[ 00 / Where my AI agents run ]

KubeLab Platform & Engineering Cockpit

Argo CD v3.4.1 · 2 applications syncedK3s v1.34.4+k3s1

The 24/7 hybrid cloud and bare-metal infrastructure platform powering my autonomous AI agents, edge inference, and GitOps workflows.

The proof

Whose problem: Mine. It is the stack under all my work: my own products, client work in staging, and the blueprint a client can replicate.
The constraint: One operator. Every change to a cluster is a pull request, and production is promoted only after I merge it.
Measured result: Each service says who can reach it, measured from outside the mesh and checked again every week.; Measured in October 2026
Where to verify: Services, and who can reach them

[ 01 / The Engineering Foundry Behind Every Product ]

KubeLab is the operating foundation behind every project, open-source tool, and product showcased across this portfolio (including Pollex, Hive MCP, KubeLab Platform API, and this Astro website). It runs on rented machines at Hetzner Cloud (Germany) and Google Cloud and on a bare-metal homelab in the USA, as independent single-node K3s clusters.

Nothing shown here is an isolated mockup or tutorial demo: every workload is built, tested in staging, secured behind Zero-Trust authentication, and operated 24/7 through immutable GitOps pipelines.

01 · Reproducible GitOps

Infrastructure as code with Ansible, Terraform and K3s. Argo CD reconciles the clusters against Git.

02 · Edge AI & Privacy

Local LLM inference on a Jetson Nano. The prompt never leaves the house.

03 · Agent memory

Hive MCP AST RAG serving AI agents only the context a task needs.

[ 02 / Services, and who can reach them ]

Each row says who can reach the service, measured from outside the mesh. Only the mesh-only ones stay off the internet: there are zero port-forwarding rules on my residential USA network, so for those there is no address to expose in the first place.

13 documented here

Public 3
Behind Authelia 3
Own login 4
Mesh only 3

Access measured from outside the mesh on October 18, 2026.

Status	Service	Category	Access	Node	Endpoint	Description & Stack
// Core Gateway
	KubeLab Platform API	Core Gateway	Public	vps	api.kubelab.live/health	High-throughput Go API, Token-Bucket rate limiting and platform telemetry. GoTraefikArgoCDKubernetes
	Traefik Ingress Proxy	Core Gateway	Behind Authelia	vps	traefik.kubelab.live	Layer 7 cloud and homelab edge ingress router with Let's Encrypt TLS termination. TraefikK3sLet's EncryptCrowdSec
	Headscale Mesh VPN	Core Gateway	Own login	vps	vpn.kubelab.live	Self-hosted WireGuard control plane with MagicDNS and isolated tenant routing. WireGuardGoTailscaleSQLite
	Authelia Zero-Trust Auth	Core Gateway	Own login	vps	auth.kubelab.live	Two-factor authentication and forward-auth identity provider for internal services. AutheliaRedisTOTPDuo
	CoreDNS & Pi-hole Split Gateway	Core Gateway	Mesh only	rpi4	—	Authoritative Split DNS daemon and network sinkhole routing staging zones and microservices. CoreDNSPi-holeGoDNSSEC
// AI & Inference
	Pollex Edge AI	AI & Inference	Public	jetson	mlorentedev.github.io/pollex	English text polish on a local Qwen 2.5 1.5B, served by llama.cpp on the GPU, with an optional cloud fallback. Gollama.cppCUDA
	Hive MCP Server	AI & Inference	Public	vps	mlorentedev.github.io/hive	AST-based chunker and MCP memory layer for multi-agent workflows. PythonFastMCPTree-sitterSQLite FTS5
// GitOps & Delivery
	Argo CD GitOps Hub	GitOps & Delivery	Own login	gcp1	argo.kubelab.live	Declarative GitOps continuous delivery synchronizing K3s clusters with drift detection. ArgoCDKubernetesKustomizeHelm
	Gitea On-Prem Forge	GitOps & Delivery	Own loginOn demand	beelink	gitea.kubelab.live	Lightweight self-hosted Git repository and automated CI mirror for private codebases. GiteaGoPostgreSQLSSH
// Observability
	Grafana Telemetry	Observability	Behind Authelia	vps	grafana.kubelab.live	Centralized metrics visualization, cluster resource dashboards and latency graphs. GrafanaPrometheusLokiGlances
	Loki Log Aggregator	Observability	Mesh only	vps	—	Horizontally-scalable log aggregation system indexed by Kubernetes pod labels. LokiPromtailGoS3 Storage
	Uptime Kuma Probes	Observability	Behind Authelia	rpi3	status.kubelab.live	Independent synthetic HTTP and ICMP health monitor with an uptime history. Node.jsVueSQLiteDocker
// Storage & Data
	MinIO S3 Object Store	Storage & Data	Mesh only	vps	—	High-performance S3-compatible distributed object storage for backups and AI models. MinIOGoS3 APIK3s

[ 03 / The machines underneath ]

8 machines: 2 rented from 2 cloud providers and 6 sitting in my house, plus 1 reserve on AWS that Terraform recreates when it is needed. Only 3 of them run Kubernetes, each as its own single-node cluster rather than part of a shared one — a shared control plane that can take the whole fleet down with it is not a homelab, it is one failure with extra steps.

8 machines · 3 independent K3s clusters · 1 reserve

Hetzner Cloud VPShealthy
Production Ingress & Core IDP
k3s · ARM64 · 4 vCPU (Ampere Neoverse-N1) · 7.5 GB · Nuremberg (Germany)
Google Cloud Platform Hubhealthy
Argo CD GitOps Control Plane (ADR-063)
k3s · x86_64 · 2 vCPU (AMD EPYC 7B12) · 2 GB · Eemshaven (Netherlands)
Acemagic Staging Clusterhealthy
Staging K3s & Heavy Workloads
k3s · x86_64 · Intel N95 (4c) · 11.5 GB · Homelab (USA)
Acemagic Dev & Agent Nodehealthy
Remote development and agent workspaces
docker · x86_64 · Intel N95 (4c) · 11.5 GB · Homelab (USA)
NVIDIA Jetson Nanohealthy
Edge AI GPU Inference Node
systemd · ARM64 · 4c Cortex-A57 · 128-core Maxwell GPU · 3.9 GB LPDDR4 · Edge Hardware (USA)
Beelink Forge & CI Runnerhealthy
Git forge, CI runner and object store
docker · x86_64 · Intel N95 (4c) · 7.5 GB · Homelab (USA)
Raspberry Pi 4 Gatewayhealthy
Split DNS Gateway & Pi-hole
docker · ARM64 · Broadcom BCM2711 (4c) · 7.6 GB · Homelab (USA)
Raspberry Pi 3 Monitorhealthy
Telemetry & Uptime Kuma
docker · ARM64 · Broadcom BCM2837 (4c) · 0.9 GB · Homelab (USA)
AWS Standby Hubreserve
Cold standby for the Argo CD hub
ARM64 · 2 vCPU (Graviton2) · 2 GB · Not provisioned; Terraform recreates it (eu-central-1)

[ 04 / Where everything runs ]

All 8 machines. The reserve on AWS is listed above and not drawn, because it only exists while Terraform has it provisioned. The 3 that run K3s each run a single-node cluster, with no shared control plane.

The resolver, the monitor and the forge sit deliberately outside Kubernetes: each has to keep working while the platform is broken. A WireGuard mesh ties the fleet together with no inbound ports open.

Rendered at build from src/diagrams/topology.architecture.json

[ 05 / How a change reaches production ]

One push to master produces one multi-arch image. Staging runs it unattended; production runs the same bytes only once a release pull request merges.

Promotion re-tags a digest rather than rebuilding, so what production serves is what staging validated. Argo CD reconciles both clusters from Git — nothing is pushed to them.

Rendered at build from src/diagrams/flows.architecture.json

[ 06 / Internal Developer Platform (IDP) Catalog ]

The operational cockpit and tooling suite: live cloud infrastructure spend, incident runbooks, security posture, and upstream dependencies.

Monthly Cloud Spend$25.10(September 2026, from list prices and bills)

Operational DomainsOps · Triage · Security · Tools · Status · Docs

Explore full IDP catalog

[ 07 / Autonomous execution plane ]

How do I build in this agentic era?

An AI model with no limits eventually does damage. The platform above is where the agents run — bounded by kernel flock semaphores, ephemeral Git worktrees sharing .git/objects, and cross-model adversarial review gates.

Explore the AI Harness→Read technical note→

Figures last reconciled against the cluster on2026-08-24 · df583db