Infrastructure

This site does not need Kubernetes. I run it there anyway, alongside the rest of my services, on a small PC at home.

The host

The host is an ASRock X600 with 64 GB of RAM, an 8700G and two 4 TB NVMe drives. It runs Proxmox VE, and the Kubernetes nodes are virtual machines.

The cluster

The cluster has three Talos Linux nodes, one control plane and two workers. Talos is made for Kubernetes and has no SSH or package manager. I manage each node through the Talos API. They all have static IP addresses on the LAN.

GitOps

Every workload lives in the talos-infra repository on my Forgejo server. Argo CD watches the repository and applies its contents to the cluster. I add services through pull requests rather than configuring them on the nodes. If a release breaks, I revert the commit.

CI/CD

Forgejo Actions builds a container image after each push using a Podman runner. It sends the image to a private registry in the cluster, then updates the image tag in talos-infra. Argo CD picks up that commit and deploys it. A push usually reaches the cluster within a few minutes.

This site

melonsoda.org is a static Hugo site. The pipeline puts the generated files in an nginx image, pushes it to the registry and lets Argo CD deploy it. There is no JavaScript, database or tracking.

The edge

A small VPS runs my NetBird server and its Traefik reverse proxy. TLS terminates there, then traffic travels over NetBird’s WireGuard network to the cluster at home. I do not expose any ports on the home connection.

A second VPS runs Coturn and my Prosody XMPP server.

Updates

A bot checks for new service versions each night. It reads the release notes and opens a pull request for each update. It can merge small updates on its own. I review the bigger ones first.