Apps
Ollama, ComfyUI, Grafana, Harbor, n8n, Falco and the rest. Argo CD + CDK8s.
Overview
A seven-node Talos Kubernetes cluster on one Proxmox host, with a Hetzner VPS as the public edge and an RTX 5070 Ti for AI workloads. Everything above the bare metal is declared in this repo and rebuilt from it.
Layers
Section titled “Layers”Platform
Talos, Cilium, Gateway API, cert-manager, Argo CD. Pulumi.
Infrastructure
Seven Proxmox VMs and the Bifrost VPS on Hetzner. Pulumi.
Hardware
The Proxmox host and its GPU. Manual.
Principles
Section titled “Principles”| Rule | What it means here |
|---|---|
| Everything as code | Pulumi in core/, CDK8s in workloads/, shared values in config/config.yml. |
| No manual cluster changes | kubectl edit and kubectl scale are reverted by Argo CD self-heal; change git instead. |
| No plaintext secrets in git | Bootstrap secrets are SOPS-encrypted; runtime secrets live in OpenBao. CDK8s renders no Secret objects. |
| Zero-touch automation | just recipes drive every phase; the only manual steps are in third-party UIs (NetBird). |
Where to next
Section titled “Where to next”QuickstartEvery command in order, for when the prerequisites are ready.
Deploy from scratchPhase-by-phase build from bare Proxmox to a synced cluster.
ConceptsHow traffic, GitOps and secrets flow through the system.
OperateFixes for the failures this cluster has actually had.