finn/homelab
Watch
2
0
Fork
You've already forked homelab
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Page: Service Inventory
Pages
Home PR Previews Platform Architecture Service Inventory Storage and State
3 Service Inventory
Finn Dührkop edited this page 2026-10-27 03:43:49 +00:00
Table of contents

Service inventory

This inventory describes configured endpoints and relationships, not current availability. Identity configuration is dynamic: app role mappings are in Terraform and Authentik configuration, while live group membership is queried from Authentik. No current-group inventory is kept here.

Service Configured endpoint or exposure Identity and dependency facts
Authentik auth.113lab.dev Identity provider for applications using OIDC or forward authentication; its database is PostgreSQL.
Forgejo git.113lab.dev OIDC through Authentik; Actions uses in-cluster runners, including a dedicated preview builder.
Argo CD argocd.113lab.dev OIDC through Authentik; manages the orchard-core virtual cluster and preview applications.
Homarr 113lab.dev OIDC through Authentik; dashboard and Kubernetes overview.
Grafana / monitoring grafana.113lab.dev OIDC through Authentik; kube-prometheus-stack includes Prometheus, node-exporter, kube-state-metrics, and scrapes for Longhorn, cert-manager, and Traefik.
RustFS s3.113lab.dev; console at console-s3.113lab.dev/rustfs/console/ S3-compatible object storage; console uses Authentik. Also hosts Terraform state.
OpenBao bao.113lab.dev OIDC through Authentik; one Raft replica on Longhorn.
RomM retro.113lab.dev Authentik OIDC; MariaDB-backed application with its ROM library on NAS NFS.
ROMarr romarr.113lab.dev Authentik OIDC; shares the RomM library and uses Prowlarr as its indexer manager.
Prowlarr prowlarr.113lab.dev Authentik forward-auth; ROMarr connects to its in-cluster API.
Jellyfin jellyfin.113lab.dev on the LAN No Cloudflare DNS/tunnel route; local DNS and internal Traefik ingress. Media is mounted read-only from NFS. Configuration and metadata use Longhorn; transcode cache is ephemeral.
Mail mail.113lab.dev sending domain; [email protected] receives forwarded mail Mailgun (EU region) handles outbound transactional mail; Cloudflare Email Routing handles inbound forwarding. No inbound mail server runs in the cluster.
Orchard Core previews preview.113lab.dev/<repo-key>/<PR-number>/ Workloads run in the shared orchard-core virtual cluster; the preview workflow creates repository/PR-scoped resources.

Additional service facts

  • Prometheus storage is a Longhorn-backed 10 GiB claim. Alertmanager is disabled; etcd, scheduler, controller-manager, and kube-proxy scrapes are disabled because the k3s control-plane components bind to localhost.
  • The Grafana overview dashboard is provisioned from modules/monitoring/dashboards/overview.json. Its panels cover node/pod health, certificates, web errors, utilization, Longhorn volumes, and estimated board power. The power exporter reads Pi 5 PMIC values; it does not represent wall power and has no Pi 4 control-plane sensor.
  • RomM's configured optional metadata providers include Hasheous, Playmatch, HowLongToBeat, LaunchBox, ScreenScraper, IGDB, RetroAchievements, and SteamGridDB. API credential values are not recorded here.
  • ROMarr mounts the RomM library and uses a downloads/ directory on the same NAS volume. Prowlarr's in-cluster API endpoint is http://prowlarr.prowlarr.svc:9696.
  • Mailgun domain setup creates SPF/DKIM records and a credentials Secret in the mail namespace. The Cloudflare email-routing destination is a configured variable and requires address verification before forwarding.

Configuration sources

Root module wiring and endpoint values are in main.tf and dns.tf. Per-service configuration is in modules/<service>/; monitoring details are in modules/monitoring/, mail in modules/mail/, and application-specific storage and identity settings in the corresponding modules. Authentik group membership is not represented by this inventory.