Homelab

This repository documents my personal homelab infrastructure and GitOps journey. It is intentionally public-safe: no secrets, private keys, kubeconfigs, or internal-only configuration is committed.

Hardware

• Server: HP Proliant DL380 G9
• Switch: Cisco WS-C3560CX-12-TC-S
• Access Point: Ubiquiti UniFi AC Lite

Core Platform

• Virtualization: Proxmox
• Firewall / Router: OPNsense
• Kubernetes: RKE2 (managed via Rancher, cis compliant)
• GitOps: Argo CD

DNS & Identity

• DNS: AdGuard Home
  • Upstream: Unbound
  • Internal zones / identity integration: FreeIPA
    • home.arpa
    • mgmt.home.arpa
    • app.home.arpa
• User & Access Management: FreeIPA (SSO / centralized authN/authZ)

Storage & Cloud

• NAS: TrueNAS
• Cloud (Self-hosted): Nextcloud

Kubernetes Networking & Security

Cilium (eBPF-based CNI)

Full kube-proxy replacement with native eBPF datapath:

• Routing: Native routing, bpf.masquerade, bpf.tproxy, BBR congestion control
• Load Balancing: LB-IPAM (pool 192.168.20.200–250), L2 announcements, BGP (AS 64501 ↔ OPNsense AS 64500)
• Gateway API: v1.4.1 Experimental channel with embedded Envoy proxy

Encryption & Mutual Authentication (Phase 2)

WireGuard transparent encryption — all pod-to-pod traffic between nodes is encrypted at the kernel level. Strict mode enabled: unencrypted inter-node pod traffic is dropped (no plaintext fallback). Control-plane node is opted out of NodeEncryption (host-network traffic already TLS-protected), with allowRemoteNodeIdentities: true to permit those flows.

SPIRE mutual authentication — every workload receives a SPIFFE SVID (X.509 identity) from a dedicated SPIRE infrastructure (trust domain: spire.cilium):

Component	Scope	Details
SPIRE Server	1 replica, StatefulSet	Longhorn 1Gi PV, cilium-spire namespace
SPIRE Agent	DaemonSet (all 3 nodes)	Full tolerations including etcd:NoExecute
Cilium Auth	authentication.enabled: true	Chart defaults to false — must be explicit

Enforcement via authentication.mode: required on CiliumNetworkPolicy ingress rules:

Policy	Source → Destination
allow-hubble-relay	hubble-ui → hubble-relay (port 4245)

Not eligible for mutual auth: Policies using fromEntities (CoreDNS, metrics-server, webhooks, gateway ingress, SPIRE agent→server) — reserved identities don't carry SPIFFE SVIDs. SPIRE agents run hostNetwork: true, so they appear as remote-node/host entities. Longhorn instance-manager pods are ephemeral and don't register SVIDs quickly enough.

TLS Re-encryption (Phase 1)

End-to-end encrypted path from client to pod:

Client ──TLS──▶ HAProxy (edge VIP) ──TLS──▶ Gateway/Envoy ──plaintext──▶ Pod

• Edge: HAProxy 2.8 LTS behind Keepalived VIP (192.168.20.22), terminates and re-encrypts to cluster
• Certificates: Vault PKI (Root RSA-4096 10yr → Intermediate 5yr) via cert-manager ClusterIssuer
• Gateway: HTTPS listener on :443 with TLS Terminate mode

Network Policies

Zero-trust model — every namespace starts with default-deny-ingress, then explicit CiliumNetworkPolicy allow rules per service:

• allow-coredns — DNS from all cluster sources (port 53)
• allow-hubble-relay — hubble-ui only (mutual auth enforced)
• allow-metrics-server — kube-apiserver only
• allow-gateway-to-* — Envoy ingress identity to backend services
• allow-apiserver-webhook — webhook ports for cert-manager, Longhorn
• allow-spire-agent-to-server — host/remote-node/kube-apiserver entities (hostNetwork agents)
• allow-longhorn-internal — intra-namespace

Security & Observability

• SIEM/XDR: Wazuh
• Flow Observability: Hubble (UI exposed via Gateway API + TLS)

High Availability

• Reverse Proxy: HAProxy + Keepalived (failover / high availability)
• Vault PKI: 3-node HA + failover

Diagrams

All architecture diagrams live under architecture/diagrams/.

Note: A Draw.io diagram will be added first, but it is currently outdated and will be updated as the architecture evolves.