Hetzner CAX21
ARM64 8GB VPS hosting production K3s, Traefik, and Headscale control plane
IAM AuthNeeds my account on the provider
Internal Developer Platform
KubeLab IDP · Control Plane & Tooling Catalog
The internal developer platform powering autonomous agents, GitOps reconciliation, and edge workloads. Transparent cloud spend, incident runbooks, security posture, and core tooling.
6 operational domains · 26 platform components · monthly cloud spend $25.10 (September 2026, from list prices and bills)
[ 01 / Cloud Infrastructure & Spend ]
Real-world infrastructure hosting and transparent monthly cloud budget
$15.59/mo
GCP Hub
e2-small instance running the central Argo CD GitOps management hub
IAM AuthNeeds my account on the provider
AWS Standby
Cold standby infrastructure for automated disaster recovery exercises
IAM AuthNeeds my account on the provider
Cloudflare R2
Zero-egress S3-compatible storage for off-site encrypted backup snapshots
IAM AuthNeeds my account on the provider
Knowledge Vault
Local Obsidian repository holding architecture ADRs and technical runbooks
Local VaultA local vault on my laptop
[ 02 / Incident Triage & Observability ]
Telemetric tracebacks, GitOps delivery state, and on-call runbooks
Grafana Logs
Loki cluster log exploration, LogQL telemetry, and anomaly classifiers
Behind AutheliaLinked from Services on the Lab
Argo CD Sync
Declarative GitOps continuous delivery and spoke cluster drift healing
Own loginLinked from Services on the Lab
Status Overview
Live multi-burn-rate SLO monitoring and edge probe health status
Behind AutheliaLinked from Services on the Lab
SRE Runbooks
Operational playbooks for platform recovery, failover, and maintenance
[ 03 / Security & Perimeter Auditing ]
Automated secret scanners, TLS cipher suite testing, and perimeter audits
GitGuardian
Automated secrets detection and leak prevention across Git repositories
IAM AuthNeeds my account on the provider
SSL Labs
Qualys SSL Labs public A+ TLS rating and cipher configuration audit
PublicOpen resource (SSL Labs)
Headers mlorente
SecurityHeaders.com automated evaluation for the public mlorente.dev portal
Shodan Perimeter
External port visibility and attack surface verification for the production VPS
[ 04 / Core Platform Tooling ]
Identity, container image registries, code repositories, and AI token tracking
Cloudflare One
Zero Trust Network Access policies, edge DNS filtering, and warp tunnels
IAM AuthNeeds my account on the provider
GitHub kubelab
Infrastructure as Code repository containing all Kubernetes and Ansible assets
Docker Hub
Container image repository hosting immutable multi-arch build artifacts
Claude Usage
Inference token consumption analytics and engineering spend tracking
IAM AuthNeeds my account on the provider
[ 05 / Upstream Dependencies Status ]
Operational health of third-party cloud backbones and foundation model APIs
GitHub Status
Operational availability of GitHub VCS, webhooks, and CI runners
Cloudflare Status
Real-time health of global Anycast DNS, CDN, and Zero Trust tunnels
Claude Status
Inference API latency, error rates, and platform incident reports
[ 06 / Architecture Reference Docs ]
Official technical references for core components deployed in the platform
Kubernetes
Core container scheduling, networking, and declarative API primitives
K3s
Lightweight CNCF-conformant Kubernetes distribution and edge configuration
PublicOpen resource (K3s)
Traefik
Dynamic HTTP/TCP reverse proxy routing and automatic ACME TLS issuance
PublicOpen resource (Traefik)
Argo CD
GitOps operator pattern and multi-cluster application controller guides
PublicOpen resource (Argo CD)
Authelia
Forward authentication middleware and single sign-on access policies
PublicOpen resource (Authelia)
Headscale
Self-hosted coordination server for encrypted WireGuard mesh networks