Platform engineering
Homelab Overview
A four-node K3s platform used to practise declarative operations, distributed storage, observability, security monitoring and evidence-driven recovery.
Architecture
Platform topology
External access, cluster services, persistent storage, monitoring and recovery are treated as connected platform dependencies.
Internet and edge
DNS, access controls and encrypted tunnel
01
Node 1
Server · etcd · workloads 02
Node 2
Server · etcd · workloads 03
Node 3
Dedicated worker 04
Node 4
Server · etcd · workloads
Ingress and service networking
Traefik, service addressing and internal DNS
K3s cluster
Four-node ARM64 platform
Case study →Capabilities
Platform engineering areas
The platform combines infrastructure building, operations, security and recovery rather than treating each tool as an isolated installation.
GitOps and secrets
Flux reconciles reviewed Git changes while SOPS with age protects Git-managed secrets and supports repeatable recovery.
View GitOps case study →Storage and recovery
Longhorn provides persistent storage. Git, etcd, volume backups and application-aware protection address different recovery scopes.
View recovery case study →Operations portal and telemetry
A local intranet is being developed to bring platform health, monitoring, operational links and future AI-assisted investigation into one interface. Prometheus, Grafana, Loki and Promtail remain supporting telemetry components rather than the final destination.
View operations portal case study →Network and ingress
Traefik, service addressing, internal DNS and tunneled public access form a documented and testable request path.
View edge case study →Security operations
CrowdSec and Wazuh support behavioural and endpoint visibility with severity, triage and incident-response workflows.
View security case study →Operational knowledge
Architecture decisions, phase evidence and Runbooks are maintained as platform components rather than optional afterthoughts.
View knowledge case study →Operating model
From change to evidence
Material changes follow a reviewable path from local edit through Git, reconciliation, runtime validation and reusable documentation.
Edit and render
Change manifests in the correct platform area and render locally.
Review and commit
Review the diff, scan for plaintext secrets, commit and push.
Reconcile and validate
Verify Flux, Kubernetes resources, application behaviour and telemetry.
Capture knowledge
Store reusable procedures as Runbooks and retain implementation evidence.