K3s Homelab

Architecture

Hardware

Stack

Traffic Flow

Internet → Cloudflare Edge (TLS termination)
        → Cloudflare Tunnel (QUIC, outbound-only)
        → cloudflared pod (tunnel namespace)
        → ClusterIP Service
        → Application pod (workloads / monitoring namespace)

Zero inbound ports. No public IP exposure. All external traffic enters through an outbound-only tunnel to Cloudflare's edge network, routing directly to ClusterIP services. Traefik handles internal ingress routing.

Cluster Provisioning

K3s is a lightweight, CNCF-conformant Kubernetes distribution. It is Linux-only — k3d runs it inside Docker containers on macOS, transparent to all Kubernetes operations.

$ k3d cluster create homelab \
    --port "80:80@loadbalancer" \
    --port "443:443@loadbalancer" \
    --k3s-arg "--disable=traefik@server:0" \
    --wait

Default Traefik disabled at cluster creation. A manually configured instance is deployed later with HTTP-to-HTTPS redirect, TLS, and the API dashboard disabled.

$ kubectl get nodes -o wide
NAME                   STATUS   ROLES                  VERSION        INTERNAL-IP   OS-IMAGE
k3d-homelab-server-0   Ready    control-plane,master   v1.33.6+k3s1   172.18.0.2    K3s v1.33.6+k3s1

Security Hardening

Namespace Isolation

Four dedicated namespaces with Kubernetes Pod Security Standards (PSS) enforced at the namespace level via labels.

Network Policies

Default deny ingress and egress on all workload and monitoring namespaces. Every permitted traffic flow is an explicit, scoped rule.

RBAC & Pod Security

Observability

Deployed via kube-prometheus-stack Helm chart — Prometheus, Grafana, node-exporter, kube-state-metrics, and the Prometheus Operator in a single deployment.

$ helm install monitoring prometheus-community/kube-prometheus-stack \
    --namespace monitoring \
    --values manifests/monitoring/kube-prometheus-values.yaml \
    --wait

$ kubectl get pods -n monitoring
NAME                                                   READY   STATUS    RESTARTS   AGE
monitoring-grafana-67b8c4968d-zx775                    3/3     Running   0          14m
monitoring-kube-prometheus-operator-5888c6f4d6-z467s   1/1     Running   1          17h
monitoring-kube-state-metrics-66dddb6c8f-mxh9d         1/1     Running   1          17h
monitoring-prometheus-node-exporter-k766h              1/1     Running   1          16h
prometheus-monitoring-kube-prometheus-prometheus-0     2/2     Running   3          17h

Grafana is publicly accessible at dashboard.nfroze.co.uk with anonymous read-only access. 28 dashboards total — one custom Cluster Overview homepage, 27 provisioned by the Helm chart covering compute resources, networking, API server, kubelet, and Prometheus self-monitoring.

Build Log Deployment

This site runs as an Nginx container in the workloads namespace. The static files are baked into a custom Docker image — a single, versioned, immutable artefact.

FROM nginxinc/nginx-unprivileged:1.27-alpine

COPY nginx.conf /etc/nginx/conf.d/default.conf
COPY index.html /usr/share/nginx/html/
COPY css/ /usr/share/nginx/html/css/
COPY images/ /usr/share/nginx/html/images/

EXPOSE 8080

The unprivileged Nginx variant runs as UID 101 on port 8080 — compliant with the restricted Pod Security Standard without modification. Security headers (X-Frame-Options, X-Content-Type-Options, CSP, Referrer-Policy) are set in the Nginx configuration.

$ kubectl get pods -n workloads
NAME                        READY   STATUS    RESTARTS   AGE
build-log-cc4948cdb-jcqwm   1/1     Running   0          18m

$ curl -s -o /dev/null -w "HTTP %{http_code}" https://k3s.nfroze.co.uk
HTTP 200

AI Operations

Jarvis is an AI infrastructure operator with full shell access to the host and the Kubernetes API. Cluster health queries are handled in real time via Discord — live kubectl output, not cached responses.