// the find
Mafyuh/iac
GitOps-driven Infrastructure as Code for my homelab
A personal homelab monorepo covering GitOps for Kubernetes (Talos + Flux), Docker Compose services, Ansible playbooks, and a slow migration to NixOS, all stitched together with GitHub Actions and Renovate. It's aimed at homelabbers who want a real-world reference for running a hybrid Docker/Kubernetes setup rather than a reusable tool.
The security posture is unusually thorough for a personal repo: Bitwarden Secrets Manager with SOPS-encrypted access keys, Gitleaks pre-commit plus GitGuardian as a backstop, and Trivy scanning every container image with results surfaced in GitHub Security. Using Talos Linux for the control plane instead of generic Ubuntu nodes means the k8s layer is API-managed and immutable rather than hand-patched. Renovate is wired across the whole stack (Helm charts, container tags, Terraform/OpenTofu providers), not just app dependencies, so version drift gets caught everywhere.
The README says outright 'this repo is not structured like a project you can easily replicate' — there's no documented convention for how an app directory is supposed to look, so anyone trying to lift a pattern has to reverse-engineer it from examples. Several load-bearing pieces are custom or unofficial: the External Secrets Bitwarden integration is explicitly called out as unofficial, and the ai-proxy/model-metadata backfill is a bespoke tool with no visible tests. It's still mid-migration (Ubuntu VMs to NixOS, Docker Compose to k8s), so parts of the repo represent two different ways of doing the same thing at once, which is confusing to read cold. No visible CI validation of the Flux manifests themselves beyond a diff workflow — nothing stops a bad HelmRelease from merging other than the apply failing after the fact.