Skip to content

Architecture diagram variants

Every box is clickable. Ctrl or ⌘ + scroll (or pinch) zooms, drag pans once zoomed, ⛶ goes fullscreen.

How the project works: Pulumi provisions, git deploys, users reach apps.

Homelab architecture

Hover a box to trace its path · click for details

UsersInternet visitorpublic apps onlyVPN useroff-site · NetBirdLAN userhome networkEdge · public internetBifrost edgeHetzner VPSTraefikTLS + routingNetBirdVPN + tunnelAuthentiksingle sign-onGatusuptime pageCloudflare DNSDNS onlyHome lab · Proxmox serverKubernetes clustertalos-cluster · API VIP 192.168.1.210NetBird peertunnel endCilium Gatewaysingle entry pointPlatformArgo CDGitOpsCiliumnetwork + eBPFcert-managerTLSAppsAIOllamaOpen WebUIComfyUIKubeflowObservabilityGrafanaVictoriaMetricsVictoriaLogsOpenTelemetrySecurityFalcoTrivyKyvernoToolsHarborn8nHeadlampCS2 serverCluster servicesLonghornstorageOpenBaoruntime secretsCloudNativePGPostgresNodes — Talos Linux VMs7 VMs · 32 vCPU · 82 GiB RAM · 1 × 16 GB GPUWorkersgeneral appsGPU workerRTX 5070 Ti · 16 GBControl planesetcd + APIHTTPSWireGuard tunnelNetBird mesh*.madhan.appown LB IPHTTP(S) from outside enters through the Gateway; hover any box to trace its pathTrafficManaged by PulumiManaged by Argo CD

The stack from hardware to apps, and which tool owns each layer.

The four layers

Click any box for details

Managed byApps and cluster servicesPlatformInfrastructureHardwareAIOllamaOpen WebUIComfyUIKubeflowObservabilityGrafanaVictoriaMetricsVictoriaLogsOpenTelemetrySecurityFalcoTrivyKyvernoToolsHarborn8nHeadlampCS2 serverServicesLonghornOpenBaoNetBird peerCloudNativePGArgo CDGitOpsCiliumnetwork + eBPFCilium Gatewaysingle entry pointcert-managerTLSCluster · Talos Linux VMsTalos Linuximmutable OSControl planesetcd + APIWorkersgeneral apps3 nodes · VIP 192.168.1.2103 nodesBifrost edge · Hetzner VPSBifrost edgeHetzner VPSCloudflare DNSDNS onlyProxmox hostphysical serverGPU workerRTX 5070 Ti · 16 GBGPU passed through to one VMgit pushworkloads/Argo CDGitOpsPulumiinfra as Go codePulumiinfra as Go codeby handProvisioned by Pulumi from the laptopDeployed by git push → CI → Argo CD

Follow one request hop by hop. Press Play, or Step through.

Follow one request

Press Play or Step · click any box for details

Public request · internet → GrafanaInternet visitorpublic apps only1Cloudflare DNSDNS only2TraefikTLS + routing3WireGuard tunneledge → LAN5NetBird peertunnel end6Cilium Gatewaysingle entry point7Grafanadashboards8ForwardAuth · skipped for GrafanaAuthentiksingle sign-on4LAN or VPN request · straight to the gatewayLAN userhome network9Cloudflare DNSDNS only10Cilium Gatewaysingle entry point11Headlampcluster UI12wildcard *.madhan.app → 192.168.1.220 · skips the edgePress Play or Step to follow a request from the internet to Grafana, then one from the LAN to Headlamp.▶ PlayStep →

The cluster at the centre, with everything that feeds it around the edge.

Cluster and its satellites

Click any box for details

Cloud servicesGitHubsource of truthGitHub ActionsCDK8s synthManifests branchvX.Y.Z-manifestsOperator & usersgit pushworkloads/YouoperatorPulumiinfra as Go codeLAN userhome networkCloud servicesBifrost edgeHetzner VPSTraefikTLS + routingAuthentiksingle sign-onNetBirdVPN + tunnelGatusuptime pageCloudflare DNSDNS onlyInternet visitorpublic apps onlyHome lab · Proxmox serverKubernetes clusterCilium Gatewaysingle entry pointNetBird peertunnel endPlatform — installed by PulumiArgo CDGitOpsCiliumnetwork + eBPFcert-managerTLSCluster services — synced by Argo CDLonghornstorageOpenBaoruntime secretsCloudNativePGPostgresApps — synced by Argo CDAIOllamaOpen WebUIComfyUIKubeflowObservabilityGrafanaVictoriaMetricsVictoriaLogsOpenTelemetrySecurityFalcoTrivyKyvernoToolsHarborn8nHeadlampCS2 serverNodes — Talos Linux VMs, created by Pulumi7 nodes · 32 cores · 82 GiBControl planesetcd + APIWorkersgeneral appsGPU workerRTX 5070 Ti · 16 GB3 nodes · VIP 192.168.1.2103 nodes1 node · AI onlyTalos LinuxProxmox hostVMs · Talos · Cilium · Gateway · cert-manager · Argo CDHetzner VPS · Authentik · DNSArgo CD pullsDNSHTTPSWireGuard tunnelLAN / VPN: *.madhan.app → 192.168.1.220Provision (Pulumi)Deploy (git → Argo CD)TrafficManaged by PulumiManaged by Argo CD

How a change reaches the cluster: infrastructure, apps and secrets, stage by stage.

How a change reaches the cluster

Click any box for details

Infrastructure — Pulumi, from your laptopYouoperatorPulumiinfra as Go codeProxmox hostphysical serverTalos Linuximmutable OSControl planesWorkersGPU worker7 VMs · VIP 192.168.1.210Argo CDCiliumCilium Gatewaycert-managerCloudflare DNSBifrost edgeAuthentikVMsinstalls the platformApps — git push, synced by Argo CDgit pushworkloads/GitHubsource of truthGitHub ActionsCDK8s synthManifests branchvX.Y.Z-manifestsArgo CDGitOpsLonghornOpenBaoNetBird peerCloudNativePGGrafanaOllamapullsCluster servicesApps · + every app in workloads/Secrets — no values in gitSOPS + agebootstrap secretsbootstrap Secretsunseal key · CloudflareOpenBaoruntime secretsGrafanamounted as filesjust create-secretsSecrets Store CSI1234561234561234Provision (from your laptop)Deploy (git → Argo CD)Runtime (in the cluster)Managed by PulumiManaged by Argo CDNumbers mark the order within each lane