Implementation Selection
Purpose
Move from architectural roles to concrete implementation choices by evaluating how different options compose into functional platform stacks.
1) Role Implementation Matrix
The following matrix summarizes the primary implementation options for each architectural role. For detailed trade-offs and integration notes, refer to the individual role documents.
| Role | Implementation Options | Primary Best-Fit Stacks |
|---|---|---|
| Edge & Boundary | Traefik, NGINX Ingress, Caddy | K3s, K8s, Nomad |
| Identity & Access | Authentik, Keycloak, Authelia | All Stacks |
| Connectivity & Naming | CoreDNS, ExternalDNS, Pi-hole, Consul | K8s, Nomad |
| Storage & Persistence | Longhorn, Rook-Ceph, ZFS, NFS | K3s, K8s, Nomad |
| Compute & Orchestration | K3s, K8s (Talos), Nomad | - |
| Operations | Prom/Grafana/Loki, GitOps, Velero, Restic | All Stacks |
2) Stack Assemblies
Instead of starting with pre-baked bundles, we derive platform “stacks” as compatible sets of implementations that naturally compose together.
The Pragmatic Homelab (K3s-based)
Focuses on ease of use and low overhead while maintaining Kubernetes compatibility.
- Orchestrator: K3s
- Ingress: Traefik (Forward-auth)
- LB (L4): Klipper (bundled) or MetalLB
- Identity: Authentik
- Storage: Longhorn
- Backups: Velero + Restic
- Observability: Prometheus + Grafana + Loki
The Appliance Cluster (Talos/K8s-based)
Focuses on HA, security, and immutability.
- Orchestrator: Kubernetes on Talos
- Ingress: NGINX Ingress (OAuth2-proxy)
- LB (L4): Kube-vip (Layer 2)
- Identity: Authentik or Keycloak
- Storage: Rook-Ceph
- Backups: Velero (CSI Snapshots)
- Observability: Prometheus + Grafana + Loki
The Flexible Scheduler (Nomad-based)
Focuses on simplicity and host-integrated storage.
- Orchestrator: Nomad
- Ingress: Traefik or Caddy
- Discovery/LB: Consul + Fabio/Traefik
- Identity: Authentik (Forward-auth)
- Storage: ZFS (Host volumes + Replication)
- Backups: Restic
- Observability: Prometheus + Grafana + Loki
3) Selection Criteria & Validation
We evaluate these stacks against our Non-Functional Requirements and Policies.
Hard Gates
These are non-negotiable policy checks.
- No Inbound NAT: Must support exposure via tunnels or relay Exposure Policy.
- Identity-First: All exposure points must enforce IdP-backed auth Identity Policy.
- Cluster Reachability: Load balancing (L4/L7) must be addressed at Day 1; “floating” workloads require a stable entry point to be usable.
- Durability: Must meet RPO 1h / RTO 4h for critical data Backup Policy.
Acceptance Tests
- Internal DNS:
internal.service.risu.techresolves internally and is unreachable from WAN. - VPN access: VPN client resolves internal names and can access internal ingress.
- Public isolation: public ingress serves only public services, never internal.
- Identity flow: auth proxy + IdP flow works end-to-end for internal and public routes.
- Stateful proof: dummy stateful service gets storage, replica, backup job signal, and a restore test plan.