Talos production cluster
The production cluster is the primary Kubernetes cluster of the homelab. It runs the bulk of workloads: media (Jellyfin, Immich, Tube Archivist), productivity (Nextcloud, Outline, Paperless), DevOps (Gitea, n8n, Keycloak), and observability.
This page is a top-down overview that links into every layer.
Stack
Versions
| Component | Version | Declared in |
|---|---|---|
| Talos Linux | v1.14.3 | talos/talos/topf.yaml |
| Kubernetes | v1.37.1 | talos/talos/topf.yaml |
| Flux | v2.9.6 | k8s/clusters/talos/flux-system/gotk-components.yaml |
These are the versions declared in Git. Flux updates itself as soon as its manifests merge; a Talos or Kubernetes bump only reaches the nodes with the next topf upgrade.
Layers at a glance
| Layer | What | Doc |
|---|---|---|
| Hardware | Intel NUC × 4 — three NUC 13 Pro (i5-1340P, 64 GB RAM, 2 TB NVMe) and one NUC 14 (Core Ultra) | hardware/talos |
| Hypervisor | Proxmox VE (4-node cluster proxmox1–4); 3 control-plane VMs + 4 worker VMs + 4 NetBird LXCs, all VMs SecureBoot (OVMF + vTPM) | foundation/proxmox |
| Cluster OS | Talos Linux, configured by topf | foundation/talos |
| GitOps | Flux pulling from Gitea, decrypting secrets via SOPS | foundation/flux |
| Network | Cilium (kube-proxy replacement, WireGuard, L2 announcements) | platform/cilium |
| Storage | Longhorn (cluster-native block) + NFS to TrueNAS (bulk media) | platform/longhorn · hardware/nas |
| Ingress | Envoy Gateway with PROXY-protocol-v2 from the edge cluster | platform/envoy-gateway · topics/envoy-gateway-proxy-protocol-v2 |
| Secrets | External Secrets + SOPS | platform/external-secrets · operations/sops |
| Backups | k8up Schedule → Restic → Hetzner S3 (warm) → Synology NAS (hot) → encrypted WD drives (cold) | operations/ |
Cluster machines
| Role | Name | Host | Notes |
|---|---|---|---|
| Control plane | talos-cp-01 | proxmox1 | etcd member |
| Control plane | talos-cp-02 | proxmox2 | etcd member |
| Control plane | talos-cp-04 | proxmox4 | etcd member; pinned to the NUC 14's E-cores |
| Worker | talos-worker-01 | proxmox1 | extra NICs into VLAN 104+105, GPU passthrough |
| Worker | talos-worker-02 | proxmox2 | extra NICs into VLAN 104+105, GPU passthrough |
| Worker | talos-worker-03 | proxmox3 | extra NICs into VLAN 104+105, GPU passthrough; the host keeps CPUs 0–3 free as the control-plane failover slot |
| Worker | talos-worker-04 | proxmox4 | extra NICs into VLAN 104+105, 12 cores, no GPU passthrough today (gpu: false in talos.tf) |
Networking summary
| Plane | What |
|---|---|
| Pod CIDR | 10.100.0.0/16 |
| Service CIDR | default (10.96.0.0/12) |
| Node mgmt | VLAN 100 (192.168.100.0/24) — control planes + workers |
| Storage | VLAN 104 (192.168.104.0/24) — workers only, for NFS to TrueNAS |
| Public | VLAN 105 (192.168.105.0/24) — workers only, for ingress |
| Inter-site | NetBird mesh — production network exposes those VLANs to peers |
Full network map: Fabric overview · NetBird · UniFi.
What runs here
- All persistent apps with stateful PVCs (Longhorn-backed).
- Anything GPU-accelerated — the worker nodes carry the Intel iGPU passthrough.
- The control plane for Flux's primary
GitRepositoryand the SOPS keys.
The edge cluster handles only public-facing ingress + sidecar workloads; everything stateful lives here.
Reconciliation order
Flux applies the cluster as a set of Kustomizations from k8s/clusters/talos/. Most of the platform has no ordering at all; what is ordered funnels through infra-configs, the gate every app waits for.
18 platform Kustomizations and 55 apps. An arrow means "has to be ready before"; the 12 entries without an incoming arrow start as soon as Flux is running.
Lifecycle commands
# Render for review, diff against the live nodes, apply (from talos/talos)
topf render
topf apply --dry-run
topf apply
# Upgrade
topf upgrade
# Build or replace a node: the VM boots the nocloud image (maintenance mode),
# the config joins it, and only the upgrade installs the metal image it is
# meant to run — never skip the last step (see Talos › Bootstrap flow)
topf apply --nodes-filter '^<host>$'
topf upgrade --nodes-filter '^<host>$'
# Reconcile Flux
flux reconcile kustomization flux-system
# Inspect
kubectl get nodes -o wide
kubectl get pods -A | grep -v Running | grep -v Completed
flux get all -A
See also
- Hardware → Talos — physical specs
- Foundation → Proxmox — hypervisor running the VMs
- Foundation → Talos — the OS configuration workflow
- Foundation → Flux — GitOps loop
- Cluster — edge — the smaller sister cluster