Platform Engineering · Home Lab
I built a production-grade platform at home, then wrote down everything I learned.
A 6-node Talos Kubernetes cluster on Proxmox with full GitOps delivery, zero-trust networking, and local GPU inference — plus the applications running on top of it. Three rebuilds from scratch. One data loss. All of it documented, including the parts that didn't work.
Start here
Two things that are built and running — and one arc still being written. If you have five minutes, start with any of them.
Built and running
The homelab platform
A production-grade Kubernetes platform on Talos and Proxmox — full GitOps, zero-trust networking, local GPU inference. It grew from a single Home Assistant box into 72 ArgoCD applications, documented across fourteen decision records that show the tradeoffs I accepted rather than solved.
Product · Shipped, in daily usebig-ads
A grocery flyer viewer for a user with severe visual impairment. Accessibility constraints drove every engineering decision — no build step, no database, graceful degradation across three scraping fallbacks.
The arc, still in motion
The platform
This didn't start as a platform. It started in 2024 with Home Assistant, some ESP32s, and wanting to learn a little Linux — and got serious in July 2025.
The platform's seven capability areas — see all diagrams →
Talos on Proxmox
3-node Proxmox cluster with ZFS. 6-node Talos Kubernetes cluster — immutable, API-driven, no SSH. One worker dedicated to GPU inference.
Zero-trust by default
Cilium eBPF networking with per-namespace egress policy. Istio ambient mode for mTLS without sidecars. VLAN segmentation across eight trust zones.
Git is the only way in
App-of-Apps ArgoCD bootstraps everything. Vault is the single source of truth for
secrets, synced at runtime by External Secrets. No kubectl apply.
Inference that stays home
GPU passthrough from Proxmox through Talos into Kubernetes, serving local models on the GPU worker. No prompt leaves the network, and there's no per-token bill.
How it grew
Eighteen months of tinkering, then a year of building. It didn't arrive as a platform — it accreted, one problem at a time, through a couple of rebuilds and one fight I lost outright.
It started small and stayed small for a while: Home Assistant and a handful of ESP32s on an existing Unifi and Synology foundation, then containers running straight on the NAS. The goal was to learn a little Linux. Eighteen months of tinkering that looks unremarkable on a timeline — and taught me enough to want something better.
Containers moved off the NAS onto a dedicated server, run as a pet. ArgoCD and self-hosted Gitea made Git the only way to change what was deployed. This is where the homelab stopped being a hobby project and started being infrastructure.
SSO through Authentik, secrets through Vault and External Secrets, automated certificates. It stopped being "some containers" and started being a platform.
A dedicated AI workstation joined the lab, but GPU passthrough into k0s containers never came together. I lost that one outright — and it forced the next two steps.
Kubernetes moved onto disposable Proxmox VMs running immutable Talos Linux. GPU passthrough worked on the first serious attempt, and the mental model flipped from "repair the server" to "rebuild the node."
Cilium eBPF with per-namespace egress policy, and Istio ambient mTLS across the mesh. A new service reaching the internet became a deliberate change to Git, not a default.
Ollama on the GPU worker, then eleven MCP servers giving AI tooling scoped access to the platform, then vLLM for throughput. The lab now helps operate itself.
The reasoning behind each step is in the decision records; what broke getting there is in lessons learned.
Why the failures are on the site
A homelab writeup that only lists what worked tells you nothing about the engineer. These pages are the ones I'd actually want read.
Lessons learned
The GPU passthrough fight I lost completely on k0s. The MTU misconfiguration that looked like application bugs for weeks. Retrofitting secrets management after the fact — and why that ordering was the mistake.
PracticeAI-assisted engineering
Where AI tools genuinely accelerated this work, where they cost me days, and the most dangerous failure mode: being confidently assured a destructive action was safe.