Homelab GitOps Workflow

ArgoCD syncs k8s/**, Terraform+talosctl manage Talos config (manual)

Homelab GitOps Workflow ArgoCD syncs k8s/**, Terraform+talosctl manage Talos config (manual) Forgejo · Git source · Architecture component Forgejo Git source k8s/** · Kubernetes manifests · ArgoCD (Automated) k8s/** Kubernetes manifests terraform/** · Talos config · Terraform (Manual) terraform/** Talos config ArgoCD · GitOps controller · ArgoCD (Automated) · automated ArgoCD GitOps controller automated kubectl + talosctl · manual apply · Terraform (Manual) · manual kubectl + talosctl manual apply manual Talos Cluster · k8s + nodes · Architecture component Talos Cluster k8s + nodes Vault + SOPS · Secrets (*.enc.yaml) · Architecture component Vault + SOPS Secrets (*.enc.yaml) push push watch & sync apply apply decrypt ArgoCD (Automated) Terraform (Manual) Legend Backend Cloud Security External

ArgoCD Path (Continuous)

  • • Push to k8s/** auto-triggers ArgoCD watch
  • • ArgoCD syncs manifests to cluster
  • • Applications reconcile continuously

Terraform Path (Manual Only)

  • • terraform apply generates Talos machine config
  • • Developer runs `talosctl apply-config` locally
  • • No CI (requires node-level credentials)

Security

  • • SOPS encrypts sensitive manifests (*.enc.yaml)
  • • Vault holds service account secrets
  • • All changes audited in Git history