Infrastructure

Virtualization

Proxmox VE - Hypervisor
Multiple VMs and LXC containers
ZFS storage pools

Orchestration

Kubernetes - Container orchestration
Docker - Containerization
GitOps deployment workflow

PKI & Security

step-ca - Internal Certificate Authority
Automated certificate provisioning
mTLS for service communication

DNS

Technitium - DNS Server
Split-horizon DNS
Internal service discovery

Monitoring

Grafana - Visualization
Prometheus - Metrics
InfluxDB - Time-series data

Access & Auth

Authentik - Identity Provider
OIDC/SAML SSO
Caddy - Reverse proxy
FRP - Tunnel access

Architecture Notes

Everything runs on-premise. Services communicate over an internal network with mTLS. External access goes through authenticated reverse proxy. Monitoring covers infrastructure and application metrics.