Everything else is on a separate server running Fedora. I used to run applications inside k3s, but got tired of the constant 10% CPU usage from the control plane trying to keep track of its state. Also didn't like that the containers I used weren't being rebuilt for security updates in packages (eg. openssl). Now, I just use plain old RPMs inside VMs.
The stuff I run:
* [Host] ssh: For CLI access and git hosting (just `git init --bare`; no fancy UIs like Gitea or Gitlab).
* [Host] samba: For all file access.
* [Host] zrepl: For zfs snapshot replication.
* [Host] syncthing: For syncing KeePass databases. Also for syncing pictures from my phone.
* [VM] jellyfin: For easy access to rips of my physical media collection. VFIO is very unstable with the 13th gen iGPU on my hardware, so I custom ffmpeg wrapper that SSH's back into the host for remote transcoding in a bwrap sandbox.
* [VM] pdns-auth + dnsdist: The powerdns authoritative server handles the internal DNS. I have DNSSEC set up and SSHFP records for everything, so I don't need to worry about ~/.ssh/known_hosts. All of my computers that rely on this run systemd-resolved and do the DNSSEC validation locally. I run a daemon [2] on every host, which handles pushing new A/AAAA records via TSIG signed updates to the DNS server.
dnsdist acts as a proxy which only allows access to the specific TXT record needed for ACME DNS challenges originating from Let's Encrypt's IP addresses. I may switch to a custom CA in the future when the name contraints x509 extension is better supported (so that a custom CA wouldn't be able to issue trusted certificates for domains that aren't mine).
* [VM] miniflux: For RSS.
* [VM] unifi-controller: For managing Ubiquiti wireless APs.