Most homelab builds you're shown run past two thousand euros before the first container starts — a rack, 10-gigabit switching, redundant everything. Genuinely reliable, and out of reach for most of the people it would help. This runs on two second-hand laptops and the electricity they draw. It's a smaller, cheaper setup that anyone can rebuild without a budget.
| service | purpose | exposure | host | backend |
|---|
Every pipeline here shares the same engineering foundation: dependencies baked into the container image so no tooling is installed at job runtime; rootless Podman with layer caching for fast incremental rebuilds without a registry round-trip; Trivy security scans between build and push, failing hard on any HIGH or CRITICAL CVE; Renovate automatically opening PRs to update every version pin; and RustFS (S3-compatible) for all artifact storage — GitHub's free-tier cap is never touched.
The most complex pipeline in the repo. A single YAML recipe source fans out into PDFs (4 languages × 2 formats via Gotenberg), a Flutter mobile app, a Tailwind website, and a Flutter asset bundle — all assembled through RustFS artifact handoffs and published to the homelab registry and Google Play.
Cross-platform pipeline for the Stolpersteine offline memorial app: builds the Flutter Android APK (on a high-memory runner), runs widget tests, and publishes to both the self-hosted downloads server and Google Play on master merges.
Builds and deploys the ci-metrics GitHub Actions run poller: lints and tests the async Python poller, builds and pushes the container, then deploys to the primary host via Ansible on master merges.
Gatekeeper pipeline that runs before any code lands: secret scanning with Gitleaks, Trivy filesystem vulnerability scan, and the full pre-commit suite (ruff, shellcheck, shfmt, hadolint, codespell) inside a dedicated CI image — so no tooling is installed at job runtime.
CI/CD pipeline for the HTMX recipe platform: builds the FastAPI/Python container, runs backend tests and linting inside it, then deploys to the primary host via Ansible on master merges.
Builds and deploys the wall-mounted homescreen kiosk app: lints and unit-tests the Next.js codebase, builds and pushes the container image, then on master rolls the new image out to the container the kiosk actually displays (running on the secondary host).
Builds the Stolpersteine Rust/Axum backend: runs cargo tests, then builds and pushes the container image using sccache with a Podman bind-mount cargo cache for fast incremental Rust compilation.
Provisions both homelab hosts via Ansible: validates playbook syntax and runs a check-mode dry-run on PRs, then applies the full site.yml against the live two-node cluster on master merges — all inside an immutable container image with vault access baked in.
Lean two-job pipeline for the matchmaker API: builds the Node.js/Fastify container, then runs the full test suite inside it — no npm ci at test time because node_modules is baked into the image.
Generates the resume PDF via Gotenberg (a containerised Chrome renderer) and publishes both the PDF and open-data exports to the homelab static server, storing intermediate artifacts in RustFS.
Post-deploy smoke test that runs the verify-cluster.yml Ansible playbook against the live homelab after every master merge, confirming all services are up and reachable from outside the internal network.
| tool | what it does |
|---|