Back to Projects
Homelab: Self-Hosted Cloud Platform
AWS rebuilt from scratch at home—full stack from compute to observability.
4
Nodes
20+
Services
99.2%
Uptime
60%
LLM Latency Cut
Technologies & Skills
Infrastructure & Orchestration
Kubernetes (Talos Linux)ArgoCD (GitOps)Terraform (IaC)Kustomize
Networking & Ingress
nginx Ingress ControllerCloudflare TunnelCoreDNSNetworkPolicy
Storage
Longhorn (distributed block)MinIO (S3-compatible)
Databases
CloudNativePG (PostgreSQL)pgvector (AI embeddings)
Identity & Security
Authentik (OIDC SSO)SOPS (encrypted secrets)cert-manager (TLS)
Observability
PrometheusGrafanaTempo (tracing)OpenTelemetryLoki (logs)
CI/CD
Forgejo (git + Actions)Container RegistryDinD Runners
AI/ML Platform
vLLM (Qwen3-32B)OllamaTEI (embeddings)KServe
Workflow & Messaging
Temporal (durable workflows)Kafka/Redpanda (streaming)
Languages & Frameworks
Go (API gateway)Python (ML)Next.js (frontend)
Core Competencies Demonstrated
- •Multi-tenant GPU scheduling (sm70/Volta constraints)
- •Zero-downtime GitOps deployments
- •Service mesh patterns without Istio overhead
- •Hybrid cloud networking (Cloudflare + bare-metal)
- •Declarative IAM with OIDC claim mapping
Architecture Deep Dive
Infrastructure Layer
4-node bare-metal cluster (3 control plane + 1 worker) running Talos Linux—immutable, API-driven OS designed for Kubernetes.
- • Compute: Talos Linux nodes, machine config via Terraform
- • Networking: Cilium CNI, nginx ingress, Cloudflare Tunnel for zero-trust external access
- • Storage: Longhorn for distributed block storage with disk tagging, MinIO for S3
- • GitOps: ArgoCD with multi-source Applications and sync waves
Data Platform
- • PostgreSQL: CloudNativePG operator with HA, automated failover
- • Vector DB: pgvector extension for AI embeddings
- • Streaming: Kafka/Redpanda for event-driven architecture
- • Workflows: Temporal for durable, long-running processes
AI/ML Platform
Self-hosted LLM inference with multi-tenant GPU scheduling and 60% latency reduction.
- • Inference: vLLM serving Qwen3-32B with INT4 quantization
- • Multi-model: Ollama for smaller models, hot-swapping
- • Embeddings: TEI for text embeddings and reranking
- • Orchestration: KServe + custom Go API gateway
- • Scheduling: GPU node affinity with sm70/Volta constraints
Identity & Security
- • SSO: Authentik OIDC provider with custom claims and group mapping
- • RBAC: Kubernetes RBAC synced with Authentik groups
- • Secrets: SOPS-encrypted secrets in git, decrypted at deploy time
- • TLS: cert-manager with DNS-01 ACME challenges via Cloudflare
Observability Stack
- • Metrics: Prometheus with custom recording rules, Grafana dashboards
- • Logs: Loki for aggregation, structured logging from all services
- • Traces: Tempo + OpenTelemetry Collector for distributed tracing
- • Alerts: AlertManager → Slack integration for incident response
Self-Hosted Applications
Paperless-ngxImmichHomarrPortainerForgejoAuthentik