically.

Security

Secrets are sealed and safe in a public repo, TLS is everywhere, and the metrics endpoints are never exposed publicly.

Backups

A nightly database dump to Cloudflare R2 with guardrails that keep it inside the free tier.