Everything you need at a glance: URLs, IPs, SSH, common commands.
Note: Dev Workspace (Mat/Aja) is archived. The dev-workspace namespace is not currently deployed. See /services/dev-workspace for details.
All routes marked Authentik SSO require Google account sign-in via Authentik.
Direct SSH to nodes:
Or use ssh_config from the repo root: ssh -F ssh_config k3s-server-1
| Node / Device | IP | Notes |
|---|---|---|
| k3s-server-1 | 192.168.20.20 | Control plane + wg1 WireGuard hub (UDP 51821) |
| k3s-server-2 | 192.168.20.21 | Control plane |
| k3s-server-3 | 192.168.20.22 | Control plane |
| k3s-agent-1 | 192.168.20.30 | Worker |
| k3s-agent-2 | 192.168.20.31 | Worker (HA node-pinned) |
| k3s-agent-3 | 192.168.20.32 | Worker |
| k3s-agent-4 | 192.168.20.33 | Worker (GPU / VFIO passthrough) |
| pve1 | 192.168.1.105 | Proxmox host (ThinkCentre M920q) |
| pve2 | 192.168.1.106 | Proxmox host |
| pve3 | 192.168.1.107 | Proxmox host |
| pve4 | 192.168.1.108 | Proxmox host |
| NAS | 192.168.30.10 | Ugreen DXP4800 (Storage VLAN 30) |
| Kasa HS300 | 192.168.1.205 | Smart power strip (controls pve1-4) |
| Ollama Host | 192.168.1.214 | LAN inference server (Ollama :11434, node-exporter :9100) |
| Traefik LB | 192.168.20.200 | Ingress LoadBalancer |
| HA LB | 192.168.20.202 | Home Assistant LoadBalancer |
| MQTT LB | 192.168.20.203 | Mosquitto (Digital Signage Pi fleet) |
Cluster health:
kubectl get nodes -o wide
kubectl get pods -A | grep -v Running | grep -v Completed
kubectl top nodes
kubectl top pods -A --sort-by=memory | head -20
kubectl get volumes.longhorn.io -n longhorn-system
Restart a deployment:
kubectl rollout restart deployment/<name> -n <namespace>
kubectl rollout status deployment/<name> -n <namespace> --timeout=300s
Tail logs:
kubectl logs -n <namespace> deploy/<name> --tail=50 -f
Check recent events:
kubectl get events -A --sort-by='.lastTimestamp' | tail -20
Drain/uncordon a node:
kubectl drain k3s-agent-1 --ignore-daemonsets --delete-emptydir-data
kubectl uncordon k3s-agent-1
Check Velero backup status:
kubectl get backups -n velero
kubectl describe backup <backup-name> -n velero
cd terraform/environments/homelab-prod
terraform plan
terraform apply
cd terraform/environments/aws
terraform plan
terraform apply
# Google Cloud (OAuth apps + Authentik Google source)
# Requires: gcloud auth application-default login
# Requires: TF_VAR_authentik_token, TF_VAR_authentik_google_client_id, TF_VAR_authentik_google_client_secret
cd terraform/environments/google
terraform plan
terraform apply
# Unlock stuck state (check for .tflock in S3 first)
terraform force-unlock <lock-id>
cd ansible
source .env
# Full site
ansible-playbook -i inventory/homelab playbooks/site.yml
# Single node
ansible-playbook -i inventory/homelab playbooks/site.yml --limit k3s-agent-1
# Proxmox updates (rolling)
ansible-playbook -i inventory/homelab playbooks/proxmox-update.yml
gh workflow run promote-image.yml -f image=<image-name> -f tag=sha-<commit>
| What | S3 Path | Schedule |
|---|---|---|
| etcd snapshots | k3s-homelab-backups-855878721457/etcd-snapshots/ | 2:00 AM UTC daily |
| PostgreSQL dumps | k3s-homelab-backups-855878721457/postgres-backups/app/ | 3:00-4:00 AM UTC daily |
| openclaw-memory-db | zolty-homelab-backups/openclaw-memory/ | 3:00 AM UTC daily |
| Longhorn volumes | k3s-homelab-backups-855878721457/longhorn/ | 5:00 AM UTC daily |
| Velero k8s objects | k3s-homelab-backups-855878721457/velero-backups/ | Daily + Weekly + Monthly |
| Terraform state | k3s-homelab-tfstate-855878721457/ | On apply |
See Backup and Restoration Guide for the full list of protected vs unprotected databases.