Homelab

meklab

A home datacenter run with the practices of a platform team. Infrastructure as code, GitOps, observability from day one, and a security posture designed as if publicly exposed.

Principles

Education first: It is a learning environment. Understanding comes before automation.
Future-me optimization: Invest in setup to reduce maintenance. Runbooks, tickets, and design docs are part of the deliverable.
Clear environment boundaries: Strict separation between dev, staging, and production.
DNS is public, reachability is private: Names resolve publicly; packets only arrive over a mesh VPN with tag-based ACLs. This site is the one exception, and it lives on Cloudflare, not in the cluster.
Containers are disposable, data is not: Every stateful volume has a backup with a tested restore.

Topology

Proxmox cluster · 4 hosts · quorum 3

host 1k3s server · etcd

host 2k3s server · etcd

host 3k3s server · etcd

host 4console · UPS master

Kubernetes · Flux reconciles from self-hosted GitLab

Traefik cert-manager MetalLB ExternalDNS Longhorn Garage Vault External Secrets KEDA Authentik GitLab CE Runners

Observability

Prometheus · Grafana · Alertmanager
Loki · Blackbox probes per service tier

Storage and backup

Longhorn (2 replicas) · Garage S3
PBS for VMs · Velero for volumes · offsite copy

Edge

MikroTik routing and VLANs · split-horizon DNS on three resolvers · Tailscale as the only remote path

What runs there

Platform

Three k3s servers, all etcd members, one per Proxmox host. Longhorn block storage with two replicas. Garage for S3. Traefik with cert-manager certificates from Let's Encrypt over DNS-01. MetalLB for bare-metal load balancing.

Delivery

Self-hosted GitLab CE runs in the cluster with its own runners and container registry. Application repos build images on semver tags; Flux image automation promotes them. Nothing is deployed by hand.

Secrets and identity

HashiCorp Vault on Raft, synced by External Secrets Operator. Authentik provides OIDC, LDAP, and forward-auth in front of every service, including GitLab, Grafana, and Vault itself.

Network

MikroTik routing and switching with VLAN segmentation. Split-horizon DNS across three resolvers, all managed by ExternalDNS. Tailscale as the only remote path, with tag-based ACLs.

Backup

Proxmox Backup Server for VMs, Velero and Longhorn snapshots for cluster volumes, Garage as the S3 target, and an offsite copy. Restores are exercised, not assumed. A data-loss incident in 2026 was recovered from these.

Services

Media (Jellyfin, Audiobookshelf), home automation (Home Assistant, Zigbee2MQTT), recipe and garden apps for family, local LLM inference, a metasearch engine, and the archival pipelines described on the projects page.

Operating it

The lab is tracked like a real engineering estate: issues and milestones in GitLab, design documents before builds, runbooks for hardware maintenance and disaster recovery, and a weekly automated security-advisory review that diffs the service inventory against upstream advisories. The interesting failures get written up. An etcd brown-out caused by three simultaneous VM backups, a filesystem corruption on distributed block storage, a FUSE mount leak that starved a node: each became a reference document and a change in practice.