Kubexa

work in progressThis site is being written now: pages appear and change as the cluster does. The AI layer is the most incomplete part.

About this site

I run one Talos Linux cluster for a household and a few projects, and every decision about it lives in a single git repository. Flux reconciles that repository; I change the cluster by changing the repository.

What is here

Concrete documentation for the stack, written while it runs: node images, hardware, Gateway routes, Ceph and PostgreSQL, the monitoring stack, the AI layer. Each page quotes the manifest it describes, and the quote is resolved at build time from the same file that runs on the cluster, so a page cannot drift from reality without the build failing.

The site is a work in progress. Pages are added as the stack is written up, and the AI layer is the least finished part. Physical networking has no page yet: the switch, the NICs and the cabling guides come later, after the software layers settle.

How it is built

A Rust binary: Leptos for server-side rendering, Markdown compiled into the binary at build time through rust-embed, comrak for Markdown and syntect for highlighting. There is no client framework and no hydration payload. Every page renders without JavaScript; a 1 KB script adds search and the theme switch on top.

Every page also exists as plain Markdown at <path>.md, plus /llms.txt and /llms-full.txt for agents, and /sitemap.xml and /rss.xml for everything else.

kaniko builds the image inside the cluster. Google archived that project in 2024 and a group of maintainers picked it up, which earns them their own page.

Core patterns

Identity comes first. ZITADEL is the only identity provider here, and it hands out short-lived tokens instead of long-lived credentials:

  • the kube-apiserver trusts ZITADEL as a JWT issuer through KubeAuthenticationConfig, maps the email claim to a username and the groups claim to Kubernetes groups, both prefixed zitadel: (infrastructure/configs/k8s-oidc-rbac.yaml)
  • kubectl gets its token from kubelogin, so a user kubeconfig carries an exec block and no static certificate
  • talosctl goes through a small OIDC bridge that exchanges the same ZITADEL identity for a Talos client certificate, so the day-to-day talosconfig holds no long-lived admin key
  • applications are OIDC clients of the same provider, and group membership decides what they see: Gitea admins, Grafana editors, Harbor project roles and the NetBird groups all come from one groups claim

Permission therefore lives in two places, ZITADEL roles and Kubernetes RBAC, and both are declared. Nothing grants access by hand.

Why the stack stays this small

Price efficiency decides what runs here. The cluster owns three RTX 3050 class cards and keeps them busy: every push to any repository reindexes the code through kb-embed and kb-rerank, and WebODM runs photogrammetry on the same hardware. Serving a language model from those cards never pays. A node that answers a model locally costs more to buy, more to power and more to keep cool than the answers are worth, while a hosted API charges 10 EUR a month for the same work. That is what this site's own agent stack uses, opencode-go with DeepSeek v4.1 Flash exclusively, and the electricity bill does not move.

The same arithmetic shapes the rest of the platform. Three cheap control planes beat a managed cluster, Ceph on local disks beats cloud block storage, and one Tailscale tailnet beats a VPN appliance. Each choice trades a fixed cost for a marginal one.

Serving a frontier model at DeepSeek's own scale is a different problem with a different answer. Their recipe and deepinfer show how they run inference, and this report covers the gigawatt campus they are planning in Inner Mongolia. That marginal cost is capital and electricity at a scale no household reaches, which is why renting the result beats building it.

Contact

[hello@kubexa.tech](mailto:hello@kubexa.tech) reaches the maintainer for questions,

corrections, and anything here that contradicts what your own cluster does.

[security@kubexa.tech](mailto:security@kubexa.tech) is the disclosure path if you find a

weakness in anything this site describes, and the same address is published in /.well-known/security.txt for scanners and researchers.

Mail is the only channel: no phone number, no contact form. It gets answered when someone is at the keyboard, with no turnaround promised.

Colophon

The mark and the type are the only design decisions here I did not borrow. Everything else follows the home-ops community layout, and the typeface is JetBrains Mono.