# pierreh2/homelab architecture

> Architecture diagram of the GitHub repository pierreh2/homelab, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/pierreh2/homelab
- Repository: https://github.com/pierreh2/homelab

## Overview

This repository describes a single-node K3S homelab managed through ArgoCD GitOps. An operator bootstraps ArgoCD, applies the central App-of-Apps configuration, and ArgoCD deploys applications in dependency-ordered sync waves. The runtime stack covers networking, TLS, identity, registry policy, observability, and user-facing services. Edges below reflect README statements only; source excerpts were unavailable, so implementation-level calls and finer data flows are not shown.

Main entry points: [`central-argocd/argocd`](https://github.com/pierreh2/homelab/tree/main/central-argocd/argocd) (ArgoCD), [`apps/authentik/application.yaml`](https://github.com/pierreh2/homelab/blob/main/apps/authentik/application.yaml) (Authentik), [`apps/envoy-gateway-system/application.yaml`](https://github.com/pierreh2/homelab/blob/main/apps/envoy-gateway-system/application.yaml) (Envoy Gateway), [`apps/prometheus/application.yaml`](https://github.com/pierreh2/homelab/blob/main/apps/prometheus/application.yaml) (Prometheus)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_gitops["GitOps Management"]
  node_argocd["ArgoCD"]
  node_appset["Central AppSet"]
  node_appconfig["ArgoCD Config<br/>[application.yaml]"]
  node_rollouts["Argo Rollouts<br/>[application.yaml]"]
end

subgraph group_platform["Cluster Platform"]
  node_envoy["Envoy Gateway<br/>[application.yaml]"]
  node_metallb["MetalLB<br/>[application.yaml]"]
  node_certmanager["cert-manager<br/>[application.yaml]"]
  node_k3s["K3S Cluster"]
end

subgraph group_security["Identity and Security"]
  node_authentik["Authentik<br/>[application.yaml]"]
  node_oauthproxy["OAuth2 Proxy<br/>[application.yaml]"]
  node_harbor["Harbor Registry<br/>[application.yaml]"]
  node_kyverno["Kyverno<br/>[application.yaml]"]
end

subgraph group_services["Applications and Observability"]
  node_prometheus[("Prometheus<br/>[application.yaml]")]
  node_grafana["Grafana<br/>[application.yaml]"]
  node_dashboard["Kubernetes Dashboard<br/>[application.yaml]"]
  node_httpserver["HTTP Server<br/>[application.yaml]"]
  node_plex["Plex<br/>[application.yaml]"]
end

node_operator(("Operator"))
node_internet(("Internet Users"))
node_nas[("NAS Storage")]

node_operator -->|"bootstraps"| node_argocd
node_operator -->|"applies"| node_appset
node_appset -->|"configures apps"| node_argocd
node_argocd -->|"deploys wave 0–1"| node_metallb
node_argocd -->|"deploys wave 0–1"| node_envoy
node_argocd -->|"deploys wave 2–3"| node_harbor
node_argocd -->|"deploys wave 2–3"| node_kyverno
node_argocd -->|"deploys wave 2–3"| node_certmanager
node_argocd -->|"deploys wave 4"| node_appconfig
node_argocd -->|"deploys wave 4"| node_rollouts
node_argocd -->|"deploys wave 9"| node_authentik
node_argocd -->|"deploys wave 10+"| node_oauthproxy
node_argocd -->|"deploys wave 10+"| node_prometheus
node_argocd -->|"deploys wave 10+"| node_grafana
node_argocd -->|"deploys wave 10+"| node_dashboard
node_argocd -->|"deploys wave 10+"| node_plex
node_envoy -->|"exposes apps"| node_internet
node_certmanager -->|"issues TLS"| node_envoy
node_authentik -->|"provides SSO"| node_grafana
node_authentik -->|"provides SSO"| node_argocd
node_oauthproxy -->|"secures exposure"| node_prometheus
node_kyverno -->|"enforces registry policy"| node_harbor
node_prometheus -->|"feeds metrics"| node_grafana
node_k3s -->|"stores persistent data"| node_nas

click node_argocd "https://github.com/pierreh2/homelab/tree/main/central-argocd/argocd"
click node_appset "https://github.com/pierreh2/homelab/blob/main/central-argocd/central-application.yaml"
click node_appconfig "https://github.com/pierreh2/homelab/blob/main/apps/argocd-config/application.yaml"
click node_rollouts "https://github.com/pierreh2/homelab/blob/main/apps/argo-rollout/application.yaml"
click node_envoy "https://github.com/pierreh2/homelab/blob/main/apps/envoy-gateway-system/application.yaml"
click node_metallb "https://github.com/pierreh2/homelab/blob/main/apps/metallb/application.yaml"
click node_certmanager "https://github.com/pierreh2/homelab/blob/main/apps/cert-manager/application.yaml"
click node_authentik "https://github.com/pierreh2/homelab/blob/main/apps/authentik/application.yaml"
click node_oauthproxy "https://github.com/pierreh2/homelab/blob/main/apps/oauth2-proxy/application.yaml"
click node_harbor "https://github.com/pierreh2/homelab/blob/main/apps/harbor/application.yaml"
click node_kyverno "https://github.com/pierreh2/homelab/blob/main/apps/kyverno/application.yaml"
click node_prometheus "https://github.com/pierreh2/homelab/blob/main/apps/prometheus/application.yaml"
click node_grafana "https://github.com/pierreh2/homelab/blob/main/apps/grafana/application.yaml"
click node_dashboard "https://github.com/pierreh2/homelab/blob/main/apps/k8s-dashboard/application.yaml"
click node_httpserver "https://github.com/pierreh2/homelab/blob/main/apps/http-server/application.yaml"
click node_plex "https://github.com/pierreh2/homelab/blob/main/apps/plex/application.yaml"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_argocd,node_appset,node_appconfig,node_rollouts,node_internet toneBlue
class node_envoy,node_metallb,node_certmanager,node_k3s,node_nas toneAmber
class node_authentik,node_oauthproxy,node_harbor,node_kyverno toneMint
class node_prometheus,node_grafana,node_dashboard,node_httpserver,node_plex toneRose
class node_operator toneIndigo
```

## Components

### GitOps Management

- [ArgoCD](https://github.com/pierreh2/homelab/tree/main/central-argocd/argocd): `central-argocd/argocd`
- [Central AppSet](https://github.com/pierreh2/homelab/blob/main/central-argocd/central-application.yaml): `central-argocd/central-application.yaml`
- [ArgoCD Config](https://github.com/pierreh2/homelab/blob/main/apps/argocd-config/application.yaml): `apps/argocd-config/application.yaml`
- [Argo Rollouts](https://github.com/pierreh2/homelab/blob/main/apps/argo-rollout/application.yaml): `apps/argo-rollout/application.yaml`

### Cluster Platform

- [Envoy Gateway](https://github.com/pierreh2/homelab/blob/main/apps/envoy-gateway-system/application.yaml): `apps/envoy-gateway-system/application.yaml`
- [MetalLB](https://github.com/pierreh2/homelab/blob/main/apps/metallb/application.yaml): `apps/metallb/application.yaml`
- [cert-manager](https://github.com/pierreh2/homelab/blob/main/apps/cert-manager/application.yaml): `apps/cert-manager/application.yaml`
- **K3S Cluster**

### Identity and Security

- [Authentik](https://github.com/pierreh2/homelab/blob/main/apps/authentik/application.yaml): `apps/authentik/application.yaml`
- [OAuth2 Proxy](https://github.com/pierreh2/homelab/blob/main/apps/oauth2-proxy/application.yaml): `apps/oauth2-proxy/application.yaml`
- [Harbor Registry](https://github.com/pierreh2/homelab/blob/main/apps/harbor/application.yaml): `apps/harbor/application.yaml`
- [Kyverno](https://github.com/pierreh2/homelab/blob/main/apps/kyverno/application.yaml): `apps/kyverno/application.yaml`

### Applications and Observability

- [Prometheus](https://github.com/pierreh2/homelab/blob/main/apps/prometheus/application.yaml): `apps/prometheus/application.yaml`
- [Grafana](https://github.com/pierreh2/homelab/blob/main/apps/grafana/application.yaml): `apps/grafana/application.yaml`
- [Kubernetes Dashboard](https://github.com/pierreh2/homelab/blob/main/apps/k8s-dashboard/application.yaml): `apps/k8s-dashboard/application.yaml`
- [HTTP Server](https://github.com/pierreh2/homelab/blob/main/apps/http-server/application.yaml): `apps/http-server/application.yaml`
- [Plex](https://github.com/pierreh2/homelab/blob/main/apps/plex/application.yaml): `apps/plex/application.yaml`

### Other components

- **Operator**
- **Internet Users**
- **NAS Storage**

## Connections

- Operator → ArgoCD: bootstraps (evidence: `README.md`)
- Operator → Central AppSet: applies (evidence: `README.md`)
- Central AppSet → ArgoCD: configures apps (evidence: `README.md`)
- ArgoCD → MetalLB: deploys wave 0–1 (evidence: `README.md`)
- ArgoCD → Envoy Gateway: deploys wave 0–1 (evidence: `README.md`)
- ArgoCD → Harbor Registry: deploys wave 2–3 (evidence: `README.md`)
- ArgoCD → Kyverno: deploys wave 2–3 (evidence: `README.md`)
- ArgoCD → cert-manager: deploys wave 2–3 (evidence: `README.md`)
- ArgoCD → ArgoCD Config: deploys wave 4 (evidence: `README.md`)
- ArgoCD → Argo Rollouts: deploys wave 4 (evidence: `README.md`)
- ArgoCD → Authentik: deploys wave 9 (evidence: `README.md`)
- ArgoCD → OAuth2 Proxy: deploys wave 10+ (evidence: `README.md`)
- ArgoCD → Prometheus: deploys wave 10+ (evidence: `README.md`)
- ArgoCD → Grafana: deploys wave 10+ (evidence: `README.md`)
- ArgoCD → Kubernetes Dashboard: deploys wave 10+ (evidence: `README.md`)
- ArgoCD → Plex: deploys wave 10+ (evidence: `README.md`)
- Envoy Gateway → Internet Users: exposes apps (evidence: `README.md`)
- cert-manager → Envoy Gateway: issues TLS (evidence: `README.md`)
- Authentik → Grafana: provides SSO (evidence: `README.md`)
- Authentik → ArgoCD: provides SSO (evidence: `README.md`)
- OAuth2 Proxy → Prometheus: secures exposure (evidence: `README.md`)
- Kyverno → Harbor Registry: enforces registry policy (evidence: `README.md`)
- Prometheus → Grafana: feeds metrics (evidence: `README.md`)
- K3S Cluster → NAS Storage: stores persistent data (evidence: `README.md`)