EPOCH.ENGINEERING

Self-Hosted Infrastructure Platform

Try the live cluster demo

Online

  • Proxmox VE + OpenTofu
  • TalosOS + K8s 1.36
  • Karpenter (node autoscaling)
  • Cilium + Hubble (networking)
  • WireGuard (pod-to-pod encryption)
  • ArgoCD (continuous delivery)
  • OpenBao (secrets vault)
  • External Secrets Operator
  • SOPS + age (encryption)
  • helm-secrets (config injection)
  • Traefik + cert-manager + trust-manager
  • Cloudflare Zero Trust
  • Keycloak (identity provider)
  • oauth2-proxy (ForwardAuth)
  • Longhorn (block storage)
  • CloudNativePG (PostgreSQL)
  • Harbor (container registry)
  • Spegel (P2P image mirror)
  • Argo Workflows (CI pipelines)
  • Argo Events (webhook triggers)
  • Kyverno (policy enforcement)
  • Cosign (image signing)
  • Kyverno verifyImages (admission)
  • Fulcio (keyless signing CA)
  • Rekor (signing transparency log)
  • Tessera (Rekor v2 log storage)
  • TUF (self-hosted trust root)
  • TSA (RFC3161 timestamps)
  • SLSA Build L3 (provenance)
  • Syft + Grype (SBOM/CVE)
  • Semgrep + Trivy (SAST/IaC)
  • Pluto (deprecated K8s APIs)
  • OWASP ZAP (DAST scanning)
  • Headlamp (K8s dashboard)
  • kubernetes-reflector (ConfigMap sync)
  • Reloader (CM/Secret-driven rollouts)
  • Renovate (dependency updates)
  • ArgoCD Image Updater
  • Kargo (staged promotion)
  • Argo Rollouts (progressive delivery)
  • Linkerd mTLS (workload identity)
  • Prometheus + AlertManager
  • Grafana (visualization)
  • Alloy (logs + OTLP traces)
  • Loki (log aggregation)
  • Tempo (tracing + metrics)
  • ntfy (push notifications)
  • Goldilocks (VPA dashboard)
  • HPA (CPU-based autoscaling)
  • KEDA (event-driven scaling)
  • VPA (memory right-sizing)
  • KRR (resource analysis)
  • Velero (cluster backups)
  • Velero UI (backup dashboard)
  • SeaweedFS (S3 storage)
  • RabbitMQ (message broker)
  • Valkey (Redis cache)
  • CrowdSec (threat intel)
  • Maddy (SMTP relay)
  • BetterAuth + Hono (app auth)
  • Resend (email delivery)
  • Knative Serving (serverless)
  • Rybbit (web analytics)
  • Gatus (status page)
  • GO Feature Flag
  • Grafana Faro (Web Vitals)
  • Falco (runtime security)
  • Falcosidekick (event routing)
  • DefectDojo (vulnerability mgmt)
  • Loki Ruler (LogQL detection)
  • Beelzebub (cluster-internal honeypot)
  • LitmusChaos (chaos engineering)
  • fail2ban (brute-force protection)
  • Kanister (data-recovery drills)
  • buildah (image build - dev + CI)
  • Skaffold (inner-loop dev)
  • Fastlane (iOS + Android)

Review

All components reviewed and promoted.

Pending

Current infrastructure stack fully implemented and online.

How a Deploy Flows

Application path
git pushGitHub
Argo Eventswebhook sensor
Pre-build scansSemgrep, TruffleHog, OSV
Buildahbuild + push image
Post-build scansTrivy, Syft, Grype
Cosign signkey + keyless (Fulcio)
SLSA attestprovenance v1.0
Harborsigned digest
Kargo Warehousenew freight
Promote stagesdev -> staging -> prod
Argo Rolloutscanary delivery
Servinglive traffic
Infrastructure path
PR validation (no apply)
IaC pull requestGitHub
Argo Workflowsinfra-validate
tofu validatesyntax + config
IaC scansCheckov, Trivy, Pluto, TFLint
Operator apply
merge to mainreviewed
bin/ deployoperator runs tofu apply
Proxmox + TalosVMs provisioned
Clusterplatform updated
GitOps sync (manifests)
ArgoCDGitOps reconcile
Manifests applieddesired state

Nothing reaches a cluster by hand. Application images are signed and provenance-attested before a deployable tag exists, and Kargo gates prod on manual approval. Argo Workflows only validates infrastructure on PRs; the actual tofu apply runs from the deploy script, and ArgoCD reconciles the rendered manifests separately.

How Security Layers

Identity & Access
KeycloakSSO / OIDC
oauth2-proxyForwardAuth
Cloudflare edgeproxy + WAF
OpenBaosecrets vault
External Secretsvault sync
SOPS + ageencrypted at rest
Network & Mesh
LinkerdmTLS mesh
Ciliumdefault-deny + Hubble
WireGuardpod encryption
cert-managerTLS + trust-manager
TraefikTLS edge termination
Supply Chain & Admission
Kyvernoadmission policy
Cosignkey + keyless signing
SLSA L3build provenance
Trivy / Syft / Grypeimage + SBOM scan
SemgrepSAST
TruffleHogsecret scan
OSVdependency vulns
Plutodeprecated APIs
Runtime
Falcosyscall detection
Falcosidekickalert routing
CrowdSecthreat intel + bouncer
fail2banedge brute-force ban
Beelzebubhoneypot
OWASP ZAPDAST on promotion
Aggregation & Response
DefectDojofindings + SLA
Loki RulerLogQL alerting
ntfynotifications

Five layers, each independent. Identity and secrets gate access, the mesh encrypts and segments every hop, supply-chain gates stop unsigned or unattested images at admission, runtime sensors watch live workloads, and every signal lands in DefectDojo for triage on an SLA.

How Data Is Protected

Veleromanifests + CSI snapshots
CloudNativePGbase backup + continuous WAL
Longhornblock-level snapshots
Kanisterrecovery-drill verification
SeaweedFS S3object storage
Restoredrill-verified recovery
Longhorn snapshots: 30 min Tier-2 daily: 7 days Weekly + secrets: 30 days Continuous WAL: point-in-time
Verification monitors -> Prometheus alerts
cnpg-witness velero-watcher sentinel-freshness drill-result-exporter

Four independent sources back up to one S3 store. A monitor layer writes per-backup sentinels and tracks freshness, and Kanister exercises the full restore path on a schedule, so recovery is tested, not assumed.

Deployed Apps