Active project

Self-Hosted Homelab

My homelab is a constantly evolving platform where I experiment with new tools almost daily. At its core sits a production-grade, three-node K3s cluster on bare-metal Intel NUC and MacMini hardware — but it is far more than a Kubernetes cluster. It runs alongside Proxmox virtualisation, Cloudflare edge networking with Zero Trust ingress, and a Tailscale mesh VPN, hosting self-hosted web apps, home automation and monitoring across several Linux distributions. It is a hands-on environment for prototyping and sharpening my security, DevOps, edge and platform-engineering skills.

Live dashboard · igorbond.info ↗

Architecture

homelab-architecture.yaml

Applications

Self-hosted web apps Home automation apps Infra monitoring Bookmarks & file storage

▼

Edge & Ingress / Gateway API

Cloudflare Tunnel Zero Trust Access Traefik Gateway API

HTTPRoutes → Cloudflare Tunnel → *.igorbond.info

▼

Network Services

MetalLB Flannel CNI LoadBalancer IP pool Tailscale VPN

▼

Compute & Orchestration · K3s + Proxmox · Ubuntu / Debian

Node-01 · NUC

Control + Worker

CPUIntel i5-7260U

RAM16 GB

Storage512 GB SSD

Node-02 · NUC

Worker

CPUIntel i3 (8th Gen)

RAM16 GB

Storage256 GB SSD

Node-03 · MacMini

Proxmox / Worker

CPUIntel i7

RAM16 GB

Storage256 GB SSD

▼

Physical Infrastructure

2× Intel NUC + 1× MacMini (Proxmox) 48 GB total RAM 1 TB total storage Gigabit Ethernet

Stack

helm list --all-namespaces

K3s

Lightweight Kubernetes distribution with embedded etcd for high availability. A 3-node quorum enables fault tolerance and production-grade resilience.

Cloudflare TunnelZero Trust

Secure, outbound-only edge ingress — no inbound ports exposed. Publishes services to *.igorbond.info behind Cloudflare's edge, with Zero Trust Access policies and caching.

Proxmox VE

Type-1 hypervisor running on the MacMini node for VMs and LXC containers, hosting workloads that live outside Kubernetes alongside the K3s cluster.

Gateway API

Modern, expressive HTTP routing replacing the deprecated Nginx Ingress Controller — a future-proof choice, since that controller retires in March 2026.

Traefik

Cloud-native edge router with native Gateway API support, automatic service discovery and dynamic configuration.

MetalLB

Bare-metal LoadBalancer implementation using L2/ARP mode, with a dedicated IP pool for service exposure and no cloud-provider dependency.

Flannel

Container Network Interface (CNI) with VXLAN overlay networking — simple, reliable pod-to-pod communication across nodes.

Ubuntu Server

A stable, secure base for the lab, with extended maintenance through to 2029.

Experimentation log

git log --oneline

Designed and deployed a production-grade 3-node HA cluster with etcd quorum consensus.
Secured external access with Cloudflare Tunnel and Zero Trust policies — no inbound ports, with edge caching across *.igorbond.info.
Extended the platform beyond Kubernetes with Proxmox virtualisation for VM and LXC workloads.
Automated configuration management with Ansible playbooks.
Adopted modern Gateway API routing, proactively avoiding the soon-to-be-deprecated Nginx Ingress Controller.
Configured MetalLB for bare-metal LoadBalancer services with a dedicated IP pool.
Established GitOps-ready infrastructure following production SRE practices.

Tools & skills

Kubernetes (K3s) administration Cloudflare Tunnel & Zero Trust Edge networking Reverse proxy & caching Container networking Infrastructure as Code Ansible Linux system administration Proxmox virtualisation Self-hosting Home automation Helm charts Load balancing High availability design Troubleshooting & debugging Bare-metal Kubernetes Network policy SRE practices VMware Fusion