Frank, the Talos Cluster: Overview & Roadmap
This is the overview post for the Frank, the Talos Cluster series — a tutorial-style walkthrough of building an AI-hybrid Kubernetes homelab from scratch.
This post is a living document: it gets updated as new technologies and capabilities are added to the cluster.
Roadmap
1 Hardware — 7 Nodes, 3 Zones
3x Intel NUC (Core zone)
1x GPU tower — RTX 5070
1x Legacy desktop
2x Raspberry Pi 4
2 OS & Bootstrap
Talos Linux (immutable)
Sidero Omni (lifecycle)
Declarative machine config
Rolling upgrades
3 Networking — Cilium CNI
eBPF kube-proxy replacement
L2 LoadBalancer (ARP)
Hubble observability
Network policy
4 Storage — Longhorn
Distributed 3-replica block storage
GPU-local StorageClass
2x 4TB SSD on gpu-1
iSCSI via Talos extensions
5 GPU Compute
NVIDIA GPU Operator (RTX 5070)
Intel DRA driver (Arc iGPU)
Dynamic Resource Allocation
CDI device injection
6 GitOps — ArgoCD
App-of-Apps pattern
Multi-source Applications
Self-healing + drift detection
Zero-downtime adoption
7 Fun Stuff
OpenRGB via USB HID
DaemonSet + ConfigMap
Custom container build (GitHub Actions)
IT5701 firmware lock (in progress)
8 Observability
VictoriaMetrics (metrics + alerts)
VictoriaLogs (log aggregation)
Grafana dashboards
Fluent Bit log shipping
Blackbox Exporter (endpoint probes)
Pushgateway (heartbeat ingestion)
Telegram alerting
Health Bridge (GitHub lifecycle)
Edge Observability (blog analytics, edge security, AI alerts)
9 Backup
Longhorn → Cloudflare R2
Daily + weekly recurring jobs
SOPS-encrypted credentials
NAS target (pending Longhorn 1.13)
10 Secrets Management
Infisical (self-hosted vault)
External Secrets Operator
ClusterSecretStore
ExternalSecret → K8s Secret
11 Local Inference
Ollama (gpu-1, RTX 5070)
LiteLLM (unified gateway)
OpenRouter (free cloud models)
OpenAI-compatible API
12 Agentic Control Plane
Sympozium (K8s-native agents)
n8n (per-user workflow automation)
VK Remote (self-hosted kanban API)
ElectricSQL real-time sync
13 Unified Auth
Authentik IdP (OIDC + proxy)
SSO for ArgoCD, Grafana, Infisical
Forward auth for Longhorn, Hubble, Sympozium
OIDC-backed kubectl via apiserver
14 Multi-tenancy
vCluster (K8s-in-K8s)
Disposable experiment clusters
Resource quotas + network policies
GitOps-provisioned via ArgoCD
15 AI Agent Orchestrator
Paperclip (org-chart agents)
Virtual companies + budgets
Delegation chains + governance
LiteLLM gateway integration
16 Media Generation
ComfyUI (diffusion models)
LTX-2.3 video, SDXL image, Stable Audio
GPU Switcher dashboard (Go)
Time-sharing via replica scaling
17 Public Edge — Hop
Hetzner CX23 (single-node Talos)
Headscale mesh + Tailscale
Caddy reverse proxy + TLS
Split-DNS (MagicDNS)
18 Persistent Agent
Kali Linux workstation
Always-on Claude Code agent
SSH remote access
50Gi persistent /root
19 Progressive Delivery
Argo Rollouts controller
LiteLLM canary (Cilium traffic split)
Sympozium blue-green
VictoriaMetrics analysis gates
21 Secure Agent Pod
Hardened non-root Kali container
Cilium egress allowlist
VibeKanban agent orchestration
VK Relay (WebSocket tunnel to browser)
24 In-Cluster Ingress
Traefik v3 on raspi edge nodes
Wildcard TLS (*.cluster.derio.net)
Authentik forward-auth (12 services)
Homepage dashboard
25 CI/CD Platform
Gitea (GitHub mirror forge)
Tekton Pipelines + Triggers
Zot OCI registry (cosign signed)
Webhook-driven CI on pc-1
26 Agent Images and the VK-Local Sidecar
agent-images repo (shared base + children)
Matrix CI with cross-repo
repository_dispatch
VK-local sidecar (shared /home/claude PVC)
Lockstep bumper PR in frank29 Ruflo — Swarm Orchestrator
claude-flow / ruvocal (chaotic swarm)
Hybrid pod: ruvocal + shell sidecar
SSH+Mosh shell on 192.168.55.222
Zero frontier-LLM keys (LiteLLM-only egress)
30 The Frank Papers — Research Series
Third blog series (Building / Operating / Papers)
Dossier gate (vendors, sources, gaps, counter-args)
Mermaid Frank theme +
.paper-post CSS scope
Render-time cross-series backlinks (zero retrofit)
Paper 00 prologue published 2026-05-1832 Infrastructure Automation
AWX Ansible controller (operator + CR)
Reaches non-Talos / external home-lab devices
Native OIDC login via Authentik
awx.cluster.derio.net (Traefik)
33 Hermes Agent Shell
Nous Research hermes CLI (dedicated pod, gpu-1)
BYOK → LiteLLM (provider pinned in config.yaml)
profile.d shim vs. sshd env-scrub
SSH+Mosh shell on 192.168.55.226
— Virtual Machines — upcoming
KubeVirt (VMs as pods)
CDI disk image import
KubeVirt Manager UI
Longhorn-backed DataVolumes
Technology → Capability Map
| Technology | Capabilities Unlocked |
|---|---|
| Talos Linux + Omni | Immutable OS, declarative machine config, secure bootstrap |
| Cilium (eBPF) | Kube-proxy replacement, L2 LoadBalancer, Hubble UI (192.168.55.202) |
| Longhorn | Distributed block storage, GPU-local StorageClass, 3-replica HA, UI (192.168.55.201) |
| ArgoCD | GitOps, App-of-Apps, self-healing, drift detection |
| NVIDIA GPU Operator | GPU scheduling, AI/ML workloads, container toolkit |
| Intel GPU DRA Driver | iGPU sharing via DRA, namespace-scoped GPU access |
| OpenRGB | LED control from K8s (just for fun) |
| VictoriaMetrics + Grafana | Cluster-wide metrics, alerting, dashboards, Grafana UI (192.168.55.203) |
| VictoriaLogs + Fluent Bit | Centralised log aggregation and querying |
| Longhorn Backup + Cloudflare R2 | PVC backup/restore, daily + weekly schedules, offsite storage |
| Infisical + External Secrets Operator | Secret management with audit trail, ExternalSecret → K8s Secret sync (192.168.55.204) |
| Ollama | Local LLM inference on gpu-1’s RTX 5070 (qwen3.5:9b, deepseek-coder:6.7b) |
| LiteLLM | Unified OpenAI-compatible gateway, virtual keys, spend tracking (192.168.55.206) |
| OpenRouter | Free-tier cloud model aggregation (DeepSeek R1, Gemini Flash, Llama 3.3 70B) |
| Sympozium | Kubernetes-native agentic control plane — agent=Pod, policy=CRD, execution=Job (192.168.55.207) |
| cert-manager | Automated TLS certificate lifecycle for webhooks and internal services |
| Authentik | Unified SSO — OIDC for ArgoCD, Grafana, Infisical; forward-auth proxy for Longhorn, Hubble, Sympozium (192.168.55.211) |
| vCluster | Virtual K8s clusters inside Frank — disposable sandboxes with own API server, resource quotas, network policies |
| Paperclip | AI agent orchestrator — virtual companies with org charts, budgets, and delegation chains; complements Sympozium (192.168.55.212) |
| ComfyUI | Diffusion model serving — video (LTX-2.3), image (SDXL), audio (Stable Audio), node-based workflow editor (192.168.55.213) |
| GPU Switcher | Custom Go dashboard for GPU time-sharing — one-click switching between Ollama and ComfyUI (192.168.55.214) |
| Hop (Hetzner Edge) | Public-facing single-node Talos cluster — Headscale mesh, Caddy reverse proxy, blog hosting, split-DNS |
| Headscale + Tailscale | WireGuard mesh networking — remote homelab access from any device, MagicDNS for split-DNS |
| Caddy | Automatic TLS (Cloudflare DNS challenge), public/mesh routing, path rewriting |
| Secure Agent Pod | Hardened non-root coding agent workstation — Cilium egress, dropped capabilities, VibeKanban orchestration, SSH (192.168.55.215) + UI (192.168.55.218) |
| Argo Rollouts | Progressive delivery — canary (Cilium traffic splitting + VictoriaMetrics analysis) and blue-green (preview + atomic cutover) |
| n8n | Per-user workflow automation — 400+ integrations, visual node editor, webhook triggers, Authentik forward-auth (192.168.55.216) |
| Blackbox Exporter + Pushgateway | Feature-level health monitoring — HTTP endpoint probes, cron heartbeat ingestion, Grafana alerting to Telegram |
| Health Bridge | Grafana alert → GitHub Project lifecycle state bridge — automatic degraded/dead/healthy transitions, issue comments, bug issue creation |
| Traefik (in-cluster) | In-cluster ingress controller, wildcard TLS (*.cluster.derio.net), ACME via Cloudflare DNS-01, Authentik forward-auth for 12 services (192.168.55.220) |
| VK Remote (self-hosted) | Self-hosted VibeKanban kanban API — PostgreSQL 16, ElectricSQL real-time sync, Rust/Axum server, local JWT auth, Authentik SSO ingress (vk.cluster.derio.net) |
| VK Relay | WebSocket relay sidecar tunneling browser API calls to local VK agent server via yamux multiplexing, SPAKE2 pairing, Ed25519 request signing |
| gethomepage.dev | Cluster dashboard at master.cluster.derio.net — service catalog with HTTP health indicators, custom bookmarks |
| Gitea | Self-hosted git forge with GitHub pull-mirror, Authentik OIDC SSO (192.168.55.209) |
| Tekton | K8s-native CI/CD pipelines — webhook-driven clone, test, build, sign, report status on pc-1 |
| Zot | OCI container/artifact registry with cert-manager TLS and cosign image signing (192.168.55.210) |
| agent-images | Shared base image + per-pod children repo — agent-base toolchain + secure-agent-kali / vk-local children, matrix CI, cross-repo repository_dispatch, lockstep bumper PR |
| Ruflo (claude-flow + ruvocal) | Swarm-style AI orchestrator — hybrid pod (ruvocal SSR + agent-shell-base sidecar), LiteLLM-only egress, SSH+Mosh shell on 192.168.55.222, web UI at ruflo.cluster.derio.net |
| The Frank Papers | Third blog series — research-grade landscape reviews framed as decisions; dossier gate (validate-dossier.py + pre-commit hook), Mermaid Frank theme, five papers/ shortcodes, render-time cross-series backlinks. Prologue published 2026-05-18: Why Run Your Own Cluster in 2026? |
| GoatCounter | Cookieless blog analytics — public beacon via Hop’s Caddy at counter.derio.net, mesh-only admin at counter.cluster.derio.net with Authentik forward-auth (192.168.55.224) |
| CrowdSec + caddy-crowdsec-bouncer | Edge HTTP security — agent tails Caddy logs on Hop, Caddy bouncer enforces decisions locally without round-tripping to Frank |
| Falco (modern_ebpf) + Falcosidekick | Container runtime security on Talos — Loki output to VictoriaLogs (Loki push protocol) + direct Telegram for priority:critical |
| ai-alert-helper | FastAPI service — daily blog digest, alert-time LLM enrichment, surge detection (hour-of-day baseline computed in Python because LogsQL has no quantile_over_time); LiteLLM-backed swap contract for future Sympozium |
| AWX | Ansible automation controller — the imperative arm reaching non-Talos home-lab hosts over SSH; operator + AWX CR (two-layer reconcile), native OIDC SSO via Authentik, Gitea-backed Job Templates |
| hermes (Nous Research) | Terminal-native agent CLI in a dedicated agent-shell-base pod on gpu-1 — BYOK to LiteLLM (provider pinned via config.yaml mapping), profile.d shim defeating the sshd env-scrub, SSH+Mosh on 192.168.55.226 |
Cluster State
| Node | Zone | Role | Hardware |
|---|---|---|---|
| mini-1/2/3 | Core (B) | Control-plane + Worker | Intel Ultra 5, 64GB RAM, 1TB NVMe, Arc iGPU |
| gpu-1 | AI Compute (C) | Worker | i9, 128GB RAM, RTX 5070, 2x4TB SSD |
| pc-1 | Edge (D) | Worker | Legacy desktop, 64GB SSD + 3x HDD |
| raspi-1/2 | Edge (D) | Worker | Raspberry Pi 4, 32GB SD |