Physical hosts
8
Control planes
3
Layers owned
Iron → DNS
Managed service
None
The stackbottom up
Six layers, no rented ones.
Everything below runs on hardware in a flat in this city. Nothing here is a trial tenant, a free tier, or a managed control plane. Where a version is printed, that is the version in production — not the one the docs recommend.
06
Published
What the world sees
sidspanos.meThis site
CloudflareEdge · TLS · DNS
Cloudflare WorkersHero Hub
GitHub PagesJAMF TotalOps
05
Services
Containers with a job
WordPressSalient child theme
MariaDBPer-site instance
RedisObject cache
AdminerShared across sites
statusdOwn code · stdlib only
04
State & network
Deliberately off-cluster
NFSRWX · off-cluster by design
nfs-subdir-provisionerDefault StorageClass
UniFiDHCP stops at .127
Docker macvlan.192 – .255
Containerised DNSResolver, not the gateway
03
Cluster
Nodes are disposable
Talos Linuxv1.13.9 · no shell, no ssh
Kubernetesv1.36.3
flannelCNI
MetalLBv0.16.0 · L2 · /28 pool
API VIPFloats across 3 planes
02
Hosts
The compromise layer
Zorin OS 17Bare metal on all four
QEMU / KVMTalos runs as VMs
Docker EngineOn the Synology
Synology DSMWeb + storage host
01
Iron
Bought, not provisioned
4× Latitude 3440i3-1315U · 16GB · NVMe
Gigabit switchingReplaced a 100Mb unit
Wired onlyNo wireless in the path
krakenWindows · jump host
Operating it
daily drivers
Git BashExclusively
VS CodeEditor
nanoOn the boxes
ghAuthenticated CLI
paramikoFleet-wide scripting
Draw.ioClickable diagrams
Stream DeckCustom command buttons
OllamaLocal inference · no hosted API
Estate management
day job discipline
JAMF ProMDM · policy · scoping
Apple Business ManagerSource of truth
DEPZero-touch enrollment
VPPLicensing
MCPThis site, driven by an agent
Verifiednot assumed
Anyone can install it once.
A stack list is a shopping receipt until something is deliberately broken to see what happens. These four were.
01
The VIP actually fails over
A control plane was shut down, not drained, and the Kubernetes API VIP moved to a surviving node. Tested on the way in, not promised in a README.
02
RWX verified across nodes
The same volume mounted read-write from pods on different physical hosts at once. Storage sits off-cluster precisely so a node can be destroyed without ceremony.
03
The bottleneck was a switch
Cluster throughput was capped at 100Mb by an eight-port switch with one gigabit socket. Not a Kubernetes problem. Found by measuring, fixed by replacing.
04
Pinned after being burned
A releases/latest chart handed back :main container images. Every chart in the cluster now carries an explicit version, because that one did not.
Talos v1.13.9 · Kubernetes v1.36.3 · MetalLB v0.16.0
Built, broken, documented