Technology Stack

6 min read
Table of Contents

This page covers the complete technology landscape and tools that power my infrastructure and projects. Everything runs on a production-grade Kubernetes cluster, providing a solid foundation for experimentation and real-world deployments.

🗺️ How the K3s Cluster Works

The whole platform runs on K3s — a lightweight Kubernetes distribution — driven entirely by GitOps. Nothing is changed by hand: I describe the desired state in Git, and the cluster continuously reconciles itself to match. The diagram below traces that loop end to end.

flowchart TB
    Dev["git push"] --> Repo[("fako-cluster<br/>GitOps repo")]
    Repo ==>|"① Flux pulls and reconciles"| API

    subgraph CP["K3s Control Plane · Apple Silicon M1 Pro"]
        direction LR
        API["kube-apiserver"]
        ETCD[("embedded etcd<br/>desired state")]
        SCHED["scheduler"]
        CM["controller-manager"]
        API <--> ETCD
        SCHED -. watches .-> API
        CM -. watches .-> API
    end

    API ==>|"② schedules pods onto nodes"| Agents

    subgraph Agents["K3s Agent Nodes · kubelet + containerd"]
        direction LR
        Workers["x86 / ARM workers<br/>ThinkPad · mini-PCs"]
        GPU["GPU node · Ryzen 9 3900X<br/>RTX 5070 + RTX 3050<br/>NVIDIA device plugin"]
    end

    Internet([Internet]) --> CF["Cloudflare Tunnel + CDN"]
    CF ==>|"③ request path"| Traefik["Traefik Ingress"]
    Traefik ==> Agents

    AWS[("AWS Secrets Manager")] -. External Secrets .-> API
    NAS[("UGREEN NAS · 12TB")] -. NFS / SMB CSI .-> Agents

① Reconcile — FluxCD watches the Git repo and applies any change to the kube-apiserver, which persists the desired state in etcd. ② Schedule — the scheduler and controller-manager place the resulting pods onto the right agent nodes (GPU workloads land on the node with the NVIDIA device plugin). ③ Serve — inbound traffic flows from the internet through a Cloudflare Tunnel to Traefik, which routes it to the pods. Secrets are pulled from AWS Secrets Manager and storage is mounted from the NAS over CSI.

What’s running on top

flowchart LR
    subgraph AICore["AI/ML Platform"]
        Ollama[Ollama LLM]
        Voice["WhisperX · Piper · OpenWakeWord"]
        LF[Langfuse]
    end
    subgraph AppsG["Applications"]
        AIagents[AI Agent Platforms]
        Auto["Automation · n8n · Argo"]
        Web["Web & Content"]
    end
    subgraph DataG["Data Layer"]
        PG[(CloudNativePG HA)]
        Redis[(Redis)]
        PV[("Persistent Volumes<br/>NFS / SMB on UGREEN NAS")]
    end
    subgraph ObsG["Observability"]
        Prom[Prometheus] --- Graf[Grafana]
        Loki[Loki] --- Tempo[Tempo]
    end

    AppsG --> AICore
    AppsG --> DataG
    AICore --> DataG
    AICore -. model and data volumes .-> PV
    AppsG -. mounted volumes .-> PV
    ObsG -. scrapes .-> AppsG

🏗️ Core Infrastructure

Kubernetes Platform

  • K3s: Lightweight Kubernetes distribution
  • Multi-Node: 7 heterogeneous nodes spanning x86_64, ARM64, and Apple Silicon
  • GPU Support: Dual NVIDIA GPUs — RTX 5070 (12GB) + RTX 3050 (8GB) — for AI/ML workloads
  • GitOps: FluxCD for fully automated, declarative deployments
  • Storage: Dynamic persistent volumes backed by NAS, with automated backups

Infrastructure Services

Core Platform

  • Keycloak: Identity and access management (OIDC/SAML), PostgreSQL-backed
  • CloudNativePG: High-availability PostgreSQL cluster (3-node, streaming replication, auto-failover)
  • pgAdmin: Web-based PostgreSQL administration tool
  • Traefik: Built-in K3s ingress controller — load balancing and routing
  • Cert-Manager: Automated Let’s Encrypt TLS certificate management
  • NVIDIA GPU Operator: Device plugin, container toolkit, and Node Feature Discovery for GPU scheduling

Monitoring & Observability

  • Prometheus: Metrics collection and alerting (kube-prometheus-stack)
  • Grafana: Dashboards and data visualization
  • Loki: Log aggregation and querying
  • Tempo: OpenTelemetry-native distributed tracing backend
  • Grafana Alloy: OTEL collector routing metrics, logs, and traces
  • Blackbox & GPU Exporters: Endpoint probing and GPU metrics
  • Headlamp: Kubernetes cluster UI dashboard (with Kubescape plugin)

Security & Compliance

  • External Secrets Operator: Syncs secrets from AWS Secrets Manager
  • SOPS (Age): Encrypted bootstrap secrets committed to Git
  • OAuth2 Proxy: Authentication gateway for protected apps
  • Gitleaks: Automated secret scanning of Git repositories
  • Kubescape: Kubernetes security posture scanning
  • Kube-bench: CIS Kubernetes benchmark assessments

AI/ML Platform / LLM Infrastructure

  • Ollama: Local, GPU-accelerated LLM inference
  • Open-WebUI: Multi-user chat interface for local models
  • WhisperX: GPU speech-to-text with speaker diarization (plus a CPU-only Whisper for lighter workloads)
  • Piper: Natural text-to-speech synthesis
  • OpenWakeWord: Privacy-preserving wake word detection
  • Langfuse: Self-hosted LLM observability and tracing
  • Voice Pipeline: Wearable audio ingest → transcription → notes, orchestrated with Argo Workflows

MCP Servers — Model Context Protocol

A collection of MCP servers gives AI models structured access to real systems — Kubernetes resources, GitHub, PostgreSQL, weather, time, and more — fronted by an MCP gateway. This abstraction layer is crucial for building reliable AI agents that can act on live infrastructure.

Development & Productivity Tools

Automation & Workflows

  • n8n: Self-hosted workflow automation platform
  • Argo Workflows: DAG-based orchestration for audio and data pipelines
  • Renovate: Automated dependency and image updates across the GitOps repo

Knowledge & Content

  • Paperless-NGX: Document management with OCR
  • Hugo Blog: This documentation site you’re reading
  • Umami: Privacy-focused, self-hosted web analytics

Applications

Beyond infrastructure, the cluster hosts a range of personal applications — AI agent platforms, health and productivity tools, automation bots, and web properties — all deployed through the same GitOps workflow.

Supporting Services

Technical Infrastructure

  • Cloudflare Tunnels: Secure external access with no port forwarding
  • NFS & SMB CSI Drivers: Dynamic persistent volume provisioning from NAS
  • Scheduled Backups: Daily etcd snapshots and weekly resource backups via Kubernetes CronJobs

Automation & Agents

  • System Upgrade Controller: Automated K3s patching
  • Housekeeping: Scheduled cleanup of completed/failed pods
  • Backup Jobs: Automated routines for critical data

Technology Patterns

All services follow these common patterns:

Deployment

  • Kubernetes: Container orchestration for all workloads
  • GitOps: Infrastructure as code with FluxCD
  • Kustomize: Templating and configuration management

Security

  • External Secrets: AWS Secrets Manager integration
  • OAuth2/OIDC: Centralized authentication with Keycloak
  • RBAC: Role-based access control
  • Network Policies: Micro-segmentation for security

Observability

  • Prometheus Metrics: Standardized metrics collection
  • Grafana Dashboards: Visual monitoring
  • Structured Logging: Centralized aggregation with Loki
  • Distributed Tracing: Request flow analysis with Tempo + Alloy

Data Management

  • PostgreSQL: Primary database for stateful applications (HA via CloudNativePG)
  • Redis: Caching and session storage across multiple services
  • AWS S3: Object storage for backups and LLM observability data
  • Automated Backups: Regular snapshots of critical data

Hardware

Compute Nodes

  • Control Plane: Apple Silicon (M1 Pro)
  • Worker Nodes: Mix of x86_64 mini-PCs and laptops for general-purpose compute
  • GPU Node: Ryzen 9 3900X with dual NVIDIA GPUs (RTX 5070 + RTX 3050) for AI/ML

Storage

  • NVMe SSDs: Fast local storage for databases
  • NAS: UGREEN NAS (12TB RAID5) for shared storage and backups
  • Cloud Backup: Offsite backup to AWS S3

Networking

  • Cloudflare: CDN, DDoS protection, and zero-trust tunnels
  • Internal: Flat cluster network across heterogeneous nodes

GitOps Structure

Every change ships the same way — push to Git, and the cluster reconciles itself:

flowchart LR
    Push[git push] --> GH[GitHub]
    GH --> CI[GitHub Actions<br/>build multi-arch image]
    CI --> Hub[(DockerHub)]
    CI --> Bump[bump image SHA<br/>in fako-cluster]
    Bump --> Flux[FluxCD reconcile]
    Hub --> Flux
    Flux --> Rollout[K3s rollout]

The entire infrastructure is managed through Git:

fako-cluster/
├── clusters/         # Per-cluster Flux entrypoints
├── infrastructure/   # Controllers, configs, CRDs
├── monitoring/       # Prometheus, Grafana, Loki, Tempo
└── apps/
    ├── base/         # App definitions
    └── staging/      # Enabled overlays per environment

Future Stack Additions

Planned technology additions:

  • Vector Database: Qdrant or Milvus for RAG and AI applications
  • Service Mesh: mTLS and traffic policy (evaluating Linkerd)
  • Native CI/CD: Tekton or Argo CD for in-cluster pipelines
  • Expanded Tracing: Broader OTEL instrumentation across services

This stack represents years of iteration and learning, optimized for both stability and experimentation. It’s designed to be production-grade while remaining flexible enough for rapid prototyping and learning.