Architecture

Three-continent Hybrid Cloud Infrastructure
Waco TX · Phoenix AZ · Amsterdam NL · 6 Zones · 3 Cloud Providers
CI/CD — live
Cloudflare — live
Terraform — live
K3s — live
Prometheus — live
n8n workflows — in progress
ArgoCD GitOps — live
01 Developer & Pipeline CI/CD · DevSecOps
source
GitHub Repo
hugo portfolio · homelab-iac tf
git push
security gates
GitHub Actions
parallel security · scan on every push
Gitleaks CodeQL
performance
Lighthouse CI
perf ≥ 90 · a11y ≥ 90
gates all pass
deploy
GitHub Pages
OIDC auth · no stored secrets
username.github.io
also triggers → Terraform plan on .tf changes via OIDC → AWS
↓
02 Edge Security & Global Delivery Cloudflare · DNS · ZT Tunnels
Public traffic — portfolio
DNS + CDN
Cloudflare Edge
prajwolbikramadhikari.com.np
proxied SSL DDoS
email security
DNS Records
DMARC p=reject · SPF -all · DKIM
TXT managed
Private access — homelab services
tunnel id
Zero Trust Tunnel
outbound-only
no open ports
exposed subdomains
7 Services
grafana · prometheus · n8n · adguard · homer · cadvisor · npm
auth protected
↓
03 Infrastructure Control Plane AWS · Terraform IaC · GitOps
IaC engine
Terraform
manages Cloudflare · DNS + OCI instances
plan on PR apply on merge
state storage
AWS S3
terraform-state · versioned encrypted
AES-256 us-east-1
state locking
S3 Locking
use_lockfile · S3-native · no DynamoDB needed
S3-native
access control
IAM + OIDC
GitHub Actions trust · no stored keys
$1 budget alert
↓
04 GitOps Application Delivery ghcr.io · ArgoCD · Persistent Storage
registry
GitHub Container Registry
multi-arch images · amd64 + arm64 via buildx
ghcr.io/nasdesps
GitOps engine
ArgoCD
watches gitops repo · auto-sync · self-heal · prune
Git = source of truth
stateful storage
local-path PVC
persistent volumes · data survives pod destruction
proven durable
workloads
status-page + Uptime Kuma
deployed entirely through Git · zero kubectl apply
2 apps managed
↓
05 Hybrid Compute & Storage K3s · Docker · Two Continents
🇺🇸
Waco, Texas On-premise · Debian laptop
K3s master
Docker services
Prometheus
scrapes node_exporter from all nodes
Grafana
cross-cloud dash · global latency
n8n
event automation · incident routing
AdGuard Home
local DNS · ad blocking
Homer
homelab dashboard · service overview
NPM
Nginx Proxy Mgr · reverse proxy
Loki + Promtail
centralized logs · auto-discovers containers
tunnel agent
cloudflared
outbound-only to CF ZT · exposes all 7 services
running
🇺🇸
Phoenix, Arizona Oracle Cloud Free Tier
K3s worker
OCI ARM Ampere A1
K3s worker
2 OCPU · 12GB RAM · 200GB storage · ARM
always free
node_exporter
scraped by Waco Prometheus
AdGuard Home
public DNS · redundant resolver
Ollama · DeepSeek-R1
local LLM inference · log triage tier-1
blackbox_exporter
external probes · portfolio · DNS · tunnels
mesh VPN
Tailscale
100.x.x.x stable IP · WireGuard under hood
Waco ↔ Phoenix
🇳🇱
Amsterdam, NL Insomnia 24/7 · monitoring vantage
no root
User-land processes (tmux)
Node exporter
bound to 127.0.0.1:9100 · user-land binary
Probe script
cron every 5min · latency → Pushgateway
connectivity
Reverse SSH tunnel
localhost:19100 on Waco = NL node exporter
metrics only
Connection fabric
Waco (master) ⟷ Phoenix (worker) Tailscale mesh VPN · WireGuard
Waco (homelab) ⟷ Amsterdam (NL) Reverse SSH tunnel · port 19100
All services → public internet Cloudflare ZT tunnel · outbound only
↓
06 Global Observability & Automation Prometheus · Grafana · Loki · ArgoCD · Discord
Distributed monitoring
scrape targets
3 geographic nodes
Waco · Phoenix · Amsterdam · via Tailscale + SSH
location labels
probes
Blackbox exporter
runs on Phoenix · probes portfolio, Grafana, AdGuard, DoT · TLS cert expiry
Pushgateway
logs
Loki + Promtail
all-container log aggregation · unified with metrics in Grafana
7-day retention
dashboards
Grafana
global latency panel · cross-cloud health
status widget
out-of-band watchdog
External Uptime Watchdog
Phoenix watches Waco · alerts if home goes offline · 2-fail threshold
live · alert-only
Event-driven automation (n8n)
trigger 1
GitHub webhook
workflow_run failure → Discord alert
deploy fail
trigger 2
Alertmanager
node down / critical → Discord + remediation
Discord routing
trigger 3
Health poll
Oracle + NL check · every 2 min
alert-only
output
Discord
rich embeds · severity routing
resolved alerts
Zone legend
Zone 1 — CI/CD pipeline
Zone 2 — Cloudflare edge
Zone 3 — AWS IaC control plane
Zone 4 — GitOps delivery
Zone 5 — Hybrid compute
Zone 6 — Observability + automation
CI/CD live
Cloudflare DNS + tunnels live
Terraform IaC — live
K3s cluster — live
Prometheus scraping — live
n8n workflows — in progress
ArgoCD GitOps — live