Things I've built & run

Hardware

• 3× Beelink EQi12 mini PCs — 16 cores / 64 GiB each
• Dell PowerEdge R740xd — 80 cores / 256 GiB, iDRAC-managed
• Harvester HCI v1.7.1 hyperconverging compute + storage
• Custom 3D-printed rack mounts; ~120 W idle draw

Platform & orchestration

• Guest RKE2 Kubernetes — 3 control-plane + 3 worker nodes
• kube-vip HA API server with MetalLB L2 load balancing
• Traefik ingress + cert-manager (Let's Encrypt & internal CA)
• Managed through Rancher

GitOps & CI/CD

• Self-hosted Gitea with native Actions runners
• Pipeline: build → Semgrep + Trivy scan → push to internal registry
• ArgoCD for GitOps continuous deployment
• Helm + Kustomize for application delivery

Storage & data

• Longhorn distributed block storage
• 18 PostgreSQL clusters via the CloudNativePG operator
• Nightly off-site backups to Wasabi S3 (90-day retention)

Networking & access

• VLAN-segmented network with dual Pi-hole DNS (HA, DNS-over-HTTPS)
• Cloudflare Tunnel for public HTTP/S — zero inbound ports
• External WireGuard proxy with game-aware DDoS filtering for UDP (~10–15 ms)

Observability & security

• Prometheus + Grafana, InfluxDB, and Beszel host monitoring
• Public uptime monitoring via Uptime Kuma
• Kubewarden admission policies + hourly CIS benchmark scans
• Vaultwarden-managed secrets; MFA on every admin surface

What it runs

60+ containerized services spanning public, personal, and platform workloads:

• Public sites — dustbowl.games and this portfolio
• AI & automation — Open WebUI (Ollama) and n8n workflows
• Productivity — Outline wiki, Linkwarden, Vikunja, snippet manager
• Media & home — Home Assistant, Paperless-ngx, family apps
• Platform — Grafana, Rancher, ArgoCD, Gitea, Vaultwarden