The lab
The machines and the repository behind the posts. Nothing reaches these machines unless it went through a pull request first.
Five Proxmox nodes and a NAS
It used to be one box called yoda, with a few dozen containers managed by hand. Now Terraform describes the cluster, Ansible configures the hosts, and every application is a Compose file.
obifive
Plex, apps, WordPress
The node with the iGPU
obifour
Home Assistant, state backend
DNS, tunnel, CI runner
obithree
Monitoring, CI runner
The old Home Assistant box
obitwo
My lab server
Staging, game servers. Only on when I need it.
obisix
CI runner, DNS
yoda, wiped and rejoined
NAS
Storage, backups
Not a Proxmox node
How a change gets in
Plan on pull request, apply on merge. The Terraform plan is the real gate: I read it before I merge.
- Pull request
- Read-only checksTerraform plan as a comment, linting, rendered stacks, secret scanning
- I merge
- Fans out by pathterraform/** · ansible/** · apps/compose/**
- Proxmox cluster
Every nightDrift checksA GitHub issue opens on drift, closes when clean
What it runs on
- Cluster
- Proxmox, described in Terraform
- Hosts
- Configured by Ansible
- Apps
- One Compose file per stack
- Updates
- Renovate, every image pinned to an exact version
- Way in
- Cloudflare Tunnel, no open ports
- Help
- Claude Code proposes, I read and merge