↑ ↓ to navigate
    ↵ to select
    esc to close
    Homelab

    Software Inventory

    Every pinned version in the homelab and the file that pins it.

    Every version below is pinned in code — there are no floating tags. When a number here disagrees with the cluster, the code wins and the cluster is drifting.

    This is the only page in these docs that carries version numbers. Every other page describes what a component does and links here for which release of it is running. just docs-check enforces both halves of that rule.

    Infrastructure

    SoftwareVersionManaged byPinned in
    Talos Linuxv1.13.8Pulumi core/platform/talos.go
    Kubernetes API types1.36.0CDK8s cdk8s.yaml

    Kubernetes itself has no pin of its own: the running version is whatever the Talos release ships (v1.13.x ships 1.36.x), and it does not ride along with a Talos upgrade — talosctl upgrade-k8s is a separate step, see the Upgrade Guide. The row above pins the API types CDK8s generates Go structs from, which must stay aligned with the cluster.

    Bifrost (Hetzner VPS)

    Docker Compose on a single public VPS. Everything reachable from the internet terminates here.

    SoftwareVersionPinned in
    Traefikv3.7.10 core/cloud/bifrost/docker-compose.yml
    NetBird (server, agent, proxy)0.76.3same
    NetBird dashboardv2.90.10same
    Authentik2026.5.6same
    PostgreSQL (Authentik)16.14-alpinesame
    Gatus (uptime)v5.36.0same

    Platform

    Installed by Pulumi, not GitOps — these bootstrap the cluster that runs everything else. Applied with just core platform up.

    SoftwareVersionPinned in
    Cilium1.18.12 core/platform/cilium.go
    Gateway API CRDsv1.2.1 core/platform/manifests/gateway-api-v1.2.1-experimental-install.yaml
    Argo CD (chart)10.3.2 core/platform/argocd.go
    Argo CD (image)v3.5.1same — runs ahead of the chart, see Platform
    cert-managerv1.21.1 core/platform/cert_manager.go

    The Gateway API CRDs are vendored into the repo rather than fetched from GitHub on every apply — see Cilium.

    Workloads

    Synthesized by CDK8s and delivered by Argo CD. Charts with a generated typed package are pinned in cdk8s.yaml ; the rest are pinned at their call site.

    Storage and databases

    SoftwareChartPinned in
    Longhorn1.12.0 cdk8s.yaml
    CloudNativePG0.29.0 workloads/databases/cnpg.go

    Secrets

    SoftwareVersionPinned in
    OpenBao (chart)0.29.0 workloads/secrets/openbao.go
    OpenBao (image)2.6.1same — unseal sidecar
    Secrets Store CSI Driver1.6.0 workloads/secrets/csi_driver.go

    Observability

    SoftwareChartPinned in
    VictoriaMetrics k8s-stack0.72.4 workloads/observability/victoria_metrics.go
    VictoriaLogs0.13.9 cdk8s.yaml
    Grafana12.10.4 cdk8s.yaml
    OpenTelemetry Collector0.169.0 workloads/observability/otel_collector.go
    Metrics Server3.13.1 cdk8s.yaml
    kube-prometheus-stack CRDs82.0.1 workloads/observability/victoria_metrics.go

    VMAlertmanager ships inside the VictoriaMetrics k8s-stack chart; it has no separate pin.

    Security

    SoftwareChartPinned in
    Falco8.0.5 workloads/security/falco.go
    Kyverno3.8.2 cdk8s.yaml
    Trivy Operator (chart)0.35.0 cdk8s.yaml
    Trivy Operator (CRD bundle)0.32.0 workloads/security/trivy.go

    Trivy is the one component with two deliberately different pins: the chart comes from the generated typed package, while the CRD bundle is downloaded separately by URL. They do not have to match, but a chart bump usually wants a CRD bump too.

    Applications

    SoftwareVersionPinned in
    Harbor1.19.2 cdk8s.yaml
    Headlamp0.44.0 cdk8s.yaml
    n8n (chart)2.0.1 workloads/automation/n8n.go
    n8n (image)1.78.0same
    Reloader2.2.16 workloads/support/reloader.go
    NetBird peer0.76.3 workloads/networking/netbird_peer.go
    Kubeflowv1.11.0 workloads/ai/kubeflow/kustomization.yaml
    notebook-gateway-controllerv1 workloads/ai/notebook_gateway_controller.go

    AI and GPU

    SoftwareVersionPinned in
    Ollama (chart)1.74.0 cdk8s.yaml
    NVIDIA Device Plugin0.19.3 workloads/hardware/nvidia_gpu_operator.go
    DCGM Exporter4.8.3same
    ComfyUIcu130-megapak-pt211-20260812 workloads/ai/comfyui.go

    Ollama's image tag is deliberately unset so it tracks the chart's appVersion — the chart is the pin. ComfyUI's tag encodes its CUDA line: the card is Blackwell (sm_120) and needs CUDA 12.8 or newer, so a cu126 tag will not run.

    Checking for updates

    helm search repo compares chart versions. A chart can lag the software it ships, so check the app version too — Argo CD 3.5.1 was released while chart 10.3.2 still pinned 3.5.0.

    helm repo update
helm search repo <repo>/<chart> --versions | head -3   # CHART and APP columns

    Run just docs-check after any bump. It re-reads every row above, greps the file named in the last column, and fails if the number here is no longer in that file.

    Edit this page