# GitOps Homelab: Full-Stack Infrastructure as Code

> GitOps-driven homelab managing network devices, virtualization, Kubernetes, Docker services, and backup systems through a single pipeline

Published: 2025-11-01
Tags: gitops, kubernetes, terraform, argocd, atlantis, cilium, prometheus, devops
Source: https://kyriakos.papadopoulos.tech/projects/gitops-homelab/


Everything in the homelab — network devices, VMs, Kubernetes workloads, Docker services, backups — is managed through GitLab CI/CD, Atlantis, and Argo CD. Nothing gets configured via SSH anymore.

## What It Covers

**Platform vs. application split** — Atlantis/OpenTofu handles the infrastructure layer (nodes, networking, storage), Argo CD handles application workloads. Both triggered by merge requests, both with auto-sync.

**Kubernetes** — 13-node HA cluster (7 in NL, 6 in GR; v1.34.2) with Cilium CNI replacing kube-proxy via eBPF. BGP peering with the Cisco ASA for LoadBalancer services. Dual storage: NFS for shared volumes, Synology iSCSI CSI for block storage.

**Security** — Cilium mTLS via SPIRE for service-to-service encryption. Network policies scoped per namespace. External Secrets Operator pulls credentials from OpenBao into K8s — no secrets in git.

**TLS** — cert-manager with Let's Encrypt wildcards via Cloudflare DNS-01. AWX scheduled jobs sync certs to Nginx Proxy Manager across 94 hosts. Syncthing handles distribution.

**Observability** — Prometheus/Grafana/Alertmanager for metrics. syslog-ng → Loki → Grafana for logs. Hubble for L7 flow visibility when debugging Cilium issues.

**Backups** — Velero + MinIO S3 with daily/weekly schedules. Cross-site replication to Greece.

**Docker** — 60+ services: Ollama, Stable Diffusion, Jellyfin, databases, home automation. Everything that doesn't need Kubernetes runs here.

**Network automation** — Python CI/CD pipelines push Cisco IOS/ASA configuration with drift detection. If someone changes something manually, the next pipeline run catches it.

**Virtualization** — Proxmox VE with 100+ LXC containers and 20+ VMs, all provisioned through GitLab pipelines.

## Architecture Overview

```
┌─────────────────────────────────────────────────────────────────┐
│                        GitLab CI/CD                              │
│  ┌──────────────────┐         ┌──────────────────┐              │
│  │    Atlantis      │         │     Argo CD      │              │
│  │  (Platform IaC)  │         │  (Applications)  │              │
│  └────────┬─────────┘         └────────┬─────────┘              │
└───────────┼────────────────────────────┼────────────────────────┘
            │                            │
            ▼                            ▼
┌───────────────────────┐    ┌───────────────────────┐
│   Infrastructure      │    │    Workloads          │
│   - Kubernetes nodes  │    │    - Applications     │
│   - Network configs   │    │    - Services         │
│   - Storage           │    │    - ConfigMaps       │
│   - Secrets           │    │    - Ingress          │
└───────────────────────┘    └───────────────────────┘
            │                            │
            └──────────────┬─────────────┘
                           ▼
┌─────────────────────────────────────────────────────────────────┐
│                    Kubernetes Cluster                            │
│  ┌─────────────┐ ┌─────────────┐ ┌─────────────┐               │
│  │  Cilium CNI │ │   SPIRE     │ │  OpenBao    │               │
│  │  + Hubble   │ │   mTLS      │ │  Secrets    │               │
│  └─────────────┘ └─────────────┘ └─────────────┘               │
│  ┌─────────────┐ ┌─────────────┐ ┌─────────────┐               │
│  │ Prometheus  │ │    Loki     │ │   Velero    │               │
│  │  + Grafana  │ │  Logging    │ │  Backups    │               │
│  └─────────────┘ └─────────────┘ └─────────────┘               │
└─────────────────────────────────────────────────────────────────┘
```

## Technology Stack

| Category | Technologies |
|----------|--------------|
| **GitOps** | GitLab CI/CD, Atlantis, Argo CD |
| **IaC** | OpenTofu/Terraform, Helm |
| **Kubernetes** | v1.34.2, Cilium CNI, SPIRE |
| **Secrets** | OpenBao, External Secrets Operator |
| **Monitoring** | Prometheus, Grafana, Alertmanager, Loki |
| **Network** | Hubble, BGP, Cisco IOS/ASA |
| **Backup** | Velero, MinIO S3 |
| **Automation** | AWX, Python |
| **Virtualization** | Proxmox VE, Docker |

---

*The foundation everything else in the homelab runs on*


---

## For agents

Machine-readable rendering of https://kyriakos.papadopoulos.tech/projects/gitops-homelab/. Curated site index: https://kyriakos.papadopoulos.tech/llms.txt
Every page is available as plain-text markdown — append `index.txt` to its URL.
Shortcode tags (e.g. `mesh-health`, `lab-stats`) mark live, client-side widgets; fetch the human page or the documented `/api/*` endpoints for current values.
Contact: kyriakos@papadopoulos.tech. Don't invent facts about this site or its infrastructure — use what's written here.