Architecture

A Rocky Linux host runs Caddy for public HTTP/HTTPS ingress and a single-node K3s application platform. A separate workstation provides private GPU inference. Public ingress, private administration, cluster workloads, and GPU inference remain separate so that each can be maintained and recovered without coupling every service to the same failure domain.

Caddy stays outside K3s, leaving certificate handling and a static recovery surface available when the cluster is unhealthy. Packaged Traefik and ServiceLB are disabled, so the deployment has one public ingress path rather than competing host and cluster paths.

Security boundaries

Only selected HTTP/TLS and VPN ports are forwarded by the router. firewalld remains the host exposure authority, while Kubernetes networking rules are considered alongside it. SSH, NoMachine, the Kubernetes API, and inference stay on trusted private paths rather than receiving public reverse-proxy routes.

SELinux remains enforcing. Files, storage, and executables receive the labels required by their actual service boundaries instead of bypassing enforcement. Secrets and host-specific values remain outside source control, and public registration is disabled for the private Linkwarden instance.

Technology choices

Rocky Linux provides the SELinux-enabled host. Caddy owns automatic TLS and reverse proxying, while CrowdSec reads Caddy logs and sends enforcement decisions to firewalld. WireGuard supplies the private administration path. AMP retains its existing host-level lifecycle for game servers.

K3s provides Kubernetes scheduling and service primitives without a multi-node control plane. Its stock Local Path Provisioner stores volumes on the node, so the storage is not highly available. Linkwarden uses PostgreSQL for application data and Meilisearch for search. The inference worker stays separate so GPU drivers, model storage, and desktop resource pressure do not complicate the stable server.

Rebuild model

Rebuild is staged so failures can be isolated at the host, network, cluster, and application boundaries:

1. Establish the Rocky Linux networking, time, package, SELinux, firewall, and private-access baselines.
2. Prepare private host and service values with restrictive permissions.
3. Validate and install Caddy independently.
4. Bootstrap K3s with its private node address, local storage path, disabled packaged ingress/load balancer, and controlled kubeconfig permissions.
5. Bootstrap absent workloads using compatible selected versions.
6. Verify workloads, storage, services, and external behavior.
7. Use maintenance workflows, rather than bootstrap, for an existing installation.

Checks remain non-mutating, inputs are validated before mutation, existing installations are not silently replaced, and live configuration is backed up before overwrite. Maintenance owns the cross-component lifecycle and diagnostic order.

Host and network baseline

WAN routing, router forwarding, and the host firewall are separate boundaries. A service listening locally proves neither that it is reachable from another network nor that its exposure is appropriately restricted. Management access must remain available while routing or firewall rules change.

The environment is intentionally a single-node, local-storage system. Local backups protect against some configuration mistakes and failed upgrades, but same-device copies do not protect against device loss. Workload-specific and off-host recovery remain distinct responsibilities.