I build reliable platforms that deploy and recover predictably.

A four-node K3s cluster — four VMs on one Proxmox host — with every layer declared in Git.

View case study

Problem

Twenty-plus services on one box, every change made by hand. Nothing was reproducible, and a rebuild meant re-deriving undocumented steps.

What I built

Terraform provisions the VMs, Ansible brings up a four-node K3s cluster, ArgoCD reconciles every workload from Git. Plus MetalLB and Nginx Ingress, Longhorn with scheduled snapshots, a cert-manager internal CA for real TLS, and Prometheus/Grafana/Alertmanager with custom exporters alerting to Discord. Longhorn replicates volumes between the cluster VMs — since those VMs share one physical machine, that covers a node or a disk failing, not the host going down.

Result

16 applications reconciled from Git — 12 from this repository and 4 from separate application repos — with drift auto-corrected and promotion by pull request. Rebuilding from bare metal is a documented eight-step playbook rather than a weekend of remembering — and the four incidents below are the ones that shaped what it covers, and what it openly does not.

• Terraform
• Ansible
• K3s
• ArgoCD
• Prometheus

• Architecture
• Walkthrough on request
• Private repository

resource "proxmox_virtual_environment_vm" "vm" {
  for_each = var.vms

  name      = each.key
  node_name = var.proxmox_node
  vm_id     = each.value.vmid

  cpu {
    cores = each.value.cores
    type  = each.value.cpu_type
  }
  memory {
    dedicated = each.value.memory
  }

  # The clone source is only used at creation time. The original
  # template VM may no longer exist, so ignore drift here to avoid
  # forcing VM replacement (which would destroy game-server data)
  # on routine changes like resizing.
  lifecycle {
    ignore_changes = [clone]
  }
}

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: vaultwarden
  namespace: argocd
spec:
  source:
    repoURL: https://github.com/ToonKnight/homelab.git
    targetRevision: HEAD
    path: kubernetes/vaultwarden
  destination:
    server: https://kubernetes.default.svc
    namespace: vaultwarden
  syncPolicy:
    automated:
      prune: false      # deleting is never automatic
      selfHeal: true    # a hand-edit is reverted to Git
    syncOptions:
      - CreateNamespace=true

Game-server hosting that provisions itself: pick a plan, pay, and the server boots.

View case study

Problem

Selling game-server hosting means provisioning a server per order. By hand it doesn't scale, and it can't run overnight.

What I built

Storefront, Stripe checkout, queue worker, and the panel API call that creates and boots the server. The storefront had no provider for the panel I run, so I ported one against its API. Each environment is its own GitOps repo with ArgoCD guardrails and manual promotion to production.

Result

Payment to a live, playable server in approximately 46 seconds with no manual steps — measured end to end on a test purchase, not an average over real orders. That includes automatic licence acceptance, which had previously crashed every new server on first boot.

• Laravel
• Stripe
• Docker
• ArgoCD
• REST APIs

• Storefront screenshot (opens the full-size image in a new tab)
• Not yet public — private repository

A real-time tabletop toolkit that keeps a whole table on one shared game state.

View case study

Problem

Running games, I kept the map, the initiative order and everyone's character sheets on my laptop, and the table crowded round one screen. Players could not see their own sheet or roll their own dice without asking me to click something.

What I built

A real-time browser toolkit: shared table state over websockets, server-authoritative dice, combat tracker and character import. I built and run all of it — containerised, versioned migrations, nightly backups with a staleness alert, and its own Grafana dashboards.

Result

Live and public at wyrmtable.eu, behind a Cloudflare Tunnel rather than an open port, with the pod locked down by NetworkPolicy, running non-root and rate-limited on auth. Releases are pinned image tags, promoted by hand.

• Next.js
• TypeScript
• Socket.IO
• PostgreSQL
• Kubernetes

• Live at wyrmtable.eu (opens in a new tab)
• Screenshot (opens the full-size image in a new tab)
• Private repository