root@proxmox:~#
INFRAWEAVER
A self-hosted, GitOps-driven Kubernetes platform that deploys itself onto your Proxmox host. One command starts a wizard; clicking Deploy provisions three Talos VMs, bootstraps the cluster, generates every credential into OpenBao, and hands back a running platform with SSO, ingress, wildcard TLS, replicated storage, a private git server, CI and a management console.
MIT licensed 0 secrets in git 3 Talos nodes by default ~10-15 min to a synced cluster
What you need before you start
Nothing is auto-provisioned in the cloud and nothing phones home. You bring a Proxmox host, a domain, and an SSH key. InfraWeaver brings everything above the hypervisor.
| Item | Default / supported |
|---|---|
| Node shape | 3 × (4 vCPU / 8 GB / 100 GB) = 12 vCPU, 24 GB, 300 GB |
| Node OS | Talos Linux — immutable, no SSH, API-driven |
| DNS for TLS | Cloudflare, Route 53, Azure DNS, DigitalOcean, Hetzner — or HTTP-01 with no wildcard |
| Network | A bridge reachable from your LAN; MetalLB takes a VIP range on it |
| Credentials | An SSH key pair. The wizard can mint the Proxmox API token itself and discards your root password immediately. |
THREE WAYS IN, ONE WIZARD:8080
- On a Proxmox host The script detects Proxmox and offers to build a dedicated lightweight init VM, or to run the wizard directly on the host.
- On any other Linux or macOS machine The wizard starts immediately on port 8080. Your machine only needs to reach the Proxmox API on 8006.
-
From a clone
python3 scripts/init/server.py— same wizard, no download step.
Copy the example env file, fill it in, run the deploy script. The wizard only writes this file.
What actually gets installed
Not a wrapper around a managed service. These are the real upstream projects, deployed as ArgoCD Applications, reconciled continuously. Fourteen of them ship on every install.
OPTIONAL GROUPSOFF BY DEFAULT
Toggle these in platform.yaml or from the console. Nothing is installed that you did not ask for.
| Monitoring | Prometheus, Loki, Alertmanager, Grafana dashboards |
| External DNS | Creates and prunes DNS records through your provider API |
| Velero + MinIO | Cluster-level backup to local S3-compatible storage |
| Falco | Runtime security and threat detection |
| Wazuh | SIEM and security event management |
| Homepage | Service dashboard — the console already has one built in |
ACCESS TIERSENFORCED AT INGRESS
Internal services are not merely unlisted. A Traefik middleware rejects any request whose source IP falls outside your configured ranges, so resolving the name gets an attacker nothing.
auth.example.com, console.example.com — reachable from the internet
OPEN
*.int.example.com — ArgoCD, OpenBao, Onedev, Longhorn, Grafana
IP-GATED
The six stages between Deploy and a synced cluster
Pick a stage to see what it actually runs. These are the real script names from
scripts/; the output is a faithful replay, not a progress animation.
Three models worth understanding before you install
Most of InfraWeaver's behaviour follows from these. If they make sense to you, the rest of the platform will too.
GitOps loop
GitHub is read once, at clone time, and then never again. Your cluster is its own upstream.
- GitHub templateCloned exactly once, at deploy time.
- Onedev, inside the clusterYour private git server and CI. This becomes the source of truth.
- ArgoCDWatches Onedev and reconciles roughly every three minutes.
- The clusterTo change an app, push a commit locally. Nothing leaves your network.
Secrets
Every credential is generated at deploy time. The repository contains none, by construction.
- .envDeploy-time only, gitignored, never committed.
- bootstrap-openbao.shWrites to
secret/platform/<service>. - OpenBaoRuns in-cluster. Vault-compatible, fully open source.
- External Secrets OperatorExternalSecret CRDs pull from OpenBao into real Kubernetes Secrets.
Traffic
One MetalLB VIP, one Traefik, one wildcard certificate, two access tiers.
- Your DNS provider
example.comand*.example.compoint at your public IP. - Router, port 443Forwarded to the MetalLB Traefik VIP on your LAN.
- TraefikRoutes by host. cert-manager keeps the wildcard fresh over ACME DNS-01.
- CoreDNS on its own VIPResolves
*.example.comto cluster IPs so internal traffic never leaves the LAN.
CLUSTER TOPOLOGY — DEFAULT INSTALL SYNTHETIC
The console it hands you
Once ArgoCD settles, the platform is driven from a web console rather than a pile of kubectl aliases. These views are rebuilt here at production fidelity from the real routes and data shapes — the live console sits behind SSO, so nothing on this page is a capture of a running system.
Forty-five apps, installed on demand
Each one is a directory with an application.yaml, optional Helm values and
manifests. Install from the console, or scaffold your own with
bash scripts/new-app.sh my-app and push to Onedev.
platform.yamlFLIP A FLAG
Feature groups are declarative. Toggling one here rewrites the file on the right, exactly as the console does before committing it to Onedev.
Read this before you run it anywhere real
Alpha software — not recommended for production
InfraWeaver is in active alpha and is provided as-is for homelab experimentation and learning. Use at your own risk.
- It has not undergone an independent third-party security review or penetration test.
- Do not run it in production, or on any internet-exposed environment you care about, without first commissioning your own security audit and penetration test.
- APIs, manifests, secrets handling and deploy scripts can change without notice and may contain breaking changes or security gaps.
- You are responsible for reviewing every component, rotating all generated credentials, and hardening the deployment for your own threat model.
WHAT THE PROJECT DOES DO ABOUT IT
- Kyverno admission policies ship enabledNo privileged containers, no host namespaces, no hostPath volumes, all capabilities dropped, non-root enforced,
:latestrejected. - Every namespace gets a default-deny network policyGenerated automatically, allowing only intra-namespace traffic, cluster DNS, ingress from Traefik and Prometheus scrape on metrics ports.
- A secret-leak gate fails the build
scripts/validate-iac.shrejects any raw Kubernetes Secret carrying a real value. - Credentials are generated, never shippedNothing in the repository is a working password. The wizard discards your Proxmox root credentials the moment it has minted an API token.
Every forked deployment stores user feedback locally for its own admins and forwards a sanitised copy to a single canonical endpoint, so maintainers can improve the platform for all forks. It is a hardcoded constant with no environment override, documented in the infra README. Everything else in InfraWeaver is a variable.
Start it on a spare box first.
A nested Proxmox VM with 32 GB is enough to watch the whole thing come up. If it
breaks, bash scripts/redeploy.sh wipes the cluster and rebuilds it,
keeping your .env and users.yaml.