Machines
The datacenter in the hallway runs eighty-nine apps and opens no ports
Five nodes, two old laptops, a 3D-printed case, eighty-nine apps, zero open ports. This homelab writeup runs tighter ops than most companies I have worked near.
The most impressive machine I saw this month is not in a datacenter. It is in somebody's home, partly inside a case that came off a 3D printer, and its own dashboard counts eighty-nine applications with every workload showing Ready.
This k3s homelab writeup lays the whole thing out: a five-node Kubernetes cluster built from hardware that was headed for a recycling drawer. Two old laptops and a homemade server form the high-availability control plane, voting on quorum so the cluster survives any one of them dying, and they double as ingress. Two mini PCs sit underneath as the worker pool and carry the actual load.
Eighty-nine apps, counted by category
The dashboard splits the eighty-nine into sixteen personal apps, fifty-eight platform services, eight media apps, five automation workloads, and two tooling apps.
Personal is the family's digital life: Immich for photos, Paperless-ngx for documents. Media is Jellyfin and its companion stack on the side. Automation is Airflow plus a bridge into Ziggy, the home assistant I covered in this house has a brain.
Sit with that ratio for a second. Fifty-eight of the eighty-nine exist to run, secure, store, and watch the other thirty-one. Most of a serious platform is platform. This hallway knows it.
Zero open ports, and one door for changes
Zero ports open to the internet. Every app sits behind TLS and a login, with single sign-on through Authentik. Certificates come from an internal CA via cert-manager, issued and renewed automatically for every .home domain, so none has ever expired because a human forgot.
Shipping a change is stricter than at most companies. Nothing gets kubectl-applied by hand, ever. Argo CD owns every workload through its app-of-apps pattern, synced from four repos split by namespace: tools, automation, media, personal. A change means a pull request. That is the only way in.
Then the layers you normally meet at an enterprise platform team. Kyverno checks admission policy before a workload starts, with Policy Reporter showing what got blocked. Tetragon watches runtime behavior at the eBPF level, down to syscalls and process lineage, and network policy is enforced with eBPF too. Infisical holds the secrets and rotates them. Prometheus scrapes metrics, Loki aggregates every pod's logs, Grafana draws both, and Alertmanager pages on node health, sync failures, and certificates approaching expiry.
Storage tradeoffs with prices attached
Longhorn replicates storage across the nodes: two copies for ordinary workloads, three for state that actually matters, like the Authentik and Infisical databases.
And one deliberate exception, the detail I keep quoting at people. The 250-gigabyte photo library lives on a single-replica volume pinned to one node's disk, because replicating that much imagery three times over a home network buys the household nothing. The media library skips distributed storage entirely and streams off a directly mounted RAID 10 array, since Jellyfin does not need a distributed filesystem to play a movie.
Choices with reasons and prices written down. Rarer than the hardware.
Where your own cluster starts
The writeup is the receipt, monitoring stack and all. The distribution underneath is k3s, a lightweight Kubernetes, and the official k3s quick-start guide gets a single node running with one shell command.
Read the writeup, then look at the drawer of old hardware you were about to recycle. That drawer is a control plane now.
Next up
The studio reel that runs live in WebGL, with no video file