heezy¶
Self-hosted homelab running on Proxmox + MicroK8s. All services are containerized, all infra is code.
Services¶
Services marked LAN only require your machine to use 192.168.1.29 as DNS. See DNS Architecture.
| Service | URL | Access | Notes |
|---|---|---|---|
| Grafana | https://grafana.heezy.info | LAN only | Monitoring dashboards |
| Gitea | https://gitea.heezy.info | LAN only | Git + CI/CD |
| OpenBao | https://openbao.heezy.info | LAN only | Secrets — see access guide |
| heezy-finance | https://finance.heezy.info | Public | Spending analytics |
| Receipts | https://receipts.heezy.info | Public | Receipt OCR scanner |
| Statements | https://statements.heezy.info | Public | Statement file upload |
| Maintenance | https://maintenance.heezy.info | LAN only | Vehicle, equipment and home service history — see service page |
| Projects | https://projects.heezy.info | LAN only | Project tracking and vendor quotes — see service page |
| CS1.6 Leaderboard | https://cs16.heezy.info | Public | Game stats |
| Aurral | https://aurral.heezy.info | LAN only | Music |
| Blog | https://heezy.blog | Public | Personal blog |
| Docs | https://docs.heezy.info | Public | This site |
| Overseerr | https://overseerr.trentnielsen.me | Public | Media requests |
| Navidrome | https://navidrome.trentnielsen.me | Public | Music streaming |
| Plex | https://plex.trentnielsen.me | Public | Media server |
| Sonarr | https://sonarr.trentnielsen.me | Public | TV management |
| Radarr | https://radarr.trentnielsen.me | Public | Movie management |
| SABnzbd | https://sabnzbd.trentnielsen.me | Public | Usenet downloader |
| Pi-hole | https://pihole.heezy.info | LAN only | DNS admin UI |
Not everything is a web service. Mailbot is three CronJobs with no UI, and the Statement Parser runs on a schedule behind the upload page.
Stack¶
- Hypervisor: Proxmox (192.168.1.144)
- K8s: MicroK8s 5-node HA cluster (nebula-1 through nebula-5, 192.168.1.15–19)
- Firewall: FortiGate (192.168.1.1)
- DNS: dnsmasq (192.168.1.29) — authoritative for heezy.local, heezy.info, trentnielsen.me, heezy.blog
- Ingress: SWAG reverse proxy at MetalLB VIP 192.168.1.25
- Secrets: OpenBao (KV v2, AppRole auth)
- CI/CD: Gitea act-runner (3 replicas, heezy-runner image, k8s gitea namespace)
- Monitoring: Grafana + Loki + Prometheus + Tempo on shared-lgtm (192.168.1.10)
- DB: Postgres (gitea namespace for Gitea; big-boi for heezy-finance and everything else)
- Storage: Longhorn (RWO, replicated), NFS via TrueNAS (RWX, media + shared data)
Repositories¶
| Repo | Purpose |
|---|---|
heezy-k8s |
K8s manifests — push to Gitea to deploy |
heezy-containers |
Dockerfiles + build/deploy pipelines |
ansible-heezy |
Host provisioning (all VMs + big-boi) |
terraform-heezy |
AWS + FortiGate + Proxmox infra |
heezy-docs |
This site |
All repos live on Gitea (https://gitea.heezy.info). GitHub is a read-only mirror — pushing to GitHub does not trigger deployments.