sift.sh
Home Kubernetes cluster running k3s on repurposed bare-metal hardware, fully managed via GitOps
sift.sh is a 4-node k3s cluster built from repurposed desktop hardware - old i5s and a Core2 Duo laptop board pressed into service as cluster nodes. Everything from ingress TLS to SSO to app deployment is declared in Git and reconciled by ArgoCD, with no manual kubectl apply in normal operation.
- GitOps deployment: ArgoCD continuously reconciles cluster state from a Git repo, with SOPS-encrypted secrets decrypted only at sync time - no plaintext credentials ever committed
- Single sign-on across every internal service (ArgoCD, Headlamp, Longhorn, Git, monitoring) via Authelia 2FA backed by an LLDAP directory, enforced at the Traefik ingress layer
- Public/internal DNS split: Cloudflare Tunnel exposes only hello.sift.sh to the internet with zero inbound ports opened on the home network, while ExternalDNS and internal CoreDNS auto-register every other *.sift.sh service for LAN-only access
- Automated TLS for every ingress via cert-manager using DNS01 ACME challenges against the sift.sh zone
- Distributed block storage across nodes via Longhorn, with etcd backups and a documented control-plane restore runbook
- Self-hosted platform apps running on the cluster: Forgejo (git hosting), Headlamp (cluster dashboard), kube-prometheus-stack (monitoring), plus a Minecraft server and DDNS/RIPE Atlas probes
4-node bare-metal topology on heterogeneous, repurposed hardware: souffle (i5-7500, 16GB RAM, NVMe) as the sole control plane - the only node with enough RAM and fast storage to justify the role - with sorbet, toupee, and parfait as workers. toupee runs a 2-core Core2 Duo laptop chip, so scheduling constraints keep CPU-heavy workloads off it; parfait carries the most disk and anchors Longhorn's primary replicas.
Request path: OPNsense gateway/router -> Cloudflare Tunnel (proxied DNS, no exposed ports) -> Traefik ingress inside the cluster. Traefik forward-auths every internal request through Authelia, which validates against LLDAP over an LDAP bind before allowing it through to the target service.
TLS and DNS are fully automated: cert-manager issues per-service certificates via DNS01 ACME, storing them as the shared lldap-tls secret; ExternalDNS and CoreDNS split the sift.sh zone into a public subset (just hello.sift.sh) and an internal-only subset covering the rest of the platform.