Home k3s platform

The problem

I kept building small apps that only ran on my laptop. I wanted one place to host them, with the same release step for every app, and without opening a port on my home router.

How it works

• One k3s cluster with one namespace per app. Every app has the same few manifests: namespace, config, secret, deployment, service.
• Public traffic comes in through a Cloudflare Tunnel that dials out from the cluster, so no public DNS record points at my home IP.
• Releasing is `git tag vX.Y.Z && git push`. A GitHub Actions job on a self-hosted runner builds the image and writes its commit SHA into the manifest in a separate config repo.
• Argo CD watches that config repo and syncs the change into the cluster. CI never talks to the cluster.
• Secrets are committed only as sealed secrets. Metrics, logs, uptime probes and analytics run in their own namespace.

A decision: Images are pinned to the commit SHA in a separate config repo

The config repo is the single record of what should be running. A rollback is a git revert, and nobody can bump a version by hand and forget to commit it.

What was hard

Cloudflare becomes a single point of failure for every public host, and the cluster is on a home connection. I accepted that for personal projects and cover it with caching for the pages that matter.