Quick Show of Hands

• Who has a home lab?
• Who manages servers professionally?
• Who already uses IaC tools at home or work?

Quick Intro

• Senior Software Engineer at Jack Henry
• President of Springfield Devs
• Co-organizer of Open SGF

Why I Built This

• Springfield Devs runs on a tight budget
• Hosted SaaS free tiers changed and became limiting
• Open-source self-hosted tools reduced recurring cost
• I wanted a setup volunteers can maintain together

Single-Server Limitations

• Old desktop + Docker Compose worked short-term
• Too much implicit setup knowledge in one person
• Hard to delegate, audit, and recover consistently
• Goal: move the knowledge into code and git history

Goals

Turn implicit infrastructure knowledge into versioned, repeatable code.

• Provisioning is declarative
• Configuration is automated
• Changes are reviewable
• Ownership can be distributed

IaC Ladder

• Physical hardware + network layer
• Virtualization layer (Proxmox VMs)
• OS configuration layer (Ansible)
• Cluster layer (k3s/Kubernetes)
• Application layer (Kubernetes manifests)

Kubernetes as Destination

• Kubernetes is the target platform, not the main topic
• Once cluster exists, service deployment becomes portable
• Cloud move later is easier from this layer upward
• Hard part: reliably creating the cluster from physical infra

Terraform

• Provision infrastructure resources declaratively
• Replace manual dashboard clicks with code + apply
• Clear diffs, repeatable environments, safer change review
• Providers let one workflow span multiple platforms
• It creates infrastructure, but not full in-guest OS configuration

Ansible

• Handles operating system configuration after provisioning
• Agentless: connects over SSH, no daemon required on targets
• Playbooks define desired packages, files, services, and tasks
• Inventory defines what machines are targeted
  • Terraform integration can generate that inventory

Proxmox

• Runs on physical hosts and provides VM management
• Acts as homelab virtualization foundation
• Terraform provider manages VM lifecycle in code
• RBAC and resource pools enforce safer access boundaries

Networking Challenges

• Residential internet is not a managed data center edge
• Public exposure still requires reliability and security controls
• Need a stable public entrypoint plus private tunnel to home network
• Design for segmentation and least-privilege connectivity

MikroTik as Code

• RouterOS APIs allow automation of network configuration
• Terraform provider manages VLANs, subnets, and firewall rules
• Network changes become reviewable pull requests
• Rebuilds and updates are repeatable instead of one-off clicks

Public Edge Pattern

• Small VPS provides public ingress with stable public IP
• Traffic forwards across private tunnel to home workloads
• Home services remain private-by-default behind the edge

Tailscale + Headscale

• Tailscale provides mesh connectivity built on WireGuard
• Control plane coordinates peer connectivity
• Headscale gives a self-hosted coordination server option
• Used for ACL-driven segmentation

Automation Policy

End-to-End Flow

1. Merge infrastructure change
2. Terraform provisions or updates infrastructure
3. Ansible configures systems and bootstraps cluster software
4. Flux/Kubernetes applies app manifests
5. Service becomes reachable through edge ingress

Demo 🚀

Questions?