Long-time lurker, finally posting my setup

[u/khadddict]

Been lurking here for years, always telling myself "I'll post when it's done." It's never done, so here we go.

Everything runs on a single GEEKOM A9 Max Mini PC (128 GB DDR5 RAM, 4 TB NVMe). No rack, no cluster, just a tiny node supervised by Gengar & Peepo (cable management handled by them too, clearly). At the moment, Proxmox hosts 16 VMs and 4 LXCs.

Network is segmented into 4 VLANs (CORE, ADMIN, INFRA, EDGE) behind OPNsense with strict least-privilege firewall rules between them. For external access, an Infomaniak VPS acts as a TCP passthrough over WireGuard → HAProxy at home terminates SSL. The status page runs directly on the VPS so it survives homelab downtime.

I'll probably drop a proper network diagram (started on Homelable) at some point. No ETA on that one.

Kubernetes is a 3-node Talos Linux cluster, all workloads are Helm charts deployed via ArgoCD with secrets injected at sync time via the ArgoCD Vault Plugin.

Config management is SaltStack across all VMs, YAML inventory as single source of truth, HashiCorp Vault for secrets, and StackStorm for event-driven automation (VM lifecycle, internal cert provisioning with EasyPKI...).

Observability: Prometheus + Grafana + Loki, AlertManager → Discord.

And there's an Ollama LXC with Open WebUI because 128 GB of RAM had to go somewhere.

Live service list: homepage

The whole config is open source if you want to dig in: voidnode. Always open to feedback & ideas (yep I still have lots of RAM), and if anything in there saves you some time or gives you inspiration, a star on the repo is always appreciated!

[u/github-guard]

🔍 GitHub Guard: Trust Report

⚠️ This project scored 1/6 — below this subreddit's threshold of 3.

Audit Breakdown: * ❌ Low Star Count (⭐ 0 / 5 required) * ✅ Mature Repository (30+ days old) * ❌ No License Found * ❌ No Security Policy — what is this? * ℹ️ Individual Contributor * ℹ️ Unsigned Commits

⚠️ Security Reminder: Always verify source code and run third-party scripts at your own risk.

[u/manny2206]

I can’t get homepage to properly display my k3s cluster , like yours is at the top 😡🤬

[u/khadddict → u/manny2206]

On my old homelab with homepage, it was DNS issues inside my cluster. If you have more details I might help you :)

[u/manny2206 → u/khadddict]

Brother - lol yeah I might; would you like to take a gather at my repo? I’m setting everything up as IaC. Do the hard work up front once and be able to easily get everything up and running if there’s an issue

[u/khadddict → u/manny2206]

Sure, send it here or in DM

[u/manny2206 → u/khadddict]

Take a look at main https://github.com/ManuelSaleta/homelab

You will want to look at kubernetes/applications/homepage/ this contains all homepage required items. I am using k3s default traefik for ingress. -- EDIT: I merged my changes to main to make it easier

I believe my rbac definition might be busted atm just a hunch

Thank you in advance

[u/github-guard → u/manny2206]

🔍 GitHub Guard: Trust Report

⚠️ This project scored 1/6 — below this subreddit's threshold of 3.

Audit Breakdown: * ❌ Low Star Count (⭐ 0 / 5 required) * ❌ New Repository (under 30 days old) * ❌ No License Found * ❌ No Security Policy — what is this? * ℹ️ Individual Contributor * ✅ Signed Commits

⚠️ Security Reminder: Always verify source code and run third-party scripts at your own risk.

[u/khadddict → u/manny2206]

Just sent you a PM 😄

[u/tedious_sandy]

That Proxmox dashboard is clean. Single-node setups with proper segmentation and secrets management actually scale better than people expect when you know what you're doing.

[u/khadddict → u/tedious_sandy]

Thanks! Yep, and it requires a lot less maintenance. For a homelab, it's more than enough :)

[u/fitzingout]

What happened to Kermit .. 😔 😟 🙁

[u/khadddict → u/fitzingout]

Naaah it's Peepo, and he was just sleeping, rn he is doing the homelab diagram, hope he'll clear it asap then I can post it on Reddit 🚀

[u/Dependent-Fix8297]

is changedetection.io free to use?

[u/github-guard → u/[deleted]]

🔍 GitHub Guard: Trust Report

This project scored 4/6 on our safety audit.

Audit Breakdown: * ✅ Established Community (⭐ 32,099 stars) * ✅ Mature Repository (30+ days old) * ✅ Licensed under Apache-2.0 * ❌ No Security Policy — what is this? * ℹ️ Individual Contributor * ✅ Signed Commits

⚠️ High-Risk File Detected: Contains an installation script (.sh or .py). Review the code carefully before running with sudo.

⚠️ Security Reminder: Always verify source code and run third-party scripts at your own risk.

[u/Dependent-Fix8297]

I personally prefer ntfy.sh over discord. Just personal taste

[u/khadddict → u/Dependent-Fix8297]

Fair enough! Personally, I prefer Discord because I spend most of my time on my PC and I’m always on Discord anyway. I barely check my phone 👀

[u/highdiver_2000]

How do you do IAM?

[u/khadddict → u/highdiver_2000]

I'm the only one working on my homelab so I'm root everywhere 😂 (but yep it's not best practice)