The stack from hardware to apps, and which tool owns each layer.
The four layers
Click any box for details
Managed byApps and cluster servicesPlatformInfrastructureHardwareAIOllamaOpen WebUIComfyUIKubeflowObservabilityGrafanaVictoriaMetricsVictoriaLogsOpenTelemetrySecurityFalcoTrivyKyvernoToolsHarborn8nHeadlampCS2 serverServicesLonghornOpenBaoNetBird peerCloudNativePGArgo CDGitOpsCiliumnetwork + eBPFCilium Gatewaysingle entry pointcert-managerTLSCluster · Talos Linux VMsTalos Linuximmutable OSControl planesetcd + APIWorkersgeneral apps3 nodes · VIP 192.168.1.2103 nodesBifrost edge · Hetzner VPSBifrost edgeHetzner VPSCloudflare DNSDNS onlyProxmox hostphysical serverGPU workerRTX 5070 Ti · 16 GBGPU passed through to one VMgit pushworkloads/Argo CDGitOpsPulumiinfra as Go codePulumiinfra as Go codeby handProvisioned by Pulumi from the laptopDeployed by git push → CI → Argo CD
Follow one request hop by hop. Press Play, or Step through.
Follow one request
Press Play or Step · click any box for details
Public request · internet → GrafanaIVInternet visitorpublic apps only1Cloudflare DNSDNS only2TraefikTLS + routing3WireGuard tunneledge → LAN5NetBird peertunnel end6Cilium Gatewaysingle entry point7Grafanadashboards8ForwardAuth · skipped for GrafanaAuthentiksingle sign-on4LAN or VPN request · straight to the gatewayLULAN userhome network9Cloudflare DNSDNS only10Cilium Gatewaysingle entry point11Headlampcluster UI12wildcard *.madhan.app → 192.168.1.220 · skips the edgePress Play or Step to follow a request from the internet to Grafana, then one from the LAN to Headlamp.▶ PlayStep →
How a change reaches the cluster: infrastructure, apps and secrets, stage by stage.
How a change reaches the cluster
Click any box for details
Infrastructure — Pulumi, from your laptopYYouoperatorPulumiinfra as Go codeProxmox hostphysical serverTalos Linuximmutable OSControl planesWorkersGPU worker7 VMs · VIP 192.168.1.210Argo CDCiliumCilium Gatewaycert-managerCloudflare DNSBifrost edgeAuthentikVMsinstalls the platformApps — git push, synced by Argo CDgit pushworkloads/GitHubsource of truthGitHub ActionsCDK8s synthManifests branchvX.Y.Z-manifestsArgo CDGitOpsLonghornOpenBaoNetBird peerCloudNativePGGrafanaOllamapullsCluster servicesApps · + every app in workloads/Secrets — no values in gitSASOPS + agebootstrap secretsbootstrap Secretsunseal key · CloudflareOpenBaoruntime secretsGrafanamounted as filesjust create-secretsSecrets Store CSI1234561234561234Provision (from your laptop)Deploy (git → Argo CD)Runtime (in the cluster)Managed by PulumiManaged by Argo CDNumbers mark the order within each lane