A bare metal k0s cluster managed entirely through FluxCD — no cloud provider, no managed control plane. Nodes are bootstrapped with Ansible (including OpenWRT router configuration), secrets are managed with SOPS + age, and everything from DNS to identity to CI is declared in git.

OpenTofu manages external integrations: Authentik for SSO (OIDC, LDAP, enrollment flows, and policies), Headscale as a self-hosted Tailscale control plane, Cloudflare for DNS and tunnels, Forgejo and Woodpecker for self-hosted git and CI, Grafana for cluster observability, and Wasabi for object storage.

The service stack covers the full surface area of what I’d otherwise outsource:

• Observability: kube-prometheus-stack, Loki, Tempo, Alloy, and Gatus for uptime monitoring — the same Grafana stack I run professionally, on my own hardware
• Identity: Authentik handling SSO across every internal service via OIDC and LDAP
• Networking: Headscale mesh VPN and Guacamole for remote access
• Communications: self-hosted Matrix (Synapse) with mautrix bridges for Discord, Slack, WhatsApp, Signal, iMessage, and others — one inbox for everything
• Dev tooling: Forgejo, Woodpecker CI, and Zot as a private OCI registry
• Dependency hygiene: Renovate keeps Helm chart and image versions current automatically

Running bare metal forces a different understanding of the stack than managed cloud does. There’s no control plane SLA to hide behind when something breaks — storage, networking, and scheduling failures are yours to diagnose. That context is useful when cloud abstractions fail and you need to know what’s actually underneath them. It’s also where I test operator patterns and GitOps workflows before recommending them in production.