Component overview¶

alpstack is deliberately built from a small set of well-understood, self-hostable components. The selection bias throughout is small, affordable, and operable by one person — every choice trades some feature breadth for less to run, patch, and reason about.

Foundation¶

Component	Role	Why this one
Talos Linux	The node OS	An immutable, API-managed OS with no shell and no SSH — the whole machine is declared in config and reconciled. Small attack surface, reproducible nodes, encrypted disks out of the box.
Kubernetes	Orchestration	The substrate everything else targets. Talos ships and manages a matched Kubernetes version, so the two move together.
Cilium	CNI, service LB, host firewall	eBPF dataplane that replaces kube-proxy, enforces network policy, encrypts pod traffic (WireGuard), and firewalls the nodes themselves. One component covers what would otherwise be several. See Networking model.
Longhorn	Storage (CSI)	Replicated block storage backed by the nodes' own disks — no external SAN or cloud volumes. Per-volume encryption and ReadWriteMany are built in. See Storage.

Platform services¶

Component	Role	Why this one
Argo CD	GitOps reconciler	Git is the single source of truth; every change lands via a reviewed commit. Run as one instance per layer so a fault in one can't cascade. See Architecture.
cert-manager	TLS certificates	Automates ACME issuance and renewal so certificates are never a manual chore.
Sealed Secrets	Secrets in Git	Lets secrets live in a public repo — they're encrypted to an in-cluster key and only the controller can decrypt. See Sealed Secrets.
VictoriaMetrics + VictoriaLogs	Metrics & logs	A lightweight, low-overhead observability stack — far cheaper on a small cluster than the heavier alternatives, with a compatible query surface.
Renovate	Dependency updates	Keeps chart and image versions current via automated PRs, so upgrades are a steady trickle rather than a big-bang. See Renovate.

Backing services¶

openDesk ships development-grade defaults for its datastores; alpstack swaps them for production-grade, separately-operated components:

Need	Component
Relational (HA)	MariaDB Galera and PostgreSQL via operators
Cache / KV	Valkey and Memcached
Object storage (S3)	Garage — a lightweight, self-hosted S3

The workload¶

openDesk — the sovereign-workplace suite (Univention/Keycloak identity, Nextcloud, OpenProject, Collabora, Element/Synapse, mail) — plus standalone add-ons such as NetBird (mesh remote access) and Vaultwarden.