Infrastructure

This site, and everything else on melonsoda.org, runs on a small 2L pc running Proxmox VE and a virtualized Kubernetes cluster inside of it.

The host

An ASRock X600, with 64 GBs of ram, an 8700G and 2 4TB nvmes. Server runs Proxmox VE.

The cluster

Three Talos Linux nodes: one control plane and two workers. Talos is an immutable Linux distribution built specifically for Kubernetes: there is no SSH, no package manager. The entire machine configuration is managed through the Talos API, with static IPs on the LAN.

GitOps

Every workload on the cluster is declared in git. An ArgoCD instance watches the talos-infra repository on my self-hosted Forgejo instance and makes the cluster match it, continuously. Adding a service means merging a pull request; nothing is ever configured by logging into a server. Rolling back a bad release is a git revert.

CI/CD

Forgejo Actions, with a runner running Podman, builds container images on every push. The images land in a private registry inside the cluster, and the pipeline bumps the image tag in the git repository. ArgoCD sees the change, syncs, and the new version is live. The whole loop is just push, build, deploy and takes only a few minutes.

This site

melonsoda.org is a static site built with Hugo. The same pipeline packages the output into an nginx image, pushes it to the registry, and ArgoCD deploys it. No JavaScript, no database, no tracking.

The edge

A small VPS runs a self hosted instance of Netbird, with its reverse proxy built in (Traefik). melonsoda.org terminates TLS there and is tunneled over the WireGuard-based overlay back to the cluster at home. No ports are exposed on the home connection.

I also run a second VPS that hosts Coturn + Prosody (the XMPP server).

Updates

A bot runs every night and looks for new versions of the services on the cluster. When one is found, it reads the release notes of that version, opens a pull request with the change, and merges it if the update is small and safe. Bigger updates always wait for a manual check.