Declarative host
Nix flakes and Home Manager on Ubuntu — reproducible tooling and sysctl/journald.
Open source · portfolio-grade homelab
Forge Software Factory
homelab-forge turns a single powerful workstation into a declarative software forge: remote development, sandboxed agents, local Kubernetes, Vault-backed secrets, and a git-native factory pipeline — all public, all review-gated.
Components
Sandbox platform
Layered profiles (trusted → devcontainer → k8s-workload) isolate project work.
Local Kubernetes
k3s with Traefik Ingress, cert-manager, and NetworkPolicies on 80/443.
Secrets & GitOps
HashiCorp Vault + External Secrets; Argo CD syncs cluster state from main.
Agentic factory
Git-backed tasks, Slack plan gate, Cursor SDK workers, human review before merge.
Host IDS
In-tree host-watch monitors the NUC; alerts via ntfy without secrets in git.
How the factory works
- 1. Intake
Operator describes work in Slack. The orchestrator drafts a plan PR with task YAML.
- 2. Plan gate
Thread feedback refines the plan. Explicit approval moves the task to proposed.
- 3. Worker
A sandboxed worker claims the task, implements in a git worktree, and opens/updates the PR.
- 4. Review
Humans run the review checklist. No auto-merge for production-facing changes.
- 5. Deploy
Merge to main. Argo CD converges manifests — the only steady-state deploy path.