homelab-journey
Secret Management Part 2: Securing the Remaining Cluster Secrets
Eight namespaces, eight ExternalSecrets, zero static tokens. Migrating every cluster credential to OpenBao — and learning which secrets don't need a vault at all.
homelab-journey
Documentation of my home lab evolution, from hardware builds to software experiments.
homelab-journey
Reflection: 25 Posts and a Cluster I Can Stand Behind
74 days, 25 posts, one Kubernetes cluster. A look back at what got built, what's still to come, and what I learned doing it.
homelab-journey
Secret Management Part 1: Installing OpenBao and Securing the First Secret
Kubernetes Secrets aren't encrypted — just base64. I installed OpenBao and ESO to move the TransIP API key into a proper vault and verified cert-manager still works.
homelab-journey
Cluster Observability Part 4: Alerting with Prometheus and Alertmanager
Enabling Alertmanager on the Bletchley cluster: alerting rules, SMTP delivery, end-to-end testing, and two Talos-specific surprises.
homelab-journey
Central Authentication for the Bletchley Cluster: Authelia and ForwardAuth
Adding central authentication to the Bletchley cluster with Authelia: ForwardAuth for Longhorn and Traefik, one session cookie for all services.
homelab-journey
Cluster Observability Part 3: Dashboards for Storage, Kubernetes, and Network
Importing Longhorn, Kubernetes, and resource dashboards onto the Bletchley cluster — and fixing the scrape config that was only collecting from one of four nodes.
homelab-journey
Version Control for the Cluster: Installing Forgejo on Bletchley
Installing Forgejo on Bletchley: self-hosted git, infra/apps repo structure, accidentally committing secrets, SQLite WAL, and a two-layer backup to Garage S3.
homelab-journey
Backup Validation: Restoring from Longhorn Backups
Testing the backup chain: etcd encryption with age, and a full Grafana PVC delete-and-restore to confirm Longhorn backups actually work.
homelab-journey
Offloading Bletchley Backups: Traefik, Wildcard Certs, and rclone
Exposing Garage S3 via Traefik, why Synology Cloud Sync failed, and how rclone solved the offsite backup problem instead.
homelab-journey
Backup Infrastructure: Garage S3, ZFS, and Longhorn Backup Targets
Building the local backup layer for the Bletchley cluster: ZFS mirror on rock3's SATA SSDs, Garage S3, NFS, and Longhorn recurring backups.
homelab-journey
Certificate Management: cert-manager on the Bletchley Cluster
Adding TLS to the Bletchley cluster with cert-manager, TransIP DNS-01 challenges, Let's Encrypt staging and production issuers, and automatic HTTP→HTTPS redirects.
homelab-journey
Cluster Networking: MetalLB and Traefik
Adding MetalLB and Traefik to Bletchley: real IPs for LoadBalancer services, hostname-based routing, and a reader-suggested improvement that preserves source IPs from day one.