Everything deployed on top of the platform — the actual workloads serving users (or, in this case, mostly serving me).
Grouped by what each app does, not by what stack it runs on. Each page covers the choice rationale, alternatives, and per-cluster deployment notes generated from the matching k8s/apps/ tree.
| App | Role |
|---|
| Jellyfin | Movies, shows, music streaming — the central media server |
| Immich | Self-hosted Google Photos replacement |
| Tube Archivist | YouTube channel archiver with metadata |
| Audiobookshelf | Audiobook + podcast library |
| Navidrome | Subsonic-compatible music server |
| Stump | Comics, manga, and ebook server |
| Komga | Comics/manga server — decommissioned, replaced by Stump |
| Tachiyomi | Manga catalog backend |
| RomM | ROM manager with IGDB / MobyGames metadata |
| Your Spotify | Personal Spotify listening-history dashboard |
| FileFlows | Media-processing pipeline (transcodes, conversions) |
| Loupe | gallery-dl watcher with a swipe-to-decide review queue |
Productivity & files
| App | Role |
|---|
| Nextcloud | File sync, calendar, contacts, office |
| Outline | Team wiki and knowledge base |
| Memos | Quick-capture Markdown notes and timeline |
| Paperless | Document scanning, OCR, and archiving |
| Vikunja | Task and project management |
| Tandoor | Recipe manager and meal planning |
| FileBrowser Quantum | Web file manager over the TrueNAS shares, with share links |
| Filebrowser | Retired October 2026 — replaced by FileBrowser Quantum |
| Baserow | No-code database / Airtable replacement |
| Homebox | Home inventory and asset tracker with photos and receipts |
| Kindred | Family CRM — shared people graph with private notes and gifts |
| Voyage | Trip planner with S3-backed photos and Keycloak login |
Identity & security
| App | Role |
|---|
| Keycloak | OIDC / SAML identity provider — the auth root of trust |
| LLDAP | Lightweight LDAP directory (users + groups) |
| Pocket ID | Passkey-first OIDC provider — decommissioned, replaced by Keycloak |
| Vaultwarden | Bitwarden-compatible password manager |
| DefectDojo | Vulnerability management — decommissioned June 2026 |
| Policy Reporter | Kyverno PolicyReport dashboard |
DevOps & automation
| App | Role |
|---|
| Bubbles | Attention layer over Gitea, Vikunja and GitHub projects |
| Gitea | Source of truth for the homelab repo + every personal project |
| Gitea Runner | Gitea Actions runners + Renovate driver |
| n8n | Workflow automation |
| Prefect | Python workflow orchestration with Kubernetes-backed runs |
| Selenium | Browser-automation grid |
Monitoring & alerting
| App | Role |
|---|
| Monitoring | Victoria-Metrics + Grafana stack for everything observability |
| Gatus | External health-check / uptime monitor |
| ntfy | Push-notification broker for alerts |
| Kromgo | PromQL results as public badges and graphs |
Dashboards & reading
| App | Role |
|---|
| Homepage | Single-pane-of-glass dashboard for the whole homelab |
| Family landing page | The family's own start page with their services and how-tos |
| Miniflux | Minimalist RSS reader |
| Kiwix | Offline knowledge archive (Wikipedia, Stack Exchange, …) |
Sports & fitness
| App | Role |
|---|
| Cairn | Activity tracker importing Garmin and Strava workouts |
| Ironscan | Ironman race-data scanner with results and splits browser |
Communication & utilities
| App | Role |
|---|
| Bichon | Rust-based self-hosted webmail |
| Cypht | Lightweight multi-account IMAP webmail, nothing stored locally |
| PrivateBin | Encrypted pastebin |
| IT Tools | Bundle of dev / IT utilities — encoders, formatters, generators |
| Kleinbase | Selling assistant for Kleinanzeigen and eBay over a Baserow table |
On the Maresa Docker host
These don't run on Kubernetes — they live on the always-on Synology so they keep working when the cluster is down or being upgraded.
On the edge cluster
These run on the single public Hetzner node — the edge cluster — as internet-facing services with their own domains, on local-path storage and deliberately far from the home network.
How an app page is structured
Each per-app page is two layers:
- Hand-written prose at the top — what the app is, why it ended up the choice here, alternatives that were on the table, opinionated operational notes.
## Cluster Deployment at the bottom — auto-generated from the cluster-specific README.md next to the manifests (k8s/apps/<name>/<cluster>/README.md). Includes the Helm release / image pin, detected platform dependencies, and the public URLs from the HTTPRoute.
See Components for the building blocks every app reuses (CNPG cluster patches, k8up Schedules, NetworkPolicy templates) and Platform for the controllers underneath.