AI infrastructure · the platform and the system under audit

The K8s homelab

A 32-core Debian Trixie cluster on repurposed hardware, bootstrapped with kubeadm and Ansible. Currently running Kubernetes v1.31.14 with Flannel CNI and MetalLB.

  • 4 machines
  • 32 cores
  • 56 GB RAM
  • 2 TB NFS storage
  • 1 GPU · GTX 1070

How this lab grew

  1. Phase 1 Done

    Self-hosting

    The first real workload was a home media server (Jellyfin with GPU transcoding, Audiobookshelf). Running it taught me the basics: MetalLB, NGINX ingress, NFS storage on TrueNAS, persistent volumes.

    • Ingress
    • Storage
    • GPU

  2. Phase 2 Ongoing

    Operating it properly

    Ansible bootstrap for every node, Tailscale for access, and real failures written up as post-mortems: a crashed node, a silent kubelet, a read-only filesystem.

    Evidence

  3. Phase 3 Next

    AI platform & audit lab

    Local LLM and RAG on the GPU node, with monitoring and capacity notes. The same cluster becomes the system under audit: controls, evidence, and test reports mapped to OWASP Top 10 for LLM.

    • LLM
    • RAG
    • Audit

Architecture

The cluster as it stands after phase 1.
Homelab architecture: Tailscale and gateway entry, MetalLB and NGINX ingress, Flannel CNI, four nodes, TrueNAS NFS storage, and the media services (Jellyfin, Audiobookshelf)
Ingress, storage layers, and the media services that were its first workload.

Machines

Repurposed hardware, one role each.
Role Host Hardware Specs
Control plane · GPU k8s-cp-01 ASUS ROG G702V i7 · 16 GB RAM · GTX 1070
Worker · utility k8s-worker-01 Dell Latitude i5 · 8 GB RAM · 128 GB SSD
Worker · workhorse k8s-worker-02 ASUS Tower i7 · 16 GB RAM · 160 GB HDD
Storage · NFS server k8s-data-1 HP ProLiant Xeon · 16 GB ECC · 2 TB SSD · TrueNAS

Usage

Snapshot · October 2026

Cluster CPU24%

8 / 32 cores

GPU memory · GTX 107065%

5.2 / 8 GB

TrueNAS storage82%

1.64 / 2.0 TB

These figures were read by hand; they are not live. Live cluster and GPU metrics are the next step for this page.

Captain’s log

Changes and fixes, newest first.

  • Lid switch & Ansible fixes

    Configured systemd-logind to ignore the laptop lid switch. Updated the Ansible bootstrap playbook to handle this gracefully across nodes.

  • Tailscale routing migration

    Following a filesystem crash on k8s-worker-01, migrated the Tailscale subnet router to k8s-worker-02 to keep the cluster reachable.

Stack

Provisioning
kubeadm + Ansible
Runtime
containerd
Networking
Flannel CNI · MetalLB
Ingress
NGINX
Storage
NFS on TrueNAS
Remote access
Tailscale