Kashall's Infrastructure

Overview

This repository runs my home lab — a few computers in my house that host the apps and services my household depends on (media library, home automation, dashboards, chat, and more) instead of renting them from big cloud providers.

The twist: nothing is configured by hand. The entire setup is written down as code in this repo, and software continuously keeps the real machines matched to it. Push a change and it rolls out on its own; if a machine dies, I can rebuild it from scratch in minutes.

🤓 For the technically curious — the interesting bits

Talos Linux — a minimal, immutable OS with no SSH or shell; every node is defined entirely from talos/ and managed over an API.
Flux GitOps — the cluster reconciles itself to match this repo. Every change is a reviewed commit, never a manual kubectl apply.
Cilium + BGP — pods get routable IPs and LoadBalancer services are advertised straight to my UniFi router via BGP.
External DNS UniFi Webhook — a webhook I wrote so DNS records publish directly to UniFi, no extra resolvers.
Renovate — container images and Helm charts stay current through automated pull requests.
VolSync + ZFS — persistent data is snapshotted and backed up off-site, on top of a dedicated TrueNAS box.

Built from onedr0p's cluster template — you don't need a fancy multi-node setup to run your own. Come say hi in the Home Operations Discord.

Directory Helper

This repository uses the following layout for Kubernetes.

📁 bootstrap
├── 📝 helmfile.yaml         # Helmreleases required to bootstrap Flux.
└── 📝 secrets.yaml.tpl      # Secrets required to bootstrap Flux.
📁 kubernetes
├── 📁 apps                  # Application configurations.
└── 📁 components            # Shared Kustomize components.
📁 talos
├── 📁 nodes                 # Per-node override configurations.
├── 📝 machineconfig.yaml.j2 # Base Talos configuration for all nodes.
└── 📝 talos.env             # Kubernetes and Talos version variables.
📁 unifi                     # Configuration files for UniFi

☁️ Cloud Dependencies

Most things are self-hosted, but a few critical pieces live in the cloud — to sidestep chicken-and-egg problems and stay reachable when the cluster is down.

Service	Use	Cost
1Password	Secrets with External Secrets	~$55/yr
Cloudflare	Domains, Workers, Pages, and R2	~$240/yr
Backblaze B2	Backups	$1/m
GitHub	Hosting this repository and continuous integration/deployments	Free
Let's Encrypt	Issuing SSL Certificates with Cert Manager	Free
Migadu	Email Hosting	~$20/yr
Pushover	Kubernetes Alerts and application notifications	Free
UniFi Site Manager	UniFi External Access Management	Free
		Total: ~$10/mo

💻 Networking

Everything runs on a UniFi stack split into VLANs for isolation. The cluster hands out service IPs from a dedicated network and advertises them to the router over BGP (see Cilium + BGP), so a load-balanced app gets a real, routable address on my LAN — no port-forwarding or ingress hacks.

Networking Diagram

flowchart LR
    classDef gateway fill:#163a1e,stroke:#27ae60,color:#fff
    classDef switch fill:#1e2a4a,stroke:#3498db,color:#fff
    classDef compute fill:#4a1e3a,stroke:#e74c3c,color:#fff
    classDef storage fill:#3a2a1e,stroke:#f39c12,color:#fff
    classDef ap fill:#1e3a2a,stroke:#2ecc71,color:#fff

    Internet(["The Internet"])

    Internet -- "2 Gbps ↓ / 350 Mbps ↑" --> UCG["UCG Fiber (Mystic)"]:::gateway

    UCG -- 2.5G --> FLEX["USW Flex 2.5G 8 PoE"]:::switch
    UCG -- 2.5G --> U7XG(["U7 Pro XG (Office)"]):::ap
    UCG -- 10G SFP+ --> AGG["USW Pro Aggregation"]:::switch

    AGG -- 10G SFP+ --> MAX["USW Pro Max 16 PoE"]:::switch
    AGG -- 20G LACP --> MS01["3x MS-01 (Main)"]:::compute
    AGG -- 10G --> PUDDLE["Puddle (NAS)"]:::storage

    MAX -- 1G --> U6LR(["U6-LR (Garage)"]):::ap
    MAX --> PDU["USP PDU Pro"]:::switch

    U7XG -. mesh .-> UDB["UDB Switch (Garage)"]:::switch

Networks & Vlans

Name	VLAN	Description
Management	1	Servers + Network Management
Devices	2	Wireless Devices and Workstations
IoT	3	Small devices that have the potential to be compromised, so they don't get to talk to each other.
Services	4	No DHCP — dedicated network for the cluster's BGP-advertised LoadBalancer IPs
"I Don't Trust You"	86	Non-affiliated organization issued devices (school or work devices)

🌐 DNS

I wrote External DNS UniFi Webhook so External DNS can publish the cluster's service and ingress hostnames straight to UniFi's built-in DNS — no extra resolvers or moving parts.

🔧 Hardware

Compute

Minisforum MS-01 × 3 · 96 GB RAM · Talos / Kubernetes

OS — 1 TB Crucial NVMe
Local storage — 2 TB Samsung PM9A3 U.2 NVMe
Out-of-band — JetKVM

Storage

45HomeLab HL15 · 256 GB RAM · TrueNAS SCALE / ZFS

Boot — 1 × 1 TB Kingston NV3 NVMe
puddle pool
- 6 × 12 TB Seagate IronWolf / Exos 7E8 HDD — 6-wide RAIDZ2
- 2 × 1.92 TB Samsung PM9A3 NVMe — L2ARC cache
- 1 × 12 TB Seagate IronWolf — hot spare
Unassigned — 750 GB Intel Optane NVMe (future SLOG)

Networking — UniFi

UCG Fiber ("Mystic") — router · 2.5 G WAN
USW Pro Aggregation — 10 G SFP+ aggregation switch
USW Pro Max 16 PoE — 10 G SFP+ / PoE switch
USW Flex 2.5G 8 PoE — 2.5 G PoE switch
USP PDU Pro — rack PDU
U7 Pro XG — Wi-Fi 7 AP (Office)
U6 LR — Wi-Fi 6 AP (Garage)
UDB Switch — workbench switch, wireless mesh (Garage)

Power

Eaton 5PX1500RT — 1500 VA rackmount UPS

IoT Gateways

Meshtastic MQTT Gateway — LoRa mesh → MQTT
SMLIGHT SLZB-06M — Zigbee / Matter gateway

⭐ Stargazers

Inspiration

Thanks to all the people who donate their time to the Home Operations community.

Special thanks to: ᗪєνιη ᗷυнʟ, Bᴇʀɴᴅ Sᴄʜᴏʀɢᴇʀs, and Toboshii Nakama for their assistance.

Check out kubesearch.dev to see what other users are running in their kubernetes home labs!

infrastructure