Just as an aside, you’re half way to being able to use wildcard certs, you might as well just do the last bit of work so the domain names you’re using are a little less public. Let’s Encrypt puts every domain name on every cert in a public database. I’ve seen much less random probing of my services since moving to wildcards

No support for comments? Hard pass

That’s a basic requirement for almost any company. If you’re into hard coding credentials just use wireguard directly.

The only Radxa I’d bother with is the Rock 5 and for the price, I’d probably just go with rpi5 (unless you like to tinker… a lot). That’s coming from someone that owns 3 Rock5’s. The new Orion board looks interesting, but if it’s like any other Radxa products it’ll be 2+ years before it gets decent software support.

Good write up. Thanks for the good lessons learned section.

Tmux is your friend for running stuff disconnected. And I agree with the other post about btrfs send/receive.

Argus https://release-argus.io

Internet:

• 1G fiber

Router:

• N100 with dual 2.5G nics

Lab:

• 3x N100 mini PCs as k8s control plane+ceph mon/mds/mgr
• 4x Aoostar R7 “NAS” systems (5700u/32G ram/20T rust/2T sata SSD/4T nvme) as ceph OSDs/k8s workers

Network:

• Hodge podge of switches I shouldn’t trust nearly as much as I do
• 3x 8 port 2.5G switches (1 with poe for APs)
• 1x 24 port 1G switch
• 2x omada APs

Software:

• All the standard stuff for media archival purposes
• Ceph for storage (using some manual tiering in cephfs)
• K8s for container orchestration (deployed via k0sctl)
• A handful of cloud-hypervisor VMs
• Most of the lab managed by some tooling I’ve written in go
• Alpine Linux for everything

All under 120w power usage

I prefer projectivy launcher. It’s got a few more features and feels a little more polished.