Purpose My TrueNAS lives in a VM on Proxmox, with its NVMe drives passed straight through so ZFS owns the hardware directly. The pool is encrypted with aes-256-gcm. For a while the encrypted write...
Purpose Renovate scans the repositories on the self-hosted Gitea and opens pull requests that bump container image tags, Helm charts, GitHub Actions and similar dependencies. It proposes changes. ...
Purpose The Hermes agents run unattended: the daily ops digest, the health board and the doc-writer cards. Until recently nothing measured how well a run went, and the only limits on tools were re...
Purpose The Proxmox host epyc (EPYC 8024P, 8 cores / 16 threads, 64 GiB RAM) ran the k3s cluster, Graylog, Hermes, Gitea and more. It hit host-wide memory exhaustion several times between 2026-10-...
Purpose The cluster serves its routes over HTTPS with one wildcard certificate. A single Traefik TLSStore named default holds it, and every IngressRoute says tls: {} to use it. The change started...
Purpose Posts go stale the moment Renovate bumps an image tag. A weekly job checks which versions each post documents against what is actually running, generates a rolling issue with the drift rep...
Purpose Four daily, report-only checks run against every Docker and k3s workload in the lab. Each answers a basic question: is the timezone set correctly, do logs actually reach Graylog, was this ...
Finding problems is the easy half. The compliance fixer turns findings into pull requests, and after a human merges, brings the Docker host to exactly the merged state without ever deleting data. I...
The ops digest is a daily health check for the entire homelab. It runs without an LLM in the loop, uses twelve independent collectors, and posts results to one rolling issue that only changes when ...
Purpose The daily Kubescape scan (Kubescape) already produces a full security audit of the k3s cluster, but a report with hundreds of controls is hard to read every day. This agent wraps the scan ...