Architecture

Three-continent Hybrid Cloud Infrastructure
Waco TX · Phoenix AZ · Amsterdam NL · 5 Zones · 3 Cloud Providers
CI/CD — live
Cloudflare — live
Terraform — in progress
K3s — planned
Prometheus — planned
n8n — planned
01 Developer & Pipeline CI/CD · DevSecOps
source
GitHub Repo
hugo portfolio · homelab-iac tf
git push
security gates
GitHub Actions
parallel security · scan on every push
Gitleaks CodeQL
performance
Lighthouse CI
perf ≥ 90 · a11y ≥ 90
gates all pass
deploy
GitHub Pages
OIDC auth · no stored secrets
username.github.io
also triggers → Terraform plan on .tf changes via OIDC → AWS
↓
02 Edge Security & Global Delivery Cloudflare · DNS · ZT Tunnels
Public traffic — portfolio
DNS + CDN
Cloudflare Edge
prajwolbikramadhikari.com.np
proxied SSL DDoS
email security
DNS Records
DMARC p=reject · SPF -all · DKIM
TXT managed
Private access — homelab services
tunnel id
Zero Trust Tunnel
outbound-only
no open ports
exposed subdomains
7 Services
grafana · prometheus · n8n · adguard · homer · cadvisor · npm
auth protected
↓
03 Infrastructure Control Plane AWS · Terraform IaC · GitOps
IaC engine
Terraform
manages Cloudflare · DNS + OCI instances
plan on PR apply on merge
state storage
AWS S3
terraform-state · versioned encrypted
AES-256 us-east-1
state locking
DynamoDB
terraform-state-lock · prevents conflicts
PAY_PER_REQUEST
access control
IAM + OIDC
GitHub Actions trust · no stored keys
$1 budget alert
↓
04 Hybrid Compute & Storage K3s · Docker · Three Continents
🇺🇸
Waco, Texas On-premise · Debian laptop
K3s master
Docker services
Prometheus
global aggregator · scrapes all 3 nodes
Grafana
cross-cloud dash · global latency
n8n
event automation · incident routing
AdGuard Home
local DNS · ad blocking
Homer
homelab dashboard · service overview
NPM
Nginx Proxy Mgr · reverse proxy
tunnel agent
cloudflared
outbound-only to CF ZT · exposes all 7 services
running
🇺🇸
Phoenix, Arizona Oracle Cloud Free Tier
K3s worker
OCI ARM Ampere A1
K3s worker
4 vCPU · 24GB RAM · 200GB storage · ARM
always free
Prometheus agent
node exporter · federated to Waco
AdGuard Home
public DNS · redundant resolver
mesh VPN
Tailscale
100.x.x.x stable IP · WireGuard under hood
Waco ↔ Phoenix
🇳🇱
Amsterdam, NL Insomnia 24/7 · shared shell
no root
User-land processes (tmux)
Node exporter
bound to 127.0.0.1:9100 · user-land binary
Probe script
cron every 5min · latency → Pushgateway
connectivity
Reverse SSH tunnel
localhost:19100 on Waco = NL node exporter
+ rsync backups
Connection fabric
Waco (master) ⟷ Phoenix (worker) Tailscale mesh VPN · WireGuard
Waco (homelab) ⟷ Amsterdam (NL) Reverse SSH tunnel · port 19100
Waco → NL → rsync backups SSH · K3s etcd + Terraform state
All services → public internet Cloudflare ZT tunnel · outbound only
↓
05 Global Observability & Automation Prometheus · Grafana · n8n · Discord
Federated monitoring
scrape targets
3 geographic nodes
Waco · Phoenix · Amsterdam · via Tailscale + SSH
location labels
probes
Blackbox exporter
portfolio uptime · NL latency via cron push
Pushgateway
dashboards
Grafana
global latency panel · cross-cloud health
public status widget
Event-driven automation (n8n)
trigger 1
GitHub webhook
workflow_run failure → Discord alert
deploy fail
trigger 2
Alertmanager
node down / critical → Discord + remediation
MTTA < 2min
trigger 3
Health poll
Oracle + NL check · every 2 min
auto-remediate
output
Discord
rich embeds · severity routing
resolved alerts
Zone legend
Zone 1 — CI/CD pipeline
Zone 2 — Cloudflare edge
Zone 3 — AWS IaC control plane
Zone 4 — Hybrid compute
Zone 5 — Observability + automation
CI/CD live
Cloudflare DNS + tunnels live
Terraform IaC — in progress
K3s cluster — planned
Prometheus federation — planned
n8n automation — planned