This organization contains a complete, production-grade infrastructure platform running on a single server in my home. Every layer — from VM image baking to application deployment — is defined as code, version-controlled, and automated through CI/CD pipelines.

It's not a toy setup. It runs 60+ self-hosted services across media streaming, home automation, document management, and operations tooling — all behind SSO, intrusion detection, automated TLS, and full observability. And it can be rebuilt from scratch, unattended, by merging a single PR.

The crown jewel of this project is the end-to-end automation pipeline — four repositories that chain together through GitHub Actions, each triggering the next:

How it works:

1. Packer builds a hardened Debian VM template on Proxmox with Intel GPU drivers, cloud-init, and modern networking — then pushes a manifest as a PR to the Terraform repo
2. Terraform clones that template into master and worker VMs with dual-NIC networking and GPU passthrough — then triggers Ansible via repository_dispatch
3. Ansible installs K3s with HA (Kube-VIP), pre-seeds secrets, restores TLS certificates from backup, and deploys ArgoCD with SSO — which immediately points at the Apps repo
4. ArgoCD takes over and reconciles the entire application layer through a 4-phase ordered deployment, pulling from the Apps repo as the single source of truth

The result: merge a Packer PR → a fully operational cluster with 60+ running services deploys itself, hands-free.

One machine. Three K3s nodes. 60+ services. Full HA. GPU-accelerated transcoding.

What makes this more than "just a homelab":

• 🔗 End-to-End Pipeline — Four repos chain together via GitHub Actions. A Packer build automatically triggers Terraform, which triggers Ansible, which bootstraps ArgoCD. Zero manual steps from image to running cluster.

• 🔄 Infrastructure Drift Detection — Daily Terraform plans detect and report configuration drift via GitHub Issues, auto-closing when resolved.

• 🔒 Cross-Repo Driver Synchronization — The Packer CI blocks PR merge if the VM's GPU driver version exceeds the Proxmox host's, preventing boot failures. Renovate coordinates version bumps across repos.

• 📐 4-Phase Ordered Deployment — ArgoCD's RollingSync deploys CRDs → Foundation → Controllers → Services in strict order, ensuring clean bootstrap from an empty cluster.

• 🧬 Value Cascade Architecture — A single globals.yaml propagates cluster-wide config (domains, IPs, storage) to 60+ services. Changing one value updates everything on the next sync.

• 🎭 Base/Variant Inheritance — Multi-language service variants inherit 95% of their config from a base service, overriding only what differs in a 3-5 line YAML delta.

• 🔐 Day-Zero Secrets — Sealed Secrets keypair is pre-seeded by Ansible before ArgoCD deploys, enabling encrypted secrets in Git from the first sync — no chicken-and-egg problem.

• 📡 Full Observability Stack — Prometheus metrics, Loki logs, Tempo traces, Grafana dashboards, and AlertManager → ntfy push notifications — all deployed via GitOps.

• 🎮 GPU Virtualization — Intel iGPU SR-IOV exposes 7 virtual functions, shared across workers for hardware-accelerated video transcoding and ML inference.

• 🤖 18 CI/CD Workflows — Across all repos: automated builds, plan-on-PR, drift detection, manifest validation, ArgoCD diff previews, ISO version tracking, driver sync checks, scoped refresh, and weekly image vulnerability scanning.

18 GitHub Actions workflows across all repositories:

Every PR gets validated. Every merge triggers the right downstream action. No manual deployment steps exist.