# Self-hosted Kubernetes platform across home and cloud

> A Talos Kubernetes cluster across home nodes and a cloud VPS, with single sign-on, DNS, tunnels and encrypted secrets, all managed as code.

- Role: Owner, platform design and operation
- Period: Ongoing
- Status: Ongoing
- Stack: Kubernetes, Talos, Flux, Authentik, Cloudflare Tunnel, Traefik, CoreDNS, SOPS, age, Longhorn

## Context and problem

Services run on hardware at home and on a cloud VPS. They must be reachable from outside, use one login, and keep no secrets in plain text.

## Setup

- Talos Linux, three control-plane nodes and one worker at home, one cloud worker over a WireGuard mesh (KubeSpan).
- Flux GitOps: cluster state is reconciled from the repository.
- Two Traefik ingress controllers: internal (home) and external. Cloudflare Tunnel (`cloudflared`, two replicas) for external access.
- Authentik as identity provider; OIDC bootstrap jobs configure Paperless, n8n, Node-RED and Home Assistant.
- Secrets encrypted with SOPS and age, stored in the repository.
- Longhorn for replicated storage; CloudNativePG for PostgreSQL.
- Talos upgrades run automatically through Renovate and an in-cluster executor.