finn/homelab
Watch
2
0
Fork
You've already forked homelab
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Page: Storage and State
Pages
Home PR Previews Platform Architecture Service Inventory Storage and State
3 Storage and State
Finn Dührkop edited this page 2026-10-27 03:43:50 +00:00
Table of contents

Storage and state

Block storage

  • Longhorn is the cluster block-storage system. The default replica count is 2, with best-effort replica auto-balancing.
  • The node configuration marks worker nodes as eligible for Longhorn disks. The descheduler runs separately from replica balancing.
  • Prometheus, application configuration, and other persistent claims use Longhorn where their modules specify it.
  • Single-replica workloads using ReadWriteOnce claims specify Recreate where configured.

Sources: modules/longhorn/, nodes.tf, modules/descheduler/, and each application's module.

NAS media

  • Terraform defaults the NAS server to 192.168.1.60 and the exported media root to /volume1/Media.
  • RomM's library is a read/write NFS volume under romm/; Jellyfin's media volume is read-only under jellyfin/.
  • The configured RomM library claim is 50 GiB and the Jellyfin media claim is 2.94 TiB. NFS does not enforce these claim sizes as quotas; free space is shared on the NAS.
  • NFS export permissions and the NAS's root mapping are managed outside this Terraform repository. The documented NAS export uses root-to-guest mapping; RomM's library write access depends on that mapped identity.

Sources: variables.tf, modules/romm/, and modules/jellyfin/.

RustFS and Terraform state

  • RustFS is an S3-compatible service backed by Longhorn. It uses path-style requests and enforces conditional If-None-Match writes.
  • The Terraform backend uses the terraform-state bucket and key homelab/terraform.tfstate, with S3-native lock files.
  • Backend requests use an in-cluster port-forward to RustFS; the repository configuration describes why the Cloudflare proxy path is not used by the AWS SDK.
  • Terraform state includes sensitive values. scripts/tf reads backend credentials from a Kubernetes Secret; credentials and state data are not represented in this Wiki.
  • The in-cluster S3 endpoint is http://rustfs.rustfs.svc.cluster.local:9000. The public proxy's request-body limit is documented as 100 MB on the configured Cloudflare plan.

Sources: modules/rustfs/, backend.tf, backend.hcl.example, and scripts/tf.

OpenBao

  • OpenBao runs a single Raft replica on Longhorn; it is not an HA cluster.
  • The static seal-key Secret is created outside Terraform. Terraform references it but does not manage its key material.
  • The seal key and encrypted Raft data reside in the same cluster. The key is not an independent external KMS.
  • The configured user-role policy is read-only under kv/shared/; the administrator policy is separate.

Sources: modules/openbao/ and modules/authentik/.

Data protection boundary

The repository contains state-backup tooling, but not a copy of the NAS media data. Terraform state, backups, seal-key material, and application credentials are not Wiki content.