Kubernetes Homelab

The main event, and where most posts on this blog come from: bare-metal Talos Linux on a recycled 4-node Supermicro chassis. IPv6-only pods, Cilium speaking BGP to Mikrotik spines with BFD failover, ArgoCD ApplicationSets driving every cluster from one repo, Piraeus/DRBD replicated storage, CloudNativePG, KubeVirt.

garage-ssec-proxy

A small Go proxy that makes SSE-C encryption transparent to S3 clients that can’t speak it: it injects the encryption headers and re-signs each request (SigV4) on the way to a Garage cluster. Built so CloudNativePG backups land encrypted on storage that never sees the key.

Garage S3 co-op

A distributed Garage object-storage cluster spread across friends’ homelabs: one shared NixOS flake, sops-nix secrets, and onboarding a new node is a pull request. The repo is private (it’s shared infrastructure), but the design is getting a write-up here.

Multihomed Kubernetes (series)

Making one cluster survive any single switch, link, or node failure: spine-leaf topology, Cilium iBGP to Mikrotik route reflectors, then BIRD2 with BFD for sub-second failover. Part 1 is up; Part 2 lands soon.

LibreNMS IPv6 Client Dashboard

You can’t nmap-scan a /64 into an inventory, so this polls MikroTik REST APIs for IPv6 neighbor and bridge tables and serves a Python dashboard mapping IPv6 ↔ MAC ↔ switch port. Found a 28,000-entry bridge table bug in my own network in the process. (write-up)

Cloud Resume Challenge

The AWS Cloud Resume Challenge: static site + serverless backend, deployed through CI. Frontend source / Backend source.

NixOS Dotfiles

Machine configs as a flake, the same declarative habit as everything above, applied to the machines I type on.