Three-node Kubernetes home lab on Debian 13

This series builds a small Kubernetes platform that is intentionally easy to reason about. Its control plane survives one node failure; PostgreSQL and object storage do not. Their safety comes from local durable disks, Git-declared configuration, and tested off-cluster SFTP restores.

What you will learn

By the end of this series, you will be able to:

• Operate a three-server K3s cluster on bare-metal Debian 13.
• Deliver cluster and application changes from GitHub with Flux and SOPS-encrypted secrets.
• Separate public Cloudflare-Tunnel routes from LAN-only ingress.
• Run one shared PostgreSQL service and one Garage S3-compatible object service with a recoverable SFTP backup plan.
• Schedule NVIDIA GPU workloads deliberately and observe the cluster, storage, backups, and GPU.

Who this is for

This is for a home-lab operator comfortable with SSH, Git, Linux packages, IP addressing, and basic DNS. It assumes no prior Kubernetes administration. It does not teach multi-tenant security, Internet-facing Kubernetes API access, or database high availability.

Before you begin

Prepare the following before Step 1:

• Three x86_64 Debian 13 machines with static DHCP reservations or static addresses, reliable wired networking, and SSD/NVMe storage. One has a discrete NVIDIA GPU.
• A fourth machine or remote service running SFTP, with enough capacity for retained backups. It must not be on the same disk, host, or power circuit as the cluster.
• A GitHub account and a new private repository such as homelab-gitops.
• A Cloudflare-managed domain for public sites. Internal-only services require no public DNS.
• A LAN address range reserved for MetalLB that is outside DHCP, for example 192.168.50.240-192.168.50.250.
• A workstation with ssh, git, kubectl, helm, flux, sops, age, and rclone.

Use the example names and replace values consistently:

Series steps

Each focused session takes approximately 30 to 40 minutes.

1. Plan the cluster and prepare Debian hosts
2. Harden access and establish node baselines
3. Create the three-server K3s control plane
4. Add local storage placement and LAN ingress
5. Bootstrap GitHub GitOps and encrypted secrets
6. Expose only public applications through Cloudflare
7. Deploy shared PostgreSQL and prove it can be restored
8. Deploy Garage object storage and back up buckets
9. Make the NVIDIA GPU node available on purpose
10. Observe the platform and rehearse recovery

Keep the cheat sheet nearby once the platform is running.

Key resources

• K3s high-availability embedded etcd
• Flux bootstrap
• Cloudflare Tunnel on Kubernetes
• pgBackRest SFTP support
• Garage source and documentation
• NVIDIA GPU Operator