How this homelab is built — IaC in five minutes
How this homelab is built — IaC in five minutes
Context
Everything in this homelab is Infrastructure as Code (IaC): virtual machines are provisioned declaratively, configured by automation, and the configuration itself lives in version control — never "just done by hand and remembered."
The pipeline, in words
Think of it as a chain of four tools, each responsible for one layer:
- OpenTofu (an open-source Terraform fork) talks to the hypervisor API and declares what should exist: this many VMs, these specs, this network attachment. Running it twice with no changes does nothing — that's the idempotence property that makes the whole chain trustworthy.
- Ansible takes a freshly provisioned, blank VM and turns it into a working service: installs packages, writes configuration files, starts services. Playbooks are written to be safely re-run at any time.
- Git (self-hosted) is where both the OpenTofu declarations and the Ansible playbooks live, reviewed and versioned like any other code.
- A backup system snapshots everything nightly, so that even the "state" that isn't strictly code (databases, uploaded files) has a recovery path.
A simple way to picture it:
OpenTofu (declares infrastructure) --> Hypervisor (creates VMs)
--> Ansible (configures the VMs) --> services running
Everything above is versioned in Git. Documentation lives in a wiki.
Nightly backups protect what code alone can't reconstruct (data).
Why this matters
The test I hold this lab to: if a server disappears tonight, can it be rebuilt from the Git repository alone, without me remembering any manual step? Most of the time, yes. When the answer is "no" — some manual step, some undocumented tweak — that gap gets written down as technical debt rather than quietly ignored. A few of the incident write-ups elsewhere on this shelf are exactly that: a manual step that was forgotten, and what it cost.
What a generic map of this looks like
Rather than publishing the real address plan and VM inventory (internal, and not particularly interesting to a reader who isn't me), picture three physical hosts, each running a handful of virtual machines: a Git server, a wiki, a backup server, an identity/authentication service, a small Kubernetes cluster hosting a couple of internal apps (including the portal you're reading this on), and a firewall appliance sitting at the network edge. That's structurally "the homelab" — the real map just has real names and addresses attached to it.
What this deliberately leaves out
No IP ranges, no VM identifiers, no hardware specs. Those details don't change the lesson (declare it, version it, automate it, back it up) and they're the kind of thing better kept off a public page regardless of how boring they'd be to anyone but me.