Skip to main content

History — how the homelab got here

This repository started on September 27, 2023 with a Flux bootstrap commit and has accumulated over 10,000 commits since — roughly a fifth of them written by Renovate. Almost nothing that ran on day zero still runs today: the distribution, the ingress, the identity provider, the logging stack, and the object store have all been replaced at least once. This page is the record of those replacements — the major milestones, newest first, with links into the docs that describe the current state.

2026 — SecureBoot, consolidation, and the fork in object storage​

October — one identity provider, declared per app. Every Keycloak client moved from the admin console into the app's own TofuWorkspace: the workspace creates the client, its role-gated flow and the group mapping, and hands the app the minted secret (see Identity end-to-end). LLDAP was retired the same month — Keycloak holds the accounts itself, and account.web.kueber.eu became the realm's account console.

August — the SecureBoot generation. A hardware failure on one of the three NUCs forced the first fleet expansion since the Talos migration: a fourth host (an Intel NUC 14 with a Core Ultra CPU) joined Proxmox as proxmox4. The failed host, proxmox3, came back in September and its worker was rebuilt as a SecureBoot node, which leaves the cluster at four hosts with three control planes and four workers. Its two VMs are the cluster's first SecureBoot/UKI Talos nodes — a new control plane replacing its predecessor outright, and a worker with TPM-sealed LUKS2 disk encryption and the first GPU capable of AV1 hardware encode (see Hardware acceleration). The generation came with a lesson: Talos SecureBoot images bake lockdown=confidentiality into the signed kernel command line, which silently breaks Tetragon's eBPF sensors — fixed with a custom Image Factory schematic that relaxes lockdown to integrity. In the same month the Kubernetes API server gained OIDC authentication against Keycloak, so kubectl finally logs in the same way every other app does (see Identity end-to-end). Late in the month the identity stack lost a member: the passkey-only Pocket ID, running alongside Keycloak since March 2025, was decommissioned after its last clients were re-registered in Keycloak — one professional-grade IdP instead of two small ones.

July — three spring-cleanings at once. Object storage forked: after MinIO upstream stripped the community console, every deployment moved to SILO, Pigsty's community fork, canaried on one app before the fleet followed. Observability went Victoria-only — Loki, the OpenTelemetry collector, and the leftover Prometheus CRDs were removed in favor of VictoriaLogs and VictoriaMetrics with annotation-based scraping (see Observability & alerting). The CloudNativePG database fleet moved to Debian trixie images, and the production gateway gained a GeoIP allowlist — which surfaced an Envoy Gateway bug where a merge without sectionName freezes all xDS updates.

February–April — delivery, runtime security, and this site. Spegel brought a peer-to-peer registry mirror to the nodes (see Image supply chain); KubeVela and Tetragon arrived in March — one as a delivery experiment that is installed but not yet load-bearing, the other as the runtime-security layer that is (see Policy & runtime security). In April the documentation switched to Docusaurus — the site you are reading — and Keycloak was deployed, quickly growing from "for testing" into the central identity provider. Twingate, the last remnant of the pre-mesh remote-access era, was removed.

January — cloud resources as code. Crossplane took over provisioning of external resources like Backblaze buckets and scoped keys (see the Backblaze backup location), and the NetBird operator integrated the WireGuard mesh directly into the clusters (see NetBird connectivity).

2025 — the great replatforming​

November–December — Traefik era ends, observability pivots. After 26 months as the ingress, Traefik was replaced by Envoy Gateway and the Kubernetes Gateway API. Envoy Gateway landed November 14; the last Traefik manifest was deleted December 17. December also opened the observability rebuild on both axes at once: VictoriaLogs with fluent-bit took over logs (December 16), and the victoria-metrics-k8s-stack replaced the kube-prometheus stack that had held metrics duty since April 2024 — the consolidation that finished as the Victoria-only stack of July 2026.

October — the edge reborn on Talos. The Hetzner edge machine was rebuilt as a second, single-node Talos cluster — "edge" — acting as the public entry point and edge router. From here on, both clusters run the same OS, the same GitOps flow, and the same overlay pattern.

September — guardrails. Kyverno brought admission policy, and Loki brought the first Kubernetes-native log aggregation (both since evolved — Loki lasted ten months).

June–July — the migration that renamed everything. The defining event of the repo: the three mini-servers running K3s were retired and replaced by three Intel NUCs running Proxmox, with Talos Linux VMs on top — an immutable, API-driven OS with no SSH and no package manager (the reasoning lives in Foundation → K3s (legacy)). Provisioning became OpenTofu + Ansible (see IaC layers), iGPU passthrough brought QuickSync transcoding into the VMs, and the Synology NAS picked up a small Docker sidecar host for the workloads that don't belong in a cluster. On July 22 the commit "remove k3s system" closed the chapter; CloudNativePG arrived the same month and consolidated every app database onto operator-managed Postgres.

January–April — the identity shuffle. Authelia plus LDAP experiments in January, Pocket ID for passkey-first SSO in March, and on April 1 Authentik — the identity provider since early 2024 — was removed. The pieces settled into the LLDAP + Keycloak + Pocket ID arrangement documented in Identity end-to-end. Around the same time the self-hosted NetBird mesh began replacing point tunnels for remote access.

2024 — from app pile to platform​

December — the first edge cluster. A K3s node on Hetzner decoupled public ingress from the home IP address, and Cilium entered the stack as its CNI — the beginning of the eBPF networking layer both clusters run today.

August — real backups. k8up brought restic-based, off-site backups; the three-tier backup architecture grew from this seed.

April–May — the cluster learns to observe itself. Prometheus and Grafana arrived together on April 25 — the first real monitoring stack, and the reigning one for the next twenty months until the Victoria pivot. Two weeks later cert-manager automated TLS issuance, ending the era of hand-managed certificates (today's three certificate planes are documented in Certificate lifecycle).

January–July — automation and the personal cloud. 2024 opened with a burst of foundations: Authentik as the first SSO provider, MinIO as the first S3 store, and — on January 19 — Renovate, which has since authored more than 2,000 dependency-update commits (see the auto-merge policy). The personal-cloud staples followed: Sonarr in February (the first of what became the full media-automation fleet, FileFlows joining in November), Immich in March, Nextcloud two weeks later, AdGuard Home in May, and Twingate for zero-trust access in July.

2023 — day zero​

December — self-hosted Git and CI. Gitea was deployed on December 22 — and its Actions runner (act_runner with Docker-in-Docker) landed the very same day, so self-hosted Git and self-hosted CI share a birthday. The repository that manages the homelab has been hosted by the homelab ever since (with a Codeberg mirror as the escape hatch).

October–November — first workloads, first discipline. Jellyfin was the first real application (October 6), followed within days by Longhorn for replicated storage (see Storage tiers) and Paperless. In November, SOPS with age encryption put the first secrets safely into Git, Vaultwarden took over the passwords — and ntfy arrived on November 1, making push notifications the alert channel in month two of the repo, a role it still holds (see Observability & alerting).

September 27 — day zero. The first commits: Flux v2.1.1 component manifests, a weave-gitops dashboard, the Kubernetes dashboard, and — one day later — "deploy traefik...probably not". The hardware was three Inter-Tech mini-servers with AMD Athlon 3000G boards running K3s. The distribution, the ingress, and the dashboards are all gone now, but the model established in that first week — everything declarative, everything reconciled from Git — has survived every migration since (see GitOps flow).