Ixnextiliztli

Homelab tlahcuilolli

Tlatecpanaliztli homelab CI/CD pipeline

Case-study style tlahcuilolli: quen Debian control plane, Pimox app workers, external Gitea, local registry, Kyverno policy, Argo CD, monitoring, ihuan static demo shelf omocuepque repeatable Kubernetes delivery path.

Portfolio tlamantli

Evidence quen production

Inin yeyi proof points ma quitta hiring manager achto: platform ownership, production reliability at scale, ihuan reserved MLOps path para model-serving tequitl.

Tlamantli 01

Self-hosted Kubernetes delivery platform

Git push, validation, image build, registry, GitOps sync, policy guardrails, monitoring, retained storage, ihuan VM worker provisioning ipan ce tepiton platform in quipia operational truth.

Xiquitta architecture
Tlamantli 02

Enterprise SRE ihuan incident automation

Oracle ihuan occe enterprise roles quinextia production side: 20,000+ developer users, 10,000+ external customers, Linux troubleshooting, automation, runbooks, on-call improvement, ihuan high-scale incident response.

Xiquitta CV evidence
Tlamantli 03

MLOps deployment platform placeholder

Reserved para next serious demo: FastAPI inference, Kubernetes manifests, rollout strategy, model metrics, drift signals, ihuan rollback behavior.

Xictlapo placeholder

Architecture mapa

Homelab, end to end

Current delivery path starts ika push to Gitea, runs local validation, builds arm64 images, syncs validated commit into GitOps mirror, ihuan lets Argo CD reconcile from app workers. Infrastructure path stays manual through lab.sh, including PXE/Pimox template builder, NVMe-backed worker clones, Kyverno policy placement, ihuan opt-in OpenWrt firewall VM, while OCI edge routes public traffic back through private path.

Homelab architecture map Git push enters Gitea, Gitea Actions validates and builds app images, OpenTofu manages cluster and provisioning layers, Debian keeps the control plane and PXE services, Pimox app workers run Argo CD, Kyverno, and app workloads on NVMe-backed VMs, OpenWrt can run as an opt-in firewall VM, and the OCI edge routes traffic into Kubernetes services. Source, validation, and images Control plane and provisioning Workers, edge, and workloads Developer laptop edit, test, push main Gitea repository https://lab2025.duckdns.org/git/ main is the release branch Gitea Actions runner Debian hosted runner runs validated deploys Validation gates Gitleaks secret scan Trivy IaC and image posture Buildx image build linux/arm64 website + demos OpenTofu + lab.sh manual infra apply path apps command for CI deploys PXE + preseed service dnsmasq TFTP, nginx HTTP Debian 13 arm64 netboot golden-node prep scripts kubeadm control plane API server and control loops workloads pushed to app workers GitOps mirror validated commit copied locally Argo CD reads deploy state GitOps + policy controllers Argo CD and Kyverno pinned to app workers Monitoring stack Prometheus, Grafana, Loki Promtail, node-exporter, KSM Storage and backups OpenEBS retained PVs Gitea dumps and monitoring data OCI edge host nginx, HAProxy, Varnish, Squid TLS, routing, caching public DNS entry point Tailscale + edge routes 30080 website, 30081 demos 3000 Gitea on Raspberry Pi Raspberry Pi 192.168.100.89 external Gitea Docker service optional edge-app worker repo home and backup source Orange Pi 5 Plus Pimox pimox-worker app nodes workers on nvme_thin_pool Argo CD, Kyverno, apps idempotent qm automation OpenWrt firewall VM VM 9050, opt-in only vmbr0 WAN, vmbr1 LAN simple firewall path DHCP optional, VLANs later Local registry :30500 php-website and demos-static pulled by app workers push workflow scan build manual infra validated Git serve boot join path Pimox template firewall VM policy + GitOps secure tunnel service traffic image pulls

Diagram intentionally operational: quinextia app delivery loop, image flow, provisioning path, worker-placement boundary, monitoring layer, OpenWrt firewall option, ihuan public traffic path ahmo hiding practical bits in quichihua small lab behave like platform.

Xiquitta Christmas-tree version
Nehuatl mostla, judging

Melahuac: tleica niquichihua nochi inin ihuan ahmo zan ome containers quen normal person?

Nehuatl, coffee ipan noma

Pampa onciquitta "host a website" ihuan oniquilhuia: "tlein panos tla inin quipia control plane, GitOps, retained storage, image registry, ihuan miec yancuic ways para nimopinahuiz?" Melahuac goal catca practice: provision infra, quipia config ipan Git, deploy ika automation, xitlapana, xicyecana, ihuan xiquitta tla huel rebuild ahmo ika shell history ihuan vibes.

Nehuatl mostla, judging

Tleica kubeadm? Managed clusters catca too emotionally stable?

Nehuatl, coffee ipan noma

Quena. kubeadm quicahua cluster nechca metal; in polite way quitosnequi niquita nochi sharp edge. Debian node quipia control plane, Raspberry Pi joins quen arm64 worker, ihuan Pimox ipan Orange Pi 5 Plus quimaca repeatable Debian 13 arm64 VM workers. Suddenly networking, storage, container runtimes, certs, ihuan node recovery amo cloud magic: no problema.

Nehuatl mostla, judging

Canin motlatia CI/CD part?

Nehuatl, coffee ipan noma

Tepiton, zan real. OpenTofu quichihua cluster, platform, apps, ihuan edge layers. Argo CD quitta Git ipan app workers, Kyverno quimaca policy pressure, Docker Buildx quichihua linux/arm64 images, ihuan local registry quimaca cluster. Clean loop: Git mopatla, image omochiuh, cluster updated, ahmo aca monequi kubectl-edit 2 AM.

Nehuatl mostla, judging

Tleica own registry ihuan Gitea? Simple option amo oncatca?

Nehuatl, coffee ipan noma

Simple option huel oncatca, ic heroic oniquignore. Registry quitosnequi experiments amo monequi yasque public image repo, ihuan external Gitea quimaca lab own Git service ahmo quichihua Kubernetes responsible para source of truth. In ome quichihua setup ma nesi quen tepiton platform ika opinions, responsibilities, ihuan storage drama.

Nehuatl mostla, judging

Tlein achi cualani?

Nehuatl, coffee ipan noma

Storage. Nochipa storage. Kubernetes, Docker, retained volumes, ihuan build caches huel quitemitia root disk ika quiet confidence of bad decision. Moving OpenEBS local volumes ihuan Docker data ipan external SSD quicuep lab de "tleica nochi tlatla?" ica "okay, axcan huel tlatequipanoa." Growth, supposedly.

Nehuatl mostla, judging

Platform controllers finally moved off control plane?

Nehuatl, coffee ipan noma

Quena. Argo CD ihuan Kyverno axcan target homelab.dev/node-role=app workers, including Kyverno hook jobs, para Debian node ma mocahua focus ipan control-plane duties. Inin change quichihua lab ma nesi amo nochi balanced ipan achto machine in boot.

Nehuatl mostla, judging

Current cluster huel quipia nochi inin, o tiquchichinos Pi?

Nehuatl, coffee ipan noma

Pi survives pampa demos cateh intentionally local-first ihuan now ship as separate static artifact. Website pod mocahua portfolio shell, demos-static pod serves static bundles, ihuan browser quichihua expensive work. Tla later onicship real ONNX object detection, Transformers.js, o full video transcoding models, monequi lazy-load ipan browser o yasque beefier node.

Nehuatl mostla, judging

Axcan lab huel quichihua own worker nodes?

Nehuatl, coffee ipan noma

Quena, ihuan axcan ika fewer crossed fingers. Debian quipia provisioning layer ika dnsmasq, nginx, PXE boot files, GRUB, ihuan Debian 13 arm64 preseed. OpenTofu notza Pimox through qm, quichihua VM 9000 ipan local storage, quiboota from network, quinstala OS, quichihua golden-node prep, disables swap, verifies cgroups, installs containerd ihuan kubeadm tooling, then seals it as template. Worker clones cateh idempotent by VMID ihuan now land on nvme_thin_pool.

Nehuatl mostla, judging

Ihuan OpenWrt no quisa nican?

Nehuatl, coffee ipan noma

Zan simple firewall, ahmo networking science project. Pipeline huel quichihua opt-in OpenWrt ARM SystemReady VM, attach vmbr0 quen WAN ihuan vmbr1 quen LAN, ihuan configure LAN side ahmo rewriting Orange Pi host networking. DHCP stays optional, VLANs wait until onca managed switch ihuan local test window.

Nehuatl mostla, judging

Tlein omopatla ipan observability ihuan scheduling side?

Nehuatl, coffee ipan noma

Monitoring moved de "someday" to "running," ihuan scheduling moved de "whatever fits" to explicit worker placement. Prometheus Stack, Grafana, Loki, Promtail, node-exporter, ihuan kube-state-metrics quimaca useful signals; next step quitosnequi elegir few alerts in melahuac nechixitisque para right reasons.

Yancuic activity log

Tlein omopatla since first build

Lab omocuep de working Kubernetes experiment into more complete self-hosted delivery system. Latest work focused on trust, repeatability, VM-based expansion, controller placement, ihuan making deploys match exact commit in passed validation.

  1. 01 Moved Gitea out of Kubernetes ihuan onto Raspberry Pi as local Git service, while keeping public /git/ route through edge stack.
  2. 02 Installed ihuan validated Debian-hosted Gitea Actions runner para pushes to main can build, scan, ihuan deploy without laptop session.
  3. 03 Added custom checkout flow para /git/ subpath ihuan kept persistent Debian checkout para deployment scripts.
  4. 04 Added Gitleaks secret scanning ihuan Trivy scanning para app ihuan infrastructure tree.
  5. 05 Changed deployment so validated commit is pushed into local GitOps mirror before lab.sh runs, preventing Argo CD from reconciling older tree.
  6. 06 Hardened website, demos-static, ihuan registry workloads ika non-root containers, read-only root filesystems, resource limits, ihuan explicit writable volumes.
  7. 07 Split demos into dedicated demos-static image ihuan Argo CD application so PHP website stays small and boring.
  8. 08 Changed Gitea backups to dump from Raspberry Pi Docker container ihuan store archives on Debian host.
  9. 09 Validated full main-branch deployment path: fetch main, apply OpenTofu layers, build ihuan push arm64 images, refresh Argo CD, ihuan confirm runner completes successfully.
  10. 10 Built Debian 13 arm64 Pimox template end to end ika PXE, preseed, qemu-guest-agent discovery, cgroup validation, swap disabled, ihuan final seal step.
  11. 11 Added NVMe-backed Pimox worker clone automation para VM 9000 ma mocahua ipan local storage mientras worker nodes mochihuah ipan nvme_thin_pool.
  12. 12 Added opt-in OpenWrt VM path para simple firewall between vmbr0 ihuan vmbr1, ika guardrails in avoid Orange Pi host networking changes.
  13. 13 Installed monitoring stack ihuan moved platform add-ons such as Argo CD, Kyverno, ihuan prometheus-stack toward app-worker placement instead of treating control plane as spare capacity.

Tlamantli ihuan tleica nemi nican

Improvement tlatecpanaliztli

Todo list para next homelab pass

Inin cateh improvement proposals, amo chores zan pampa chores. Each item either reduces rebuild risk, tightens supply-chain hygiene, o makes platform easier to operate quema tlein fails.

Visitor tlamachiliztli

Tlein tijpatlaz next?

Xititla ce practical idea para homelab backlog. Submissions mocahua quen plain text, limited size, ihuan escaped quema rendered.