Homelab

Homelab test

Structure

• clusters
• infrastructure
• apps

Init Secrets

# create age.agekey from private key or copy from ~/.config/sops/age/keys.txt
cp ~/.config/sops/age/keys.txt age.agekey
kubectl create secret generic sops-age -n flux-system --from-file age.agekey
rm age.agekey

sudo apt install open-iscsi sudo systemctl enable --now iscsid

Bootstrap Flux

flux check --pre
flux bootstrap github \
  --owner=jacokok \
  --repository=homelab \
  --branch=main \
  --path=./cluster \
  --personal

Flux

# Get kustomizations
flux get kustomizations
flux get kustomizations -w

# Reconcile
flux reconcile source git flux-system
flux reconcile kustomization infrastructure

kubectl describe kustomization apps -n flux-system
kubectl describe kustomization infrastructure -n flux-system

kubectl get events -n flux-system --sort-by='.lastTimestamp'

Manage Secrets

# Install sops and age
# Import age private key
# Encrypt file
sops encrypt secret.yaml > test-secret.yaml
sops decrypt test-secret.yaml
kubeseal --cert=pub-sealed-secrets.pem --format=yaml < secret.yaml > sealed-secret.yaml

Dependency Updates (Renovate)

Dependency management is handled by Renovate (config: renovate.json). Flux auto-updates are disabled: HelmRelease chart versions are pinned exactly and git-based sources track release tags instead of branches.

• Minor & patch updates (chart versions, container image tags) are auto-merged by Renovate.
• Major version updates are opened as PRs for manual review.
• Flux itself (cluster/flux-system/gotk-components.yaml) is also updated by Renovate.

Install the Renovate GitHub App on this repo (or run self-hosted) with write permissions for branches/PRs/merges.

Flux picks up merged changes automatically from the main branch.

install k3s

curl -sfL https://get.k3s.io | sh -s - --disable traefik --write-kubeconfig-mode 644

Provisioning (Ansible)

Node provisioning is automated with ansible under ansible/. Setup is handled by mise.

cd ansible
ansible-playbook playbooks/site.yml

ansible-playbook ansible/playbooks/k3s.yml -l venus

See ansible/README.md for details.

TODO

• Setup ansible to install k3s -> ansible/playbooks/k3s.yml
• Ansible update + install packages -> ansible/playbooks/system.yml
• Ansible setup registries.yaml -> ansible/playbooks/registries.yml
• Ansible ssh: configure key-based auth + passwordless sudo via playbook

sudo mkdir -p /etc/rancher/k3s
sudo nano /etc/rancher/k3s/registries.yaml
sudo systemctl restart k3s
sudo systemctl restart k3s-agent

configs:
  "index.docker.io":
    auth:
      username: "<YOUR_DOCKERHUB_USERNAME>"
      password: "<YOUR_DOCKERHUB_TOKEN_OR_PASSWORD>"

DB Restore / Import

PGPASSWORD="pass" psql -h localhost -p 5432 -U ha -d postgres -c "DROP DATABASE ha;"
kubectl exec -n ha -c postgres pod/ha-db-1 -- psql -U postgres -c "CREATE DATABASE ha OWNER ha;"

# Dump db
PGPASSWORD="pass" pg_dump -h source -U user -d db -Fc --no-owner --no-acl > db.dump
# Port forward the db pod
# Restore
PGOPTIONS="-c maintenance_work_mem=512MB" PGPASSWORD="pass" pg_restore -h localhost -p 5432 -U ha -d ha -Fc ha.dump