K3s Home Lab Cluster Architecture

Proxmox VM | MetalLB Load Balancer | Traefik Ingress | TrueNAS NFS Storage | 27 Deployments Live

Internet *.joeberry.org domains | Cloudflare DNS + DDNS HTTPS :443 Traefik Ingress Controller Dedicated VIP: 192.168.1.251 Let's Encrypt TLS (tlsChallenge via TLS-ALPN-01) | HTTP-to-HTTPS Redirect | Security Headers Middleware MetalLB Layer 2 Load Balancer Shared VIP: 192.168.1.250 | IPAddressPool: metallbaddresspool | servicelb disabled (k3s --disable=servicelb) K3s Cluster (Proxmox VM) | API: 10.43.0.1:443 | Pods: 10.42.0.0/16 | Services: 10.43.0.0/16 Authentik Server + Worker :9000/:9443 Auth Provider (OAuth2) PostgreSQL pg 17.7 | :5432 | ClusterIP CronJob pgdump */5m HashiCorp Vault Secrets Manager | :8200 Secrets Backend Cloudflare DDNS DNS Auto-Update 195d uptime Media Management Stack Prowlarr Indexer Proxy :9696 Radarr Movie Manager :7878 Sonarr TV Manager :8989 Lidarr Music Manager :8686 Soularr Book Manager :5025 Unpackerr Auto-Unpack Post-Processing Media Servers + Download Jellyfin Media Server :8096 Feishin Music Web UI :9180 HiFi Audio Stream 155d uptime Dither Audio Dither :8085 ROMM ROM Manager :8885 MariaDB :3306 | ClusterIP VPN + Networking Gluetun #1 VPN Tunnel (1st) :8079 | NET_ADMIN cap Gluetun #2 VPN Tunnel (2nd) :5030/:5031/:50300 Omada Controller Network/WiFi Mgmt :8088/:8043/:8843 Web Apps + Remote Access Open WebUI LLM Chat Interface :3022 Guacamole Remote Desktop :8086 FileBrowser Web File Manager :8083 Nginx Picture Photo Upload/View :8084/:4444 Hytale Game Server :5520/UDP Monitoring Stack Prometheus Metrics Collector :9090 Grafana Dashboards :3000 PVE Exporter Proxmox Metrics :9221 Graphite Exporter Graphite Metrics :9109/:9108 External Service Proxies (Traefik routes to external VMs via EndpointSlice) Frigate NVR :5000 Home Assistant Smart Home :8123 Proxmox Hypervisor :8006 TrueNAS Storage :443 OPNsense Firewall :10443 TrueNAS NFS Persistent Volume 39Ti | ReadWriteMany | /mnt/zfs/nfs | PV: truenas + truenas2 | PVC: truenas-pvc + truenas-pvc2 SubPath mounts for: authentik, postgresql, backups, and all app data Longhorn (Helm Install) | Distributed Block Storage nvme storage layer for high IOPS DBs Proxmox VE Hypervisor K3s Server VM | TrueNAS VM (192.168.1.213) | Frigate VM (192.168.1.206) | Hytale VM (192.168.1.217) | OPNsense FW (192.168.1.1) Legend Web / Frontend Backend / App Database / Storage Security / Auth Infra / Cloud VPN / Network External Proxy Storage Mount Cluster Boundary Traffic Flow: Internet --HTTPS--> Traefik --route--> MetalLB VIP 192.168.1.250 --LB--> Pods Auth: Authentik (OAuth2/OIDC) protects all ingress routes | Vault holds secrets | pgdump CronJob every 5m Storage: TrueNAS NFS (39Ti RWX) via PV/PVC + Longhorn block storage | All app data on NFS subPaths External Proxies: Traefik routes to external VMs via EndpointSlice (skip-verify transport) - single public IP pattern Domains: *.joeberry.org | Cloudflare DNS + DDNS auto-update | Let's Encrypt TLS via TLS-ALPN-01 challenge

Media Stack (25 apps)

  • Prowlarr -> Radarr/Sonarr/Lidarr/Soularr pipeline
  • Jellyfin media server + Feishin web UI
  • HiFi audio streaming + Dither audio processing
  • ROMM ROM manager + Unpackerr auto-extract
  • Gluetun VPN tunnel (x2)

Security & Auth

  • Authentik 2026.2 - OAuth2/OIDC identity provider
  • HashiCorp Vault - secrets management
  • Traefik middleware: IP allowlist, security headers
  • Let's Encrypt TLS via TLS-ALPN-01 challenge
  • PostgreSQL 17.7 with pgdump CronJob every 5m

Infrastructure

  • K3s on Proxmox VE (servicelb disabled)
  • MetalLB L2 mode - shared VIP 192.168.1.250
  • Traefik ingress with Cloudflare DDNS
  • TrueNAS NFS 39Ti + Longhorn block storage
  • Omada controller for WiFi/network management

Monitoring

  • Prometheus metrics collection :9090
  • Grafana dashboards :3000
  • PVE exporter for Proxmox host metrics
  • Graphite exporter for legacy metrics
  • System upgrade controller for K3s updates

External Service Proxies

  • Proxmox hypervisor (192.168.1.79) via EndpointSlice
  • TrueNAS storage (192.168.1.213) via EndpointSlice
  • OPNsense firewall (192.168.1.1) via EndpointSlice
  • Frigate NVR (192.168.1.206) via EndpointSlice
  • Home Assistant smart home platform

Network Design

  • Single public IP - all traffic through Traefik
  • External services proxied via LoadBalancer + EndpointSlice
  • skip-verify transport for self-signed external certs
  • HTTP-to-HTTPS redirect middleware on all routes
  • IP allowlist (192.168.1.0/24) on admin endpoints

Joe Berry K3s Cluster Architecture | Generated from live kubectl data + GitHub configs | joeberry.org