Self-Hosted Kubernetes Homelab
A bare-metal k3s cluster managed entirely through GitOps. This page is served from it.
Every workload is declared in git and reconciled by Argo CD using the App-of-Apps pattern, so manual changes self-heal back to the committed state. TLS certificates are issued automatically by cert-manager through Let's Encrypt DNS-01 challenges, requiring no inbound port for validation. Credentials are encrypted with Sealed Secrets so they live safely in version control. Debugging spans the full stack — I traced a broken public HTTPS path from ISP CGNAT checks through router NAT rules down to a duplicate containerPort conflict in a Traefik Helm override.
- k3s
- Argo CD
- Traefik
- cert-manager
- Sealed Secrets
- Prometheus
- Cloudflare