Tech Notes from the Homelab

Write-ups on Kubernetes, GitOps, MLOps, AI, and self-hosting — from the home rack and the day job

GitOps on Kubernetes with ArgoCD and SOPS

Declarative cluster state in a single Git repo, with encrypted secrets that age-encrypt at rest and decrypt only at sync time. A pattern I've now used across three different homelab clusters.

// Whole-cluster state recoverable from one git clone + one age key

Single Sign-On for the Homelab with Keycloak

Putting every self-hosted service behind one login with the same identity provider I use at work. OIDC for the apps that support it, oauth2-proxy for the ones that don't, and the trade-offs of each.

// One login screen across ~18 self-hosted services, on the same IdP I use professionally

Self-Hosting Ollama with GPU Passthrough on Proxmox

Running local LLMs on consumer GPU hardware via a Proxmox VM with PCIe passthrough. IOMMU groups, VFIO binding, and the boring tuning that makes inference actually fast.

// Local Llama 3.1 70B inference at 18 tok/s on consumer hardware

To Kubernetes or not to Kubernetes, that is the Question: A Home Lab Perspective

When does running Kubernetes at home actually pay off, and when is it the wrong tool? A look at intent versus hype for self-hosters.

// A framework for deciding whether to run k8s at home, based on what you're actually trying to achieve

Self-hosting Private GitHub Runners on a Kubernetes Cluster

Why we moved our GitHub Actions workloads to self-hosted runners on Kubernetes at work, the bill that triggered it, and what I'm planning to bring home to the homelab.

// Cut GitHub-hosted Actions minute spend significantly while keeping a familiar developer experience

Vaultwarden behind a WireGuard VPN — architecture diagram

Migrating Vaultwarden (Bitwarden) Password Manager behind WireGuard VPN

A technical account of migrating a self-hosted password vault from an internet-exposed reverse-proxy setup to behind a WireGuard VPN tunnel — what went smoothly, what didn't, and what the problems revealed about the underlying systems.

// Eliminated public web attack surface — the vault is reachable only through an authenticated, cryptographically silent VPN tunnel

//View all posts