homelab-journey

homelab-journey

Secret Management Part 1: Installing OpenBao and Securing the First Secret

Kubernetes Secrets aren't encrypted — just base64. I installed OpenBao and ESO to move the TransIP API key into a proper vault and verified cert-manager still works.

homelab-journey

Cluster Observability Part 4: Alerting with Prometheus and Alertmanager

Enabling Alertmanager on the Bletchley cluster: alerting rules, SMTP delivery, end-to-end testing, and two Talos-specific surprises.

homelab-journey

Central Authentication for the Bletchley Cluster: Authelia and ForwardAuth

Adding central authentication to the Bletchley cluster with Authelia: ForwardAuth for Longhorn and Traefik, one session cookie for all services.

homelab-journey

Cluster Observability Part 3: Dashboards for Storage, Kubernetes, and Network

Importing Longhorn, Kubernetes, and resource dashboards onto the Bletchley cluster — and fixing the scrape config that was only collecting from one of four nodes.

homelab-journey

Version Control for the Cluster: Installing Forgejo on Bletchley

Installing Forgejo on Bletchley: self-hosted git, infra/apps repo structure, accidentally committing secrets, SQLite WAL, and a two-layer backup to Garage S3.

homelab-journey

Backup Validation: Restoring from Longhorn Backups

Testing the backup chain: etcd encryption with age, and a full Grafana PVC delete-and-restore to confirm Longhorn backups actually work.

homelab-journey

Offloading Bletchley Backups: Traefik, Wildcard Certs, and rclone

Exposing Garage S3 via Traefik, why Synology Cloud Sync failed, and how rclone solved the offsite backup problem instead.

homelab-journey

Backup Infrastructure: Garage S3, ZFS, and Longhorn Backup Targets

Building the local backup layer for the Bletchley cluster: ZFS mirror on rock3's SATA SSDs, Garage S3, NFS, and Longhorn recurring backups.

homelab-journey

Certificate Management: cert-manager on the Bletchley Cluster

Adding TLS to the Bletchley cluster with cert-manager, TransIP DNS-01 challenges, Let's Encrypt staging and production issuers, and automatic HTTP→HTTPS redirects.

homelab-journey

Cluster Networking: MetalLB and Traefik

Adding MetalLB and Traefik to Bletchley: real IPs for LoadBalancer services, hostname-based routing, and a reader-suggested improvement that preserves source IPs from day one.

homelab-journey

Cluster Observability Part 2: Grafana Dashboards

Adding Grafana to the Bletchley cluster: Longhorn-backed storage, pre-configured Prometheus datasource, and the Node Exporter Full dashboard showing live node metrics.

homelab-journey

Cluster Observability Part 1: Prometheus and Node Exporter on Talos

Installing Prometheus and node exporter on Talos Linux: namespace labelling, values files, the duplicate pod gotcha, and confirming all four nodes are being scraped.