Skip to content

[ 00 / Infrastructure & AI agent platform ]

KubeLab Platform & Engineering Cockpit

Argo CD v3.4.1 · 2 applications synced K3s v1.34.4+k3s1

The 24/7 hybrid cloud and bare-metal infrastructure platform powering my autonomous AI agents, edge inference, and GitOps workflows.

[ 01 / The Engineering Foundry Behind Every Product ]

KubeLab is the operating foundation behind every project, open-source tool, and product showcased across this portfolio (including Pollex, Hive MCP, KubeLab Platform API, and this Astro website). It spans eight machines across Hetzner Cloud (Germany), Google Cloud and a bare-metal homelab in the USA, running three single-node K3s clusters.

Nothing shown here is an isolated mockup or tutorial demo: every workload is built, tested in staging, secured behind Zero-Trust authentication, and operated 24/7 through immutable GitOps pipelines and deterministic multi-agent context systems.

01 · Reproducible GitOps

100% IaC with Ansible, Terraform, and K3s. Argo CD reconciles drift in <30s.

02 · Edge AI & Privacy

Local LLM inference on a Jetson Nano. The prompt never leaves the house.

03 · Deterministic Memory

Hive MCP AST RAG serving AI agents with 67–82% prompt context reduction.

[ 02 / Services, and who can reach them ]

Three of these answer to anyone. The rest answer only from inside the WireGuard mesh, behind Authelia — there are zero port-forwarding rules on my residential USA network, so for most of this there is no address to expose in the first place.

14 documented here · 35 running across the three clusters

Core Gateway

  • KubeLab Platform API

    High-throughput Go API, Token-Bucket rate limiting and platform telemetry.

    Public api.kubelab.live ↗
  • Traefik Ingress Proxy

    Layer 7 cloud and homelab edge ingress router with Let's Encrypt TLS termination.

    Mesh only
  • Headscale Mesh VPN

    Self-hosted WireGuard control plane with MagicDNS and isolated tenant routing.

    Mesh only
  • Authelia Zero-Trust Auth

    Two-factor authentication and forward-auth identity provider for internal services.

    Mesh only
  • CoreDNS & Pi-hole Split Gateway

    Authoritative Split DNS daemon and network sinkhole routing staging zones and microservices.

    Mesh only

AI & Inference

  • Pollex Edge AI

    On-device LLM text polish running local Qwen 1.5B with zero cloud telemetry.

    Public mlorentedev.github.io/pollex ↗
  • Hive MCP Server

    Deterministic AST chunker and MCP memory layer for multi-agent workflows.

    Public mlorentedev.github.io/hive ↗
  • Ollama Local Engine

    Bare-metal local LLM inference cluster running Mistral and DeepSeek models.

    Mesh only

GitOps & Delivery

  • Argo CD GitOps Hub

    Declarative GitOps continuous delivery synchronizing K3s clusters with drift detection.

    Mesh only
  • Gitea On-Prem Forge

    Lightweight self-hosted Git repository and automated CI mirror for private codebases.

    Mesh only

Observability

  • Grafana Telemetry

    Centralized metrics visualization, cluster resource dashboards and latency graphs.

    Mesh only
  • Loki Log Aggregator

    Horizontally-scalable log aggregation system indexed by Kubernetes pod labels.

    Mesh only
  • Uptime Kuma Probes

    Independent synthetic HTTP and ICMP health monitor with 90-day SLA history tracking.

    Mesh only

Storage & Data

  • MinIO S3 Object Store

    High-performance S3-compatible distributed object storage for backups and AI models.

    Mesh only

[ 03 / The machines underneath ]

Nine machines: three rented from a cloud provider, one of those powered down, and six sitting in my house. Only three of them run Kubernetes, and they run three separate single-node clusters rather than one cluster with three nodes — a shared control plane that can take the whole fleet down with it is not a homelab, it is one failure with extra steps.

9 machines · 8 powered on · 3 independent K3s clusters

  • Hetzner Cloud VPS healthy

    Production Ingress & Core IDP

    k3s · ARM64 · 4 vCPU (Ampere Neoverse-N1) · 7.5 GB · Falkenstein (Germany)

  • Google Cloud Platform Hub healthy

    Argo CD GitOps Control Plane (ADR-063)

    k3s · x86_64 · 2 vCPU (AMD EPYC 7B12) · 2 GB · Eemshaven (Netherlands)

  • Acemagic Staging Cluster healthy

    Staging K3s & Heavy Workloads

    k3s · x86_64 · Intel N95 (4c) · 11.5 GB · Homelab (USA)

  • Acemagic Dev & Agent Node healthy

    Remote development and agent workspaces

    docker · x86_64 · Intel N95 (4c) · 11.5 GB · Homelab (USA)

  • NVIDIA Jetson Nano healthy

    Edge AI GPU Inference Node

    systemd · ARM64 · 4c Cortex-A57 (128 Maxwell CUDA cores, unused) · 3.9 GB LPDDR4 · Edge Hardware (USA)

  • Beelink Forge & CI Runner healthy

    Git forge, CI runner and object store

    docker · x86_64 · Intel N95 (4c) · 7.5 GB · Homelab (USA)

  • Raspberry Pi 4 Gateway healthy

    Split DNS Gateway & Pi-hole

    docker · ARM64 · Broadcom BCM2711 (4c) · 7.6 GB · Homelab (USA)

  • Raspberry Pi 3 Monitor healthy

    Telemetry & Uptime Kuma

    docker · ARM64 · Broadcom BCM2837 (4c) · 0.9 GB · Homelab (USA)

  • AWS Standby Hub standby

    Cold standby for the Argo CD hub

    ARM64 · 2 vCPU (Graviton2) · 2 GB · Powered down (was eu-central)

[ 04 / Where everything runs ]

Eight of the nine machines — the ninth is powered down, so it is listed above and not drawn here. Three run single-node K3s clusters that do not share a control plane.

Eight machines, three Kubernetes clusters An architecture diagram generated by Archify. gcp1 · Argo CD hub · Always-on cloud · K3s, 1 node gcp1 Argo CD hub K3s, 1 node Hetzner VPS · Traefik · API · Web · Authelia · Always-on cloud · K3s, 1 node Hetzner VPS Traefik · API · Web · Authelia K3s, 1 node RPi3 · Uptime Kuma · Always-on cloud · no K8s RPi3 Uptime Kuma no K8s RPi4 gateway · Pi-hole · CoreDNS · Homelab, on demand · no K8s RPi4 gateway Pi-hole · CoreDNS no K8s ace1 · staging workloads · Homelab, on demand · K3s, 1 node ace1 staging workloads K3s, 1 node ace2 · agent workspaces · Homelab, on demand · no K8s ace2 agent workspaces no K8s Beelink · Gitea · CI · MinIO · Homelab, on demand · no K8s Beelink Gitea · CI · MinIO no K8s Jetson Nano · local inference · Homelab, on demand · no K8s Jetson Nano local inference no K8s reconciles reconciles mesh mesh Always-on cloud Homelab, on demand Legend Backend Database Cloud Message bus
The resolver, the monitor and the forge sit deliberately outside Kubernetes: each has to keep working while the platform is broken. A WireGuard mesh ties the fleet together with no inbound ports open.

Rendered at build from src/diagrams/topology.architecture.json

[ 05 / How a change reaches production ]

One push to master produces one multi-arch image. Staging runs it unattended; production runs the same bytes only once a release pull request merges.

One push, one image, two environments An architecture diagram generated by Archify. Push to master · mlorentedev/web · mlorentedev/web — one build per push · Conventional Commits Push to master mlorentedev/web Conventional Commits release.yml · one multi-arch build · mlorentedev/web — one build per push · sha-abc1234 release.yml one multi-arch build sha-abc1234 Docker Hub · kubelab-web · mlorentedev/web — one build per push · one digest Docker Hub kubelab-web one digest repository_dispatch · web-image-published · Architecture component · needs a PAT repository_dispatch web-image-published needs a PAT Staging overlay PR · make promote · Architecture component · merged by hand Staging overlay PR make promote merged by hand staging · ace1 · Reconciled from Git, never pushed to · VPN-only DNS staging ace1 VPN-only DNS Re-tag the digest · X.Y.Z and latest · Architecture component · no rebuild Re-tag the digest X.Y.Z and latest no rebuild Argo CD · reconciles from Git · Reconciled from Git, never pushed to · gcp1 hub Argo CD reconciles from Git gcp1 hub production · Hetzner VPS · Reconciled from Git, never pushed to · Traefik, Cloudflare production Hetzner VPS Traefik, Cloudflare on merge builds once dispatch opens a PR same digest when merged prod overlay syncs syncs mlorentedev/web — one build per push Reconciled from Git, never pushed to Legend Frontend Backend Database Cloud Message bus
Promotion re-tags a digest rather than rebuilding, so what production serves is what staging validated. Argo CD reconciles both clusters from Git — nothing is pushed to them.

Rendered at build from src/diagrams/flows.architecture.json

[ 06 / The agents and the automations ]

The part of the platform that operates itself: agents that read the logs and file the triage, the protocols they are held to, the n8n workflows that fire without me, and where the telemetry lands. Most of it has no public address — it runs inside the mesh, so what you get here is the inventory and the boundary, not a dashboard link.

13 entries · 5 you can open from here

Agents

  • Curator Agent

    Neural Hive · Memory & ADR Synthesis

    Private repo
  • SRE Triage Agent

    Reactive LogQL & Anomaly Classifier

    Public open ↗
  • GitOps Delivery Agent

    Automated Release Attestation & Promotion

    Mesh only

Protocols

  • Spec-Driven Dev

    Formal RFCs, Threat Models & Archive Gates

    Private repo
  • Deterministic Gates

    dotf pr triage-queue & 100% Mutation Kill

    Public open ↗
  • Zero-Debt Doctrine

    In-Flight Lessons & Real-Time ADR Recording

    Public open ↗
  • Zero Plaintext Secrets

    Age / SOPS Cryption & In-Memory Injection

    Public open ↗

Workflows

  • SRE Incident Auto-Triage

    Alertmanager Webhook -> Log Slicing -> Slack

    Mesh only
  • Secret Expiry & R2 Backup

    Proactive Backup & Credential Rotator

    Mesh only
  • Spoke Reconciliation

    K8s Spoke Topology Drift Healing

    Mesh only

Telemetry

  • Loki Telemetry API

    LogQL Cluster Telemetry & Tracebacks

    Mesh only
  • Health & SLO Monitor

    Live Multi-Burn-Rate SLO Engine

    Mesh only
  • Codebase Activity

    L0 Infrastructure Codebase

    Public open ↗

Migrated from mlorentedev/kubelab · 6cd9ab0

[ 07 / Service Level Objectives (SLOs) & Reliability ]

90-Day SLA Target: 99.5%

90-day synthetic telemetry, latency bounds, and automated GitOps recovery targets monitored via Uptime Kuma.

90-Day Platform Availability (Uptime Kuma)
99.9% (90d, Uptime Kuma)

Build-time snapshot from Uptime Kuma — not a live feed.

Availability SLO
99.9% (90d, Uptime Kuma) Target ≥ 99.5%
Uptime Kuma
GitOps Drift Loop
<30s Drift Loop Target < 60s
Argo CD Reconciler
Edge inference
not measured Target < 5.0s
Jetson Nano (Qwen 1.5B)

[ 08 / Check it yourself ]

Runs in your browser, against the live API.

Every figure above was measured on the date at the foot of this page. This one is not: your browser asks the platform API directly and prints what it answers — its own view of each subsystem, and its own clock beside yours.

api.kubelab.live/health ready

    Figures last reconciled against the cluster on · df583db