server

A personal homelab repository that treats the whole cluster as infrastructure-as-code. The stack runs on k3s, with Ansible playbooks, roles and inventory as the editable source of truth; a rendered Docker Compose directory exists only on the Raspberry Pi host. The repository documents that a migration from Docker Compose to k3s was completed on 2026-08-14, when Docker was uninstalled from the main server node, and the slice-by-slice record is kept in an archive folder as history. Three hosts are described. daniel-box is the k3s control plane and runs almost every workload, including the Traefik edge, Authelia SSO and OIDC issuer, Pi-hole DNS, Longhorn storage, CrowdSec and a public WireGuard endpoint; Ansible runs on it. daniel-server is a k3s agent node with an Intel iGPU used for Jellyfin/Tdarr transcoding, LVM storage and UPS/NUT shutdown handling. daniel-pi is the only remaining Docker host, kept LAN-only, running a second WireGuard instance plus a small utility stack. Ingress is centralised on Traefik, routing through IngressRoute CRDs, with Authelia gating protected routes via forward-auth middleware and issuing OIDC tokens for apps that support them. Cloudflare proxies public hostnames, while local names are resolved by Pi-hole on the LAN. The README notes that network segmentation is not blanket-enforced: only a few roles define NetworkPolicies, and where policies exist only ingress rules are enforced by the cluster CNI. Deployment is split into a Docker play and a k8s play, both driven by each host's containers_list. The Docker play resolves a dependency graph using custom toposort filters and per-role meta/deps.yml upstream declarations, so dependencies come up first and tagged runs pull in unmet dependencies. The k8s play toposorts roles and derives edges onto Traefik (for CRD installation) and Authelia (for middleware) from the role templates themselves, with an explicit depends_on for edges no template carries. Filters are unit-tested via pytest in a pre-commit hook. Commands are documented for deploying a single service, a dry run, everything, or the Pi target, plus separate bring-up and bootstrap playbooks. Cross-cutting concerns include SOPS/age-encrypted secrets decrypted at runtime, with gitleaks in pre-commit and an out-of-band key backup; Prometheus, Grafana, Loki and Tempo observability with dashboards provisioned as code; Longhorn scheduled backups to Backblaze B2 with documented per-volume tiering and disaster-recovery procedures; Renovate-driven pull requests for pinned image versions and hook revisions; and security tooling including Authelia TOTP/OIDC, CrowdSec with per-node agents, fail2ban and UFW default-deny inbound. Quality gates run through a pre-commit tool covering YAML/JSON lint, ansible-lint, gitleaks, rendered-template validation, secret-rotation registry sync, ruff and pytest. Guidance is included for adding new services, whether as k8s roles rendering Deployment/Service/IngressRoute/PVC manifests, or as Docker roles for the Pi.