Skip to content

Technology Stack

Inventory of HomeLab technologies: layer diagram + list with official links in the name of each product.

Part of the implementation guide. Complementary C4 (C4 model) view: Architecture · Level 3 — Components · Level 4 — Deployment.

Layer Diagram

flowchart TB
  subgraph capa0 [Capa 0 — Hardware, SO y bootstrap]
    HW[Nodos_fisicos_Debian]
    Netplan[Netplan_br0]
    Ansible[Ansible]
  end
  subgraph capa1 [Capa 1 — Virtualización]
    Incus[Incus_cluster]
    IncusUI[Incus_UI]
  end
  subgraph capa2 [Capa 2 — Kubernetes management]
    K3s[K3s]
    KubeVip[kube_vip_opcional]
  end
  subgraph capa3 [Capa 3 — GitOps, red y acceso]
    ArgoCD[Argo_CD]
    Dex[Dex]
    GitHub[GitHub_OAuth]
    MetalLB[MetalLB]
    Gateway[Gateway_API_Kong]
  end
  subgraph capa4 [Capa 4 — Storage y secretos]
    OpenEBS[OpenEBS]
    Longhorn[Longhorn]
    SealedSecrets[Sealed_Secrets]
    OnePassword[1Password_SDK]
  end
  subgraph capa5 [Capa 5 — Opcionales y operaciones]
    VCluster[vCluster_Platform]
    CAPI[Cluster_API]
    CAPN[CAPN]
    SUC[system_upgrade_controller]
  end
  subgraph capa6 [Capa 6 — IA local, logs y seguridad]
    Ollama[Ollama_en_nodos_y_Mac]
    Router[ollama_router]
    OpenWebUI[Open_WebUI_y_Open_Terminal]
    Vector[Vector]
    VLogs[VictoriaLogs]
    Firewall[nftables_por_nodo]
  end
  HW --> Netplan --> Incus
  Incus --> IncusUI
  Dex --> IncusUI
  Netplan --> K3s
  K3s --> KubeVip
  K3s --> ArgoCD
  ArgoCD --> Dex
  Dex --> GitHub
  ArgoCD --> MetalLB --> Gateway
  ArgoCD --> OpenEBS
  ArgoCD --> Longhorn
  ArgoCD --> SealedSecrets
  Dex --> VCluster
  K3s --> CAPI --> CAPN
  Incus --> CAPN
  ArgoCD --> SUC
  ArgoCD --> Router --> Ollama
  OpenWebUI --> Router
  Dex --> OpenWebUI
  Vector --> VLogs
  Ansible --> Firewall
  Ansible --> Ollama

Layer 0 — Hardware, OS, and bootstrap

  • Ansible — Idempotent OS, network, Incus, and K3s (lightweight Kubernetes distribution) automation; Phases 0–3.
  • Netplan — Static IP on br0; Phase 1; node identity for Incus/K3s/CAPN (Cluster API Provider for Incus).
  • Debian — Base OS on the 3 nodes; global prerequisite.

Layer 1 — Virtualization

  • Incus — LXC (Linux container) cluster/VM with quorum; Phase 2; substrate for CAPN and instances.
  • Incus UI — Web management of the Incus cluster; Phase 2 (cert) + Phase 4 (OIDC —OpenID Connect— with Dex).
  • Zabbly Incus stable — Package repo; Phase 2.

Layer 2 — Kubernetes Management

  • K3s — Bare-metal management cluster; Phase 3.
  • kube-vip — Optional API (Application Programming Interface) VIP (Virtual IP) :6443; Phase 3 (fork).
  • CNI (choose one; in this HomeLab, Calico) — Phase 3:
  • Flannel — Default embedded in K3s (vxlan in br0)
  • Canal — Flannel + Calico policies
  • Calico — NetworkPolicy, optional BGP (Border Gateway Protocol)
  • Cilium — eBPF (extended Berkeley Packet Filter), Hubble, L3–L7 policies
CNI
Flannel
Zero extra steps in K3s
No native NetworkPolicy
Canal
Policies over known overlay
Legacy; two stacks
Calico
Maturity and BGP at L2
More pods/RAM
Cilium
eBPF observability
CPU/kernel; validate ARM64

Layer 3 — GitOps, network, and access

  • Argo CD — Bootstrap ApplicationSet (homelab-root) from GitHub, by waves; Phase 4.
  • Dex — Embedded OIDC (OpenID Connect) IdP (identity provider) in Argo CD; SSO (single sign-on) for Argo CD, Grafana, Open WebUI, vCluster Platform, and Incus UI (user interface); Phase 4.
  • GitHub — OAuth (Open Authorization) connector + GitOps repos; Phase 4.
  • MetalLB — LoadBalancer in LAN (local network); Phase 4 wave 0–1.
  • Gateway API with Kong Ingress Controller — HTTP(S) to Argo CD, Grafana, Open WebUI, Ollama router, and vCluster; Phase 4 wave 1 (alternatives: Traefik, NGINX Gateway Fabric).
  • 1Password Python SDK — OAuth secrets from local app; Phase 4.
  • VictoriaMetrics (with Alertmanager) — Node and platform metrics and alerts, lighter than Prometheus; Phase 4 (4.13, optional).
  • Grafana — Temperature, memory, disk, logs, and Ollama panels in grafana.homelab.local; Phase 4 (4.13, optional).
  • Discord and healthchecks.io — Alert destination (webhooks) and external watchdog (dead man's switch) that receives a ping from Alertmanager, in case the entire cluster goes down; Phase 4 (4.13, optional).

Layer 4 — Storage and secrets

Layer 5 — Optional and operations

  • vCluster Platform — Virtual clusters + web kubeconfig (host K3s and vClusters); Phase 5.
  • Cluster API — Declarative cluster API; Phase 6.
  • CAPN — Incus provider for CAPI (Cluster API); Phase 6.
  • clusterctl — CAPI bootstrap CLI (command-line interface); Phase 6.
  • system-upgrade-controller — Staged K3s upgrades; Phase 4 wave 3.

Layer 6 — Local AI, logs, and security

  • Ollama — Language models (LLM, Large Language Model) on CPU (central processing unit), on-demand in deborah, invincible and oliver, and on nodes that join as nodes. Guide · add a node.
  • Ollama Router (ollama-router, custom) — Single entry point (ollama.homelab.local): automatic node registration, model selection, client tokens, and model and node metrics.
  • Open WebUI — Chat with the assistant, with Dex login; Open Terminal as a sandbox terminal for the assistant to run code.
  • K8sGPT — Cluster analysis with Ollama; staged (its operator requests cluster-wide permissions).
  • Vector → VictoriaLogs → Grafana — Centralized logs (30 days) and daily and weekly reports with AI in the #ia Discord channel (guide).
  • nftables — Host firewall on each node (role host_firewall), with automatic rollback.
  • NetworkPolicy default-deny by namespace and oauth2-proxy — prepared and to be activated in stages (Authentication Model).

Each layer in the enterprise and in the cloud

The same stack, viewed through each lens. The details of each row (trade-offs, benefits, and official links) are in the "Decision in other environments" block of the linked page.

Everything runs on three machines with free software: the stack of the upper layers. No licenses and full control; in exchange, the operation, updates, and backups are yours.

Layer What changes in a company Detail
Virtualization Platform with support (vSphere, Proxmox VE, Nutanix, OpenStack) Phase 2
Kubernetes 3 control planes with etcd and a supported distribution (RKE2, OpenShift) Phase 3
GitOps Argo CD with commercial support; every change audited in Git Phase 4
Networking and ingress Dedicated load balancers or MetalLB in BGP; gateway with support Networking
Storage SAN/NAS or supported storage with backups outside the cluster Storage
Secrets Central vault with rotation and auditing (Vault, 1Password Business) Secrets
Identity Corporate IdP with MFA (Entra ID, Okta, Google Workspace) Authentication
Monitoring Guards, scaling, and long-term retention Monitoring
Logs Compliance retention and SIEM Logs
AI Local inference with GPU when data cannot leave Local AI
Multi-tenancy A virtual cluster per team or customer Phase 5
Cluster fleet Cluster API or the provider's fleet console Phase 6
Backups 3-2-1 rule with tested RPO/RTO Backups
Layer GCP AWS Azure Oracle Cloud (OCI)
Virtualization Compute Engine EC2 Azure Virtual Machines OCI Compute
Kubernetes GKE EKS AKS OKE
Networking and ingress Cloud Load Balancing and GKE Gateway ELB and AWS Load Balancer Controller Application Gateway for Containers OCI Load Balancer and Native Ingress (only Ingress)
GitOps Config Sync EKS Capability for Argo CD GitOps extensions (Flux and Argo CD) Argo CD installed on OKE
Storage Persistent Disk, Hyperdisk, and Filestore EBS and EFS Azure Disk and Azure Files Block Volume and File Storage
Secrets Secret Manager Secrets Manager Key Vault OCI Vault
Identity Workforce Identity Federation IAM Identity Center Microsoft Entra ID IAM Identity Domains
Metrics Managed Service for Prometheus Managed Prometheus and Managed Grafana Azure Monitor and Managed Grafana OCI Monitoring
Logs Cloud Logging CloudWatch Logs Azure Monitor Logs OCI Logging
AI Gemini Enterprise Agent Platform Bedrock Microsoft Foundry OCI Generative AI
Backups Backup and DR and Backup for GKE AWS Backup Azure Backup Block Volume Backups

Generally, you gain managed operations, SLAs, and scale; you lose control, pay for usage, and become more tied to each provider.