My own infrastructure: thirteen applications deploy with a git commit
My own cluster where my projects live: applications are described as packages, deploy automatically from the repository, secrets are stored encrypted next to the code. The value is direct: infrastructure I hand over can be maintained without me.
Context
My projects — kopim, this website, n8n automations and utility services — live on my own cluster. The goal: everything deploys, updates and recovers from the repository, not from one person’s memory.
What was built
Everything is in git. Thirteen applications, each with its own Helm chart and its own ArgoCD entry. A root application picks up the rest: adding a new one takes a commit, with no manual commands in the cluster. Manual edits in the cluster are reverted by ArgoCD to what the repository says.
Hands-off deploys. An application build publishes an image tagged with the commit and bumps the tag in the infrastructure repository itself; ArgoCD notices and rolls it out. A rollback is reverting that commit. This website, kopim and two more applications update this way: 179 commits in the history were made by the CI bot.
Secrets next to the code. Secret files live in the repository encrypted (SOPS + age) and are decrypted by a separate script at install time. ArgoCD never sees the keys, and the private key is not stored in the cluster.
Backups. Databases are dumped every night and kept for 30 days; a separate n8n workflow encrypts fresh dumps, moves them outside the cluster and warns when a dump is missing. There is a break-glass bundle and a step-by-step guide for the day the cluster has to be rebuilt from scratch.
The external server is code too. The external server only accepts HTTPS and forwards traffic into the cluster, and each application gets only its own way in. The server setup lives in a separate repository so it can be rebuilt at a new address.
Scale: 287 commits in the cluster repository from May to September 2026, 13 charts, 25 utility scripts.
