Homelab

This is a greenfield rebuild of my homelab where the repository itself is the single source of truth for hosts, network, firewall, Kubernetes, secrets, and recovery. Seven NixOS hosts plus an OPNsense router are declared with flakes, disko, impermanence, and sops-nix, giving every machine a reproducible, encrypted, ephemeral root with no hand-edited state. First install goes through nixos-anywhere; subsequent activations use deploy-rs from NAS-hosted GitLab runners under a strict no laptop applies policy: infrastructure only ever changes from protected CI pipelines.

The cluster is k3s with Cilium as an eBPF kube-proxy replacement, peering to OPNsense over BGP for LoadBalancer IPAM across six VLANs. Flux reconciles ordered dependency layers with health checks and prune, while a local Zot registry serves digest-pinned images so workloads never pull straight from public registries. Zero trust holds throughout: public ingress goes only through Cloudflare Tunnels, admin access through a NetBird WireGuard mesh, and firewall state is managed by OpenTofu plus a custom typed Python OPNsense reconciler with encrypted pre-change backups and read-after-write verification. On top of that sits a ZFS NAS, source-first Home Assistant, a fully local voice assistant, Grafana/Loki observability, and isolated multiuser agent workspaces.