GitOps Homelab: Full-Stack Infrastructure as Code

Everything in the homelab — network devices, VMs, Kubernetes workloads, Docker services, backups — is managed through GitLab CI/CD, Atlantis, and Argo CD. The aim is to make intended configuration reviewable and repeatable; manual recovery remains an operational concern.

I own the architecture, integration and operation of this lab. Separating platform provisioning from application delivery makes changes easier to review and repeat. It does not make recovery automatic; configuration drift, provider failures and restoration still need checking. The next step is continued reconciliation and recovery validation, not a customer launch.

The June 2026 inventory counted 13 Kubernetes nodes across two sites: 7 in the Netherlands and 6 in Greece. Earlier references to 7 described the Netherlands cluster alone. A Netherlands snapshot from 28 October 2026 still records 7; a comparable current whole-estate count has not been verified. Historical counts are not live capacity.

What It Covers

Platform vs. application split — Atlantis/OpenTofu handles the infrastructure layer (nodes, networking, storage), Argo CD handles application workloads. Both triggered by merge requests, both with auto-sync.

Kubernetes (June 2026 inventory) — 13 nodes across two clusters (7 in NL, 6 in GR; then v1.34.2) with Cilium CNI replacing kube-proxy via eBPF. BGP peering with the Cisco ASA for LoadBalancer services. Dual storage: NFS for shared volumes, Synology iSCSI CSI for block storage.

Security — Cilium mTLS via SPIRE for service-to-service encryption. Network policies scoped per namespace. External Secrets Operator pulls credentials from OpenBao into K8s — no secrets in git.

TLS — cert-manager with Let’s Encrypt wildcards via Cloudflare DNS-01. AWX scheduled jobs sync certs to Nginx Proxy Manager across 94 hosts. Syncthing handles distribution.

Observability — Prometheus/Grafana/Alertmanager for metrics. syslog-ng → Loki → Grafana for logs. Hubble for L7 flow visibility when debugging Cilium issues.

Backups — Velero + MinIO S3 with daily/weekly schedules. Cross-site replication to Greece.

Docker — 60+ services: Ollama, Stable Diffusion, Jellyfin, databases, home automation. Everything that doesn’t need Kubernetes runs here.

Network automation — Python CI/CD pipelines push Cisco IOS/ASA configuration with drift detection. If someone changes something manually, the next pipeline run catches it.

Virtualization — Proxmox VE with 100+ LXC containers and 20+ VMs, all provisioned through GitLab pipelines.

Architecture Overview

┌─────────────────────────────────────────────────────────────────┐
│                        GitLab CI/CD                              │
│  ┌──────────────────┐         ┌──────────────────┐              │
│  │    Atlantis      │         │     Argo CD      │              │
│  │  (Platform IaC)  │         │  (Applications)  │              │
│  └────────┬─────────┘         └────────┬─────────┘              │
└───────────┼────────────────────────────┼────────────────────────┘
            │                            │
            ▼                            ▼
┌───────────────────────┐    ┌───────────────────────┐
│   Infrastructure      │    │    Workloads          │
│   - Kubernetes nodes  │    │    - Applications     │
│   - Network configs   │    │    - Services         │
│   - Storage           │    │    - ConfigMaps       │
│   - Secrets           │    │    - Ingress          │
└───────────────────────┘    └───────────────────────┘
            │                            │
            └──────────────┬─────────────┘
                           ▼
┌─────────────────────────────────────────────────────────────────┐
│                    Kubernetes Cluster                            │
│  ┌─────────────┐ ┌─────────────┐ ┌─────────────┐               │
│  │  Cilium CNI │ │   SPIRE     │ │  OpenBao    │               │
│  │  + Hubble   │ │   mTLS      │ │  Secrets    │               │
│  └─────────────┘ └─────────────┘ └─────────────┘               │
│  ┌─────────────┐ ┌─────────────┐ ┌─────────────┐               │
│  │ Prometheus  │ │    Loki     │ │   Velero    │               │
│  │  + Grafana  │ │  Logging    │ │  Backups    │               │
│  └─────────────┘ └─────────────┘ └─────────────┘               │
└─────────────────────────────────────────────────────────────────┘

Technology Stack

The foundation everything else in the homelab runs on