Context My homelab runs on a single physical server: an old i7 with 32 GB of RAM. On top of it, I built a Kubernetes cluster with microk8s. It scales easily, the community is huge, and there is a tool for everything: logs, security, backups. It can also run in hybrid mode, with my local node and some nodes in the cloud if I ever need them. I didn’t start with a few containers and migrate later. I went straight to Kubernetes. ...
Users expect every service to be secure by default. You never know who might be listening, even on your own network. That’s why HTTPS has become standard in any modern setup. This article covers how I set it up on a Kubernetes cluster with Cloudflare, Traefik and Let’s Encrypt’s DNS-01 challenge. One of my constraints was to be able to reinstall the whole server very quickly. And that’s exactly what got me a Let’s Encrypt 429, rate-limited. So if you don’t want to wait 24 hours for nothing like I did, read this carefully. ...
Context My homelab server runs 28 services. Most of them are private, and I wanted an easy way to reach them from outside. I chose Tailscale. Here is how I set it up. The network underneath Before the VPN setup, some context on how my Kubernetes cluster network is laid out. Most of my services are private, a few are internet-facing. That split gave me two classes of service, and each class has its own namespace, network, and security rules (NetworkPolicies). ...