Tools

Stack

What we actually use and how often. If something is marked “occasional”, we have used it in production, just not every week.

Orchestration and compute

Where workloads run

  • Kubernetes Daily

    k3s in the homelab, EKS for clients

  • Docker / OCI Daily

    Multi-stage, rootless images

  • Proxmox VE Daily

    Lab virtualization

  • AWS EC2 / ECS Frequent

    Spot instances and autoscaling

Infrastructure as code

Nothing is changed by hand

  • Terraform / OpenTofu Daily

    Custom modules, remote state

  • Ansible Frequent

    Bare-metal node configuration

  • Helm / Kustomize Daily

    Workload packaging

  • Packer Occasional

    Immutable base images

Continuous delivery

From commit to production

  • GitLab CI Daily

    Pipelines with caches and artifacts

  • Argo CD Frequent

    GitOps with automatic synchronization

  • GitHub Actions Frequent

    Open-source projects

  • Renovate Frequent

    Dependency updates

Observability

Know before the user does

  • Prometheus Daily

    Metrics and alert rules

  • Grafana Daily

    Dashboards per service, not host

  • Loki Frequent

    Logs correlated with traces

  • Alertmanager Frequent

    Routing and silences by severity

Networking and security

Closed by default

  • Traefik / Caddy Daily

    Automatic TLS, reverse proxy

  • WireGuard Daily

    Lab access without exposing ports

  • Vault Frequent

    Dynamic secrets and rotation

  • Cloudflare Frequent

    DNS, WAF, and tunnels

Languages

For automation

  • Bash Daily

    Always with set -euo pipefail

  • Python Frequent

    Automation and operators

  • Go Occasional

    Tools and controllers

  • SQL Frequent

    PostgreSQL and SQLite

Laboratory

The homelab where everything breaks first

No architecture reaches a client before failing here first, on purpose.

team@forge ~ 
forge status --lab
nodes          3 × mini PCs (32 GB RAM, NVMe)
hypervisor     Proxmox VE 8 · quorum cluster
k8s            k3s v1.31 · 1 control plane, 2 workers
network        Segmented VLANs · WireGuard ingress
storage        ZFS mirror · hourly snapshots
backup         3-2-1 · restoration tested monthly
status         healthy

The lab is not a demo: it is where we test version upgrades, clean-slate restores, and failure scenarios before proposing them for a real project. Every service running here has its manifest in Git and can be rebuilt without manual intervention.

The rule is simple: if we cannot destroy a node on a Tuesday afternoon and watch it come back on its own, that service is not ready yet.

Want to see this in practice?

The projects document how these pieces fit together in a real system.

View projects