Homelab Applications¶
The applications the homelab cluster exists to run. The cluster itself — Flatcar, Kubeadm, Cilium, Rook-Ceph, ArgoCD and everything under them — is a separate repository with its own documentation; this site covers only what runs on top.
Applications¶
| Application | URL | Storage | Database | Authentication |
|---|---|---|---|---|
| Claude agents | <session>.ssh.wlkr.ch |
One PVC per session: $HOME, clone and login |
None | SSH public keys |
| Dependency-Track | sbom.k8s.wlkr.ch | A PVC for uploaded BOMs and mirrored feeds | CloudNativePG | Authentik OIDC |
| Extractor admin UI | extractor-admin.k8s.wlkr.ch | None | None | Authentik proxy |
| Flowscape | flowscape.k8s.wlkr.ch | None | None | Authentik proxy |
| Home Assistant | home.k8s.wlkr.ch | A PVC for /config |
CloudNativePG, for the recorder | Authentik proxy, in front of its own login |
| Knead Time | kneadtime.k8s.wlkr.ch | None | CloudNativePG | None; CORS admits kneadtime.pizza only |
| OpenCloud | cloud.infra.k8s.wlkr.ch | A PVC for the files, metadata and index | None | Authentik OIDC, web and native clients |
| Shot Timer bridge | shot.k8s.wlkr.ch | A PVC for SQLite and the installation key | CloudNativePG | The bridge's own bearer key |
| Umami | analytics.k8s.wlkr.ch | None | CloudNativePG | Authentik proxy, in front of its own login; the tracker paths are public |
| Wollbi Adventsfenster | advent.wollbi.ch | A PVC for uploads | CloudNativePG | Public; Authentik proxy on /admin only |
| Wollbi-Fescht | fest.wollbi.ch | A PVC for uploads | CloudNativePG | Public; Authentik proxy on /admin only |
How a directory becomes an application¶
The apps ApplicationSet in the platform repository watches this one and
generates an ArgoCD Application from every */application.yaml it finds.
Pushing a directory deploys an application; there is no list to register it in.
homelab (platform) homelab-apps (this repository)
Application argocd
└── ApplicationSet platform
└── Application workloads ──▶ ApplicationSet apps
└── one Application per directory
The platform names this repository in two places, the ApplicationSet's
repoURL and the apps project's sourceRepos, and never reads what is in
it. Nothing orders a workload after the platform it
uses: each Application syncs as soon as it exists and retries until the
Gateway, StorageClass or ClusterSecretStore it names is there — the
sync policy is the same one every
platform Application carries. Why the split exists is in
GitOps Strategy.
What they have in common¶
Every directory follows the same eight rules, each with one sentence of why: Conventions.
Authentication¶
Every application with a browser login goes through
Authentik, in the shape each one
supports. Dependency-Track and OpenCloud speak
OIDC, so they are real single sign-on. Home Assistant and
Umami ship no OIDC provider, so the Authentik outpost sits in
front of their own logins and browser users authenticate twice;
Flowscape and the Extractor admin UI
have no login, so the outpost is the only one. All use auth.k8s.wlkr.ch,
Authentik's only hostname; see
One hostname.
The three APIs without a browser session carry their own credential, the
exception in Conventions → rule 6.
Adding one¶
Read Conventions first; it is short. The step-by-step version is Adding a Workload in the platform documentation.