Skip to content

lfsc.dev

lfsc.dev

A single-node homelab running authoritative DNS and Kubernetes, provisioned entirely as code.

This page is static, informational documentation of a homelab — not a live dashboard or monitoring tool. The lab it describes runs on a private LAN and is never exposed to the public internet; nothing here reflects real-time state.

Configured
3
Planned
3

Current stack

Software running in the lab today, provisioned and tracked as code.

Ansible

Provisioning

Configured

Declarative provisioning for the whole lab, run from a single playbook.

  • The entire lab is provisioned declaratively through one playbook (provision.yml).
  • Ansible itself runs from a project-local Python virtual environment managed by uv, auto-activated on cd via direnv.
  • Secrets (such as the k3s cluster token) are encrypted at rest with ansible-vault and never stored in plaintext.
  • Upstream Ansible collections are pinned to exact versions to keep provisioning reproducible.

BIND9

DNS

Configured

Authoritative DNS for lfsc.dev on the local network.

  • Runs on node1 as ns1.lfsc.dev, installed and configured by a custom Ansible role.
  • Forward zone serves A records for ns1, server, and proxy, plus an apex record for lfsc.dev itself and a wildcard (*.lfsc.dev) — both pointing at 192.0.2.10, so any hostname under the domain resolves on the LAN.
  • A matching reverse zone (2.0.192.in-addr.arpa) provides a PTR record for server.
  • Non-authoritative queries are forwarded upstream to 1.1.1.1 and 8.8.8.8.
  • Queries are restricted to an ACL of localhost, local subnets, and the trusted 192.0.2.0/24 network.
  • Zone serials bump automatically, and only when zone content actually changes.

k3s v1.31.12+k3s1

Orchestration

Configured

Single-node Kubernetes cluster for running in-lab workloads.

  • node1 serves as both the k3s server and its own agent, forming a single-node cluster.
  • Provisioned via the upstream k3s-io/k3s-ansible collection (k3s.orchestration.site), pinned at 1.1.1.
  • The cluster join token is stored vault-encrypted alongside the rest of the provisioning config.

Network & split-horizon DNS

node1.lfsc.dev (192.0.2.10) is the only physical node in the lab, sitting on the 192.0.2.0/24 LAN, where it runs authoritative DNS, k3s server, k3s agent all at once.

lfsc.dev uses split-horizon DNS: the same domain resolves differently depending on which side of the network you ask from. Internal hostnames like server.lfsc.dev and proxy.lfsc.dev are only ever answered by the LAN resolver and never leave the network. Nothing in the lab is exposed publicly; the public zone only serves this page.

In short: ask for lfsc.dev from inside the LAN and BIND9 on node1.lfsc.dev answers with internal addresses. Ask from anywhere else — including the browser that loaded this very page — and Cloudflare answers instead, serving this static site from Cloudflare Pages. The two zones never talk to each other, and nothing running in the lab is reachable from outside it.

Split-horizon network diagram for lfsc.dev Two disconnected paths to lfsc.dev. On the left, the 192.0.2.0/24 LAN contains a single node, node1.lfsc.dev at 192.0.2.10, running internal DNS and a k3s cluster; only devices on that LAN can reach it. On the right, a browser on the public internet queries Cloudflare, which answers with the address of this static site served from Cloudflare Pages. A dashed barrier between the two sides shows there is no network path between them. LAN — 192.0.2.0/24 node1.lfsc.dev 192.0.2.10 Internal DNS (BIND9) k3s cluster Answers lfsc.dev only for devices on this LAN no route Internet Cloudflare Authoritative DNS + Pages serves this site
The LAN and the public internet resolve lfsc.dev independently — there is no path between them.

Internal view (LAN only)

Server: ns1.lfsc.dev (BIND9 on node1.lfsc.dev). Authoritative for lfsc.dev inside the LAN. Reachable from localhost, local subnets, and the trusted 192.0.2.0/24 network.

Internal DNS records for lfsc.dev
Name Type Value
ns1.lfsc.dev A 192.0.2.10
server.lfsc.dev A 192.0.2.10
proxy.lfsc.dev A 192.0.2.10
lfsc.dev A 192.0.2.10
*.lfsc.dev A 192.0.2.10
10.2.0.192.in-addr.arpa PTR server.lfsc.dev
lfsc.dev NS ns1.lfsc.dev

Public view (internet)

Public DNS authority for lfsc.dev
Server Description
Cloudflare Authoritative for lfsc.dev on the public internet, and what serves this page from Cloudflare Pages.

Roadmap

Planned additions to the stack, and why each one is coming next.

Traefik

Ingress

Planned

Ingress controller and reverse proxy for the k3s cluster.

  • Will route traffic arriving at proxy.lfsc.dev to services running inside the cluster.

cert-manager

TLS

Planned

Automated TLS certificate issuance and renewal.

  • Will issue and renew certificates for services exposed through Traefik.

headscale

VPN

Planned

Self-hosted Tailscale control server for private mesh VPN access.

  • Will provide private mesh VPN access to the lab without exposing any service to the public internet.