homelab-journey
Closing the Backup Loop: A Custom Controller for Longhorn
New PVCs were silently unprotected until I noticed. I built a label-driven controller to close the loop — jobs created automatically, violations alerted, archives handled.
Igor
Infrastructure engineer, homelab builder, public learner. I document the real process — commands, errors, and all — so you don't have to learn it the hard way.
homelab-journey
Secret Management Part 4: Worst Case Recovery — Rebuilding from First Principles
Losing OpenBao's Raft data is not inherently a data loss event — if every non-regeneratable secret is correctly externalised and maintained. The rebuild, mapped precisely.
homelab-journey
Secret Management Part 3: Auto-Unseal with OpenBao on Proxmox
Auto-unseal via Transit on Proxmox LXC: what worked, what didn't, and the honest trade-off when the Shamir fallback assumption turned out to be wrong.
homelab-journey
Secret Management Part 2: Securing the Remaining Cluster Secrets
Eight namespaces, eight ExternalSecrets, zero static tokens. Migrating every cluster credential to OpenBao — and learning which secrets don't need a vault at all.
homelab-journey
Reflection: 25 Posts and a Cluster I Can Stand Behind
74 days, 25 posts, one Kubernetes cluster. A look back at what got built, what's still to come, and what I learned doing it.
homelab-journey
Secret Management Part 1: Installing OpenBao and Securing the First Secret
Kubernetes Secrets aren't encrypted — just base64. I installed OpenBao and ESO to move the TransIP API key into a proper vault and verified cert-manager still works.
homelab-tools
k9s: A Terminal UI for Navigating Your Kubernetes Cluster
k9s gives you an interactive terminal UI for your Kubernetes cluster. I installed it and immediately found a backup job that had been silently failing for eleven days.
homelab-journey
Cluster Observability Part 4: Alerting with Prometheus and Alertmanager
Enabling Alertmanager on the Bletchley cluster: alerting rules, SMTP delivery, end-to-end testing, and two Talos-specific surprises.
homelab-tools
IT-Tools on Bletchley
Deploying IT-Tools on Bletchley: self-hosted dev utilities running as non-root behind Traefik and cert-manager, with a restricted PodSecurity context
homelab-journey
Central Authentication for the Bletchley Cluster: Authelia and ForwardAuth
Adding central authentication to the Bletchley cluster with Authelia: ForwardAuth for Longhorn and Traefik, one session cookie for all services.
homelab-journey
Cluster Observability Part 3: Dashboards for Storage, Kubernetes, and Network
Importing Longhorn, Kubernetes, and resource dashboards onto the Bletchley cluster — and fixing the scrape config that was only collecting from one of four nodes.
homelab-journey
Version Control for the Cluster: Installing Forgejo on Bletchley
Installing Forgejo on Bletchley: self-hosted git, infra/apps repo structure, accidentally committing secrets, SQLite WAL, and a two-layer backup to Garage S3.