The Homelab Cookbook
My playbook for running real services out of my house — sites, a database, logs, CI/CD.
This isn't a "spin up Kubernetes in 5 minutes" post. It's the actual operational playbook: what to install, what order to do it in, what breaks, and how to put it back together at 11pm when you'd rather be asleep. Every recipe ends with a When it breaks section, because everything eventually does.
You've got a spare machine, a domain you're not really using, and
the itch to stop paying for things you could host yourself. You're
comfortable in a terminal — you need the specific
decisions and gotchas the official docs leave out. The example
domain throughout is otterpond.dev; swap in your own.
A single-node Kubernetes cluster on a Mac Mini, reachable from the public internet without exposing your home IP, with private-only admin surfaces, automated TLS, off-site backups, and logs you can actually search.
| Thing | Role | Notes |
|---|---|---|
| Mac Mini (Apple Silicon) | The cluster host | Any always-on machine works; these recipes assume macOS |
| UPS / battery backup | Rides out power blips | A brownout shouldn't take down your database |
| Firewall appliance | Router, dual-WAN failover, VLANs | These recipes use a Firewalla; concepts port to anything |
| Primary ISP (fiber) | Day-to-day connectivity | — |
| Backup ISP (5G) | Failover when fiber drops | CGNAT is fine — the network-topology recipe explains why |
| Cloudflare account | DNS, Tunnels, R2 storage | Free tier covers all of this |
| Tailscale account | Private network for admin + CI | Free tier is generous |
| GitHub account | Source, Actions CI/CD, container registry | — |
| 1Password account | Secret vault, synced into the cluster | Any vault with a CLI works |
Software, all via Homebrew: colima · k3d · kubectl · helm · k9s · cloudflared · tailscale · 1password-cli · awscli · postgresql · gh
Ten recipes, in build order.
A working collection, not a finished set — it grows as the homelab does. They build on each other roughly in order, but each one stands alone.
This is a homelab, not a datacenter. Single node, single region, single person on call (you). The recipes lean on managed edges — Cloudflare for the front door, GitHub for CI, 1Password for secrets — because the alternative is running more infrastructure to support your infrastructure, and that road has no end. The twelve-factor recipe is the argument for where to draw that line.