A HomeLab that have Enterprise Level AIOps

flowchart LR
    IDEA["An app I want to try"] --> TRIAL["Runs on the\nsecondary cluster"]
    TRIAL --> DECIDE{"Actually\nuseful?"}
    DECIDE -->|"yes"| PROMOTE["Promoted to\nprimary — kakabu"]
    DECIDE -->|"no"| REMOVE["Removed —\nno ceremony"]

    classDef gate fill:#4986e8,stroke:#4986e8,color:#fff
    class DECIDE gate
      

flowchart LR
    B["Browser"] --> DNS["Pi-hole\nresolve"]
    DNS --> TR["Traefik\nroute"]
    TR --> CM["cert-manager\nencrypt (local CA)"]
    CM --> AUTH{"Keycloak /\noauth2-proxy\nauthenticate"}
    AUTH --> POD["The app\nsecrets already synced\nfrom Infisical"]

    classDef self fill:#0d9488,stroke:#0d9488,color:#fff
    class DNS,TR,CM,AUTH,POD self
      

flowchart LR
    M2["Fast tier\n2x 2TB M.2 NVMe"] --> WORK["Proxmox itself, every VM/LXC,\nall running workloads"]
    TANK["Bulk tier — 'the tank'\n~20TB, mirrored across 2 drives"] --> INT["Internal backup\non-site copy"]
    TANK --> EXT["External HDD\nrotated, kept off the box"]

    classDef self fill:#0d9488,stroke:#0d9488,color:#fff
    class M2,WORK,TANK,INT,EXT self
      

flowchart TD
    RISK1["A drive dies"] --> L1["ZFS mirror\n2x every drive"]
    RISK2["I break a VM,\ncontainer, or pod"] --> L2["Proxmox Backup Server\ndaily, several restore points"]
    RISK3["A file gets lost\nor corrupted"] --> L3["Separate file-level backup"]
    RISK4["The whole box\nis gone"] --> L4["External drive backups\noff the box entirely"]
    L1 --> OK["Data survives"]
    L2 --> OK
    L3 --> OK
    L4 --> OK

    classDef self fill:#0d9488,stroke:#0d9488,color:#fff
    classDef good fill:#4986e8,stroke:#4986e8,color:#fff
    class L1,L2,L3,L4 self
    class OK good
      

flowchart LR
    APP["An app / agent\nneeds a model"] --> GW["LLM gateway\n(in the primary cluster)"]
    GW --> T1["Tier 1 — GPU VM\nfast Nvidia GPU, always-on\nprod-level speed & reliability"]
    GW --> T2["Tier 2 — laptop (M5)\nslower, on-demand\nup to ~50B models\nresearch & testing"]
    GW --> T3["Tier 3 — cloud\nGemini / DeepSeek / OpenRouter\ngood, genuine overflow"]

    classDef local fill:#0d9488,stroke:#0d9488,color:#fff
    classDef cloud fill:transparent,stroke:#d45b28,color:#d45b28,stroke-width:2px
    class T1,T2 local
    class T3 cloud
      

flowchart TD
    NC["Nextcloud\nmy own file system"] -->|"WebDAV scan"| SCAN["Reads every file"]
    MAIL["Email\nread daily by an agent"] --> SCAN2["Reads every message"]
    SCAN --> SUM["Summarizes it"]
    SCAN2 --> SUM
    SUM --> FACTS["Extracts facts"]
    FACTS --> REL["Builds relations\nbetween files & messages"]
    REL --> ENT["Creates entities,\nbuilds profiles"]
    ENT --> CHUNK["Chunks it —\nsemantic, LLM-powered"]
    CHUNK --> STORE["Context Engine store"]
    STORE -.-> INJECT["Injected into a model call,\nonly when it's actually needed"]

    classDef self fill:#0d9488,stroke:#0d9488,color:#fff
    class NC,MAIL,SCAN,SCAN2,SUM,FACTS,REL,ENT,CHUNK,STORE,INJECT self
      

flowchart TD
    ROOT["Root Application\nwatches the control-plane branch"] --> SPAWN["One Application per file\nin the bootstrap folder"]
    SPAWN --> A1["prod apps\ntargetRevision: prod branch"]
    SPAWN --> A2["dev apps\ntargetRevision: dev branch"]
    SPAWN --> A3["system components\ntargetRevision: control-plane branch"]
    A1 --> DIFF["Continuously diffs\nlive cluster vs git"]
    A2 --> DIFF
    A3 --> DIFF
    DIFF -->|"match"| OK["Synced / Healthy"]
    DIFF -->|"drift — a manual kubectl edit?"| REVERT["Reverted automatically"]

    classDef good fill:#0d9488,stroke:#0d9488,color:#fff
    classDef fix fill:#d45b28,stroke:#d45b28,color:#fff
    class OK good
    class REVERT fix
      

flowchart TD
    GARDEN["Garden Tracker\n+ its own MCP wrapper"] --> DASH["Dashboard\none UI, on purpose"]
    TASKS["Task Manager\n+ its own MCP wrapper"] --> DASH
    CAL["Calendar / Contacts / Checkups\n+ its own MCP wrapper"] --> DASH
    DASH --> ME["Me"]
    EDU["Education app\nits own accounts, its own UI"] --> ME
    SITE["Personal website\nits own thing entirely"] --> ME

    classDef dash fill:#4986e8,stroke:#4986e8,color:#fff
    classDef standalone fill:transparent,stroke:#8592a6,color:#8592a6,stroke-width:2px
    class DASH dash
    class EDU,SITE standalone
      

flowchart TD
    H["Hermes\nassistant agent"] --> BROAD["Every MCP + memory —\nContext Engine, Hindsight,\nSearXNG, Kiwix, all of it"]
    U["Unsloth\nmy chat UI"] --> BROAD
    OC["OpenCode\nisolated sandbox —\ncodes apps, ships features"] --> CODESCOPE["Personal Skills +\ncoding-only MCPs —\nno Context Engine, no infra access"]
    PROV["Provisioner\na small team of agents"] --> PROVSCOPE["Provisions what an app needs:\nDB, Redis, auth, and a client\nin Keycloak, Langfuse, Infisical"]
    INFRA["InfraTools\na small team of agents"] --> INFRASCOPE["k3s only: check pods,\ncreate apps, bump tags,\ncluster operations"]

    classDef broad fill:#4986e8,stroke:#4986e8,color:#fff
    classDef scoped fill:#0d9488,stroke:#0d9488,color:#fff
    class H,U,BROAD broad
    class OC,CODESCOPE,PROV,PROVSCOPE,INFRA,INFRASCOPE scoped
      

flowchart TD
    PROVJOB["Provisioner\ncoordinator"] --> INF["Infisical worker"]
    PROVJOB --> GITW["git worker"]
    PROVJOB --> KCW["Keycloak worker"]
    PROVJOB --> DBW["database + client workers\nLangfuse, others"]
    INF --> UI1["Provisioner UI —\nlogs, status, full history"]
    GITW --> UI1
    KCW --> UI1
    DBW --> UI1

    INFRAJOB["InfraTools\ncoordinator"] --> LOGSW["get logs"]
    INFRAJOB --> STATUSW["check pod status"]
    INFRAJOB --> TAGSW["bump image tags"]
    INFRAJOB --> REPLW["add replicas"]
    LOGSW --> UI2["InfraTools UI —\nlogs, status, full history"]
    STATUSW --> UI2
    TAGSW --> UI2
    REPLW --> UI2

    classDef self fill:#0d9488,stroke:#0d9488,color:#fff
    class PROVJOB,INF,GITW,KCW,DBW,UI1,INFRAJOB,LOGSW,STATUSW,TAGSW,REPLW,UI2 self
      

flowchart TD
    READY["Ready to deploy\n(from Fig. H or Fig. F)"] --> PKG{"Already\npackaged?"}
    PKG -->|"no"| BUILD["Builds + pushes\na container image"]
    PKG -->|"yes"| SECRETS["Pushes secrets\nto Infisical"]
    BUILD --> SECRETS
    SECRETS --> DNS["Creates the internal\nDNS record"]
    DNS --> CERT["Requests a TLS cert\ncert-manager, local CA"]
    CERT --> TRAEFIK["Wires the ingress\nTraefik"]
    TRAEFIK --> SSO["Hooks up Keycloak SSO\ncreates a group if needed"]
    SSO --> PUSH["git push\nthe only door in"]
    PUSH --> GATE{"My\nsign-off"}
    GATE -->|"approved"| SYNC["ArgoCD syncs\n~3 min"]
    SYNC --> LIVE["Live.\nHands me the URL."]
    LIVE -.-> PUBLIC["Want it public too?\nThat's manual, on purpose\nCloudflare + my proxy, by hand"]

    classDef gate fill:#d45b28,stroke:#d45b28,color:#fff
    classDef manual fill:transparent,stroke:#d45b28,color:#d45b28,stroke-width:2px
    class GATE gate
    class PUBLIC manual