Biggs was my dog. He was the best boy and when I found out I could buy a domain with .dog as the extension, I migrated my homelab services to biggs.dog to honor him.

This is a mono repository for my home infrastructure and Kubernetes clusters, following Infrastructure as Code (IaC) and GitOps practices using Flux. Desired state lives in Git; Flux reconciles it into the clusters.

The homelab is split across two clusters (an in-progress migration — see Architecture):

• cluster0 — a single-node cloud cluster on UpCloud (public WAN IP 87.58.147.51) acting as the edge / management plane: public ingress, identity (Dex), VPN (NetBird), and the Talos management plane (Omni).
• cluster1 — the on-prem bare-metal workload cluster (the original 6-node homelab): all applications, storage, GPU/AI workloads, and observability.

Each cluster runs its own Flux Operator instance syncing a dedicated path on the main branch of this repository:

Flux components on each cluster: Source Controller, Kustomize Controller, Helm Controller, Notification Controller.

clusters/
├── cluster0/                      # ⛅ UpCloud cloud edge/mgmt cluster (single node)
│   ├── flux-system/               # FluxInstance + HelmRepository/OCIRepository sources
│   └── kubernetes/apps/
│       ├── auth/dex/              # Dex OIDC IdP (root identity for edge apps)
│       ├── cert-manager/          # Certificate issuance (ACME + CA issuers)
│       ├── external-secrets/      # External Secrets + 1Password Connect
│       ├── kube-system/cilium/    # Cilium CNI (L2 announcement, single WAN IP)
│       ├── netbird/               # NetBird WireGuard VPN (road-warrior access)
│       ├── network-policies/      # CiliumNetworkPolicies (two-tier: apps + infra)
│       ├── networking/            # agentgateway (public ingress) + Cilium LB/L2
│       └── omni/
│           ├── omni/              # Sidero Omni (in-cluster Talos management plane)
│           └── image-factory/     # Talos image factory
└── cluster1/                      # 🏠 On-prem bare-metal workload cluster (6 nodes)
    ├── flux-system/               # FluxInstance + sources
    └── kubernetes/apps/
        ├── affine/                # Collaborative workspace
        ├── ai-system/             # vLLM + kagent agents + substrate runtime + Flux/VM/Exa MCP
        ├── auth/                  # SSO stack (Pocket ID + OAuth2 Proxy)
        ├── biggs/                 # Tribute
        ├── cnpg/                  # CloudNativePG databases
        ├── dragonfly/             # Redis-compatible cache
        ├── dreamcast/             # GPU game streaming (Fenrir/Wolf + NVIDIA GPU Operator)
        ├── external-secrets/      # External Secrets + 1Password Connect
        ├── games/                 # Dedicated game servers (Windrose)
        ├── jitsi/                 # Video conferencing
        ├── kube-system/           # Cilium (BGP), CoreDNS, NFD, GPU plugins, storage
        ├── liquidctl/             # NZXT Kraken Elite AIO fan/pump control (nv-01)
        ├── manticore/             # Full-text search
        ├── matrix/                # Continuwuity (Matrix)
        ├── media/                 # Emby, Bookboss, Ersatz, Nsyncd
        ├── network-policies/      # Tiered CiliumNetworkPolicies (apps + infra)
        ├── networking/            # k8s-gateway, lan-dns, agentgateway (LAN + public)
        ├── observability/         # VictoriaMetrics/Logs, Grafana Operator
        ├── openebs/               # Container-attached storage
        ├── renovate/              # Automated dependency updates
        └── rook-ceph/             # Distributed storage

Six bare-metal nodes managed via Omni (now run in-cluster on cluster0 — see Core Components), all running Talos Linux v1.13.5 with Kubernetes v1.36.2. This is where all workloads (and the GPU) live.

A single-node cluster hosted on UpCloud, exposed on the public WAN IP 87.58.147.51. It fronts the homelab (public ingress via Cloudflare → agentgateway) and runs the identity, VPN, and Talos-management planes. Node specs are cloud-VM sized and not pinned in this repo. VIP advertisement uses a Cilium L2 announcement policy with a single-IP pool (87.58.147.51/32); the UpCloud Managed LB only supports TCP/HTTP (no UDP), so UDP services like NetBird STUN are exposed via externalIPs bound on the node's NIC instead of a LoadBalancer Service.

GPU notes (cluster1): The Intel iGPUs are exposed to workloads via the Intel GPU device plugin for media transcoding. nv-01's RTX 5090 is time-sliced into 4 nvidia.com/gpu replicas. vLLM (the in-cluster LLM, see AI & Agents) and the Dreamcast game-streaming stack can't coexist on the 32 GB card (vLLM alone pins ~27–31 GB), so the GPU Arbiter scales vLLM to 0 for the duration of any gaming session and restores it after; the time-slices then serve the session's Wolf sidecar + game container plus an always-on GPU-tuning DaemonSet. The AMD integrated graphics on the two AMD nodes are present but unused (nodes run headless).

cluster1 DNS: LAN clients resolve biggs.dog via lan-dns (192.168.6.16), which forwards to k8s-gateway for internal VIPs and to NextDNS over DoT for everything else. In-cluster, CoreDNS (kube-dns, Talos-managed) forwards biggs.dog to k8s-gateway's ClusterIP (10.105.74.41), so pods resolve *.biggs.dog internally instead of hairpinning through Cloudflare. Both forward targets use the ClusterIP (not the LB VIP) to avoid a Cilium same-node LB hairpin failure when a resolver pod is co-located with k8s-gateway.

cluster0 ingress is the cluster0-gateway (networking namespace) with HTTPS listeners for the edge hostnames omni.biggs.dog, dex.biggs.dog, and netbird.biggs.dog (TLS terminated with per-host certs issued in the networking namespace via the letsencrypt-prod ClusterIssuer — DNS-01/Cloudflare), plus a wildcard *.biggs.dog HTTP listener. Omni re-encrypts to its pod's own cert (HTTPS backend).

Service-specific gateways:

• ersatz (cluster1, game server): LAN-only HTTPS gateway at ersatz.biggs.dog

Both clusters run a least-privilege CiliumNetworkPolicy posture. Policies live centrally in apps/network-policies/policies/ and are wired through two independent Flux Kustomizations so the rollout can be staged and rolled back per-tier:

• cluster1 — network-policies-apps (policies/apps/) covers lower-risk application namespaces (affine, auth, biggs, dragonfly, games, jitsi, manticore, matrix, media, renovate). network-policies-infra (policies/infra/) covers higher-risk infrastructure namespaces (networking, ai-system, cnpg-system, observability, rook-ceph, plus a scoped kube-system policy covering only the Hubble relay/UI pods).
• cluster0 — network-policies-apps covers auth (Dex), netbird, and omni. network-policies-infra covers networking (agentgateway), cert-manager, external-secrets, flux-system, and Cilium L2 announcement. Suspend independently with flux suspend kustomization network-policies-infra if the edge or control plane regresses.

The two clusters run different identity stacks:

cluster0 (edge) — Dex (dex.biggs.dog): Dex (v2.45.1) is the root OIDC identity provider for the edge plane, backing Omni. It runs stateless (storage.type: memory) with enablePasswordDB: true and a static admin user; clients/secrets are templated into the config from 1Password. Config lives in apps/auth/dex/.

On cluster1, protected apps attach an agentgateway AgentgatewayPolicy with traffic.extAuth that calls OAuth2 Proxy's /oauth2/auth endpoint and redirects unauthenticated users to the Pocket ID sign-in. OAuth2 Proxy uses Dragonfly (Redis) for session storage so the browser cookie stays a small session ticket (a cookie-based session carrying tokens grows past 4 KB, gets chunked, and didn't survive the ext-authz subrequest — causing a forward-auth redirect loop).

• Forward-auth (cluster1, via OAuth2 Proxy): Rook-Ceph dashboard, Bookboss, kagent UI
• Native OIDC (cluster1, direct Pocket ID client): Grafana

NetBird (≥ v0.65) authenticates against its own embedded IdP; the cluster0 Dex is attached to that embedded IdP as an upstream OIDC connector at runtime (NetBird dashboard → Settings → Identity Provider). The dashboard never talks to Dex directly.

Detailed app deployment configs are in clusters/cluster1/kubernetes/apps/<namespace>/.

The dreamcast namespace is an on-demand, GPU-accelerated game-streaming platform built on Games on Whales Fenrir/Wolf. A Moonlight client pairs with an in-cluster moonlight-proxy, and the direwolf-operator spins up a per-session pod (Wolf compositor + the app) on the NVIDIA node, encodes the desktop with NVENC, and streams it back over RTSP/RTP.

The single 32 GB RTX 5090 can't host vLLM and a gaming session at once. The gpu-arbiter-operator reconciles a cluster-scoped GPUArbiter CR (cluster0) and:

1. Scales vLLM to 0 when gaming pods appear, back to 1 when idle.
2. Lifts the scheduling gate (gpu.biggs.dog/await-vram) once VRAM is freed.

Deployment: apps/dreamcast/gpu-arbiter-{operator,instance}. Image: shrinedogg/gpu-arbiter-operator:v0.1.1. Query status with kubectl get gpuarbiter cluster0.

Three gaming apps under fenrir/app/apps.yaml: Firefox (reference), Test Ball (synthetic videotestsrc), Steam (Big Picture + persistent /home/retro PVC + DLSS). See NOTES.md for details.

See NOTES.md for the list of patched Dreamcast images (direwolf-operator, moonlight-proxy, wolf-agent, wolf, gpu-arbiter-operator) and why they diverge from upstream.

The ai-system namespace runs a fully local, GPU-accelerated agentic-ops stack: an OpenAI-compatible LLM served in-cluster by vLLM, and kagent agents that use it to inspect and troubleshoot the cluster over MCP. No inference leaves the cluster. Per-task agent routing for this repo is documented in .rules.

Available agents (kubectl get agents,sandboxagents -n ai-system):

The 11 agents split across two deployment patterns:

• Classic kind: Agent CRs (invocable now via MCP): flux-agent, vm-agent, exa-agent, cilium-debug-agent, cilium-policy-agent, codebase-agent. The two cilium agents are re-defined statically in apps/ai-system/kagent/cilium-agents/ (disabled in the chart) so they carry generic k8s_* tools alongside Cilium tools; codebase-agent lives with its server in apps/ai-system/codebase-memory-mcp/.
• kind: SandboxAgent CRs on the substrate runtime (apps/ai-system/kagent/substrate-agents/): k8s-agent, helm-agent, promql-agent, observability-agent, cilium-manager-agent. These are READY=True with golden actors built, but are not yet invocable via the MCP server — an upstream kagent limitation (MCPHandler.listReadyAgents lists only v1alpha2.Agent and hard-codes reason DeploymentReady, while substrate agents report WorkloadReady). Use the fallbacks in .rules / direct kubectl until kagent wires SandboxAgent → A2A.
• Disabled chart agents: argo-rollouts-agent, istio-agent, kgateway-agent (plus the 5 substrate agents and 2 cilium agents are disabled in the chart so they don't double-render as classic Agent CRs).

See .rules for agent selection by task domain and the live invocability status.

cluster1 uses Cilium BGP to peer with the UDM router (ASN 64563, 192.168.1.1) from Cilium's ASN 64564, advertising LoadBalancer IPs from the pool 192.168.6.6–254 (deliberately off-subnet from the nodes on 192.168.2.0/24, so VIPs route via the UDM). This allows in-cluster services to advertise VIPs to the LAN. k8s-gateway has fallthrough enabled with NextDNS resolvers (45.90.28.232 / 45.90.30.232) so unknown biggs.dog names resolve to public DNS — this is how LAN/VPN clients reach cluster0 services (omni/netbird/dex at 87.58.147.51). The default k8s-gateway forward plugin (/etc/resolv.conf) was replaced to avoid a DNS loop with in-cluster CoreDNS. See NOTES.md for details on the full networking stack (Cilium, k8s-gateway, CoreDNS, Gateway API).

cluster0 advertises its single WAN IP (87.58.147.51/32) via a Cilium L2 announcement policy (no BGP — it's a single cloud node). Public DNS for omni/dex/netbird/*.biggs.dog resolves through Cloudflare to the cluster0-gateway; per-host TLS certs are issued in the networking namespace by the letsencrypt-prod ClusterIssuer (DNS-01/Cloudflare). UDP STUN (NetBird 3478) bypasses the cloud LB via externalIPs.

Secrets follow a three-tier model (on both clusters):

1. SOPS with age encryption — Git-committed secrets (Cilium policies, app defaults, and the 1Password Connect credentials/token). The repo-wide age key was rotated on 2026-07-04; sops.yaml lists the deployed key plus a pre-staged next key.
2. External Secrets + 1Password — Runtime secrets from 1Password vaults (API keys, credentials) via 1Password Connect (connect chart v2.4.1 on both clusters).
3. cert-manager — Automatic certificate issuance + renewal (ACME Let's Encrypt, CA issuer).

See NOTES.md for details.

• Kubernetes cluster(s)
• Flux CLI
• SOPS with the age key for decryption
• 1Password Connect credentials

Each cluster bootstraps via its own Flux Operator syncing from:

https://github.com/shrinedogg/biggs.dog.git

• cluster0 syncs clusters/cluster0 (edge/mgmt).
• cluster1 syncs clusters/cluster1 (workloads).

Flux automatically reconciles each cluster's state based on the manifests in its path. Secrets are decrypted by SOPS (age key) before Flux applies them.

Dependency updates are managed by Renovate using the repository config in renovate.json. It is set up to update Flux HelmRelease chart versions (HelmRepository and OCI-based sources) and container images referenced in Kubernetes manifests, including the media stack under clusters/cluster1/kubernetes/apps/media/.

Each application follows a consistent pattern:

<namespace>/
├── kustomization.yaml    # Namespace-level kustomization
├── namespace.yaml        # Namespace definition
└── <app>/
    ├── ks.yaml           # Flux Kustomization
    └── app/
        └── helmrelease.yaml (or raw manifests)

Personal homelab configuration - feel free to use as reference.