A Kubernetes homelab on one Mac with Rancher, K3s and Lima

Saturday, October 17, 2026

This Kubernetes homelab runs on one Mac: Rancher manages K3s clusters for management, beta and prod, and each cluster is a Lima VM on Apple's Virtualization framework. The map below shows every service in the setup, grouped by layer and by cluster.

Until mid-October, everything behind the GodfreyLabs products ran on one Kubernetes cluster inside Docker Desktop on the same Mac: databases, sign-in, object storage, schedulers, the backends of every site. The plan for leaving was written before the build, in Off Docker Desktop, without stopping anything. Over four days the whole stack moved to the Lima VMs.

The products moved one at a time. elevatedaily.io went first, then eightballsports.com, then paiddaily.io and sagedaily.io, and last the shared platform that all of them depend on. Each product ran in only one place at a time. When the last piece left, Docker Desktop was switched off.

What the management, beta and prod clusters do

The management cluster is the hub. Rancher runs there and manages all three clusters through one UI and one API, with Keycloak for sign-in. Argo CD runs there too. It syncs beta from the beta branch and prod from main, so a merge to either branch starts a deploy to that cluster. Images build on Argo Workflows with BuildKit and go into a private registry. Prometheus, Grafana, Loki and Tempo collect what the other two clusters send. OpenBao holds the secrets. The backup store and Backstage live on the hub as well.

Beta and prod stay lean. They run the products and the data the products need, plus small agents that ship metrics and logs up to the hub. Tools that only an operator looks at stay off the clusters that serve traffic.

Two design decisions apply to every cluster: where the backups are stored, and how the sites reach the internet.

Every cluster backs up into one store, and that store keeps its data in a folder on the Mac itself, outside every VM. If a VM is lost, its backups are still on the Mac.

The sites are published through Cloudflare Tunnel, which dials out from the Mac, so the Mac opens no inbound ports. Cloudflare Access sits in front of the operator surfaces.

The stack, by layer and clusterHover, tap or tab to a service. The red lines show what it talks to.

One Mac, three Linux VMs

FoundationThe VMs, Kubernetes and the control plane that everything else runs on.

All three clusters

Management

DeliveryHow code becomes images, and images become running workloads.

Management

ObservabilityMetrics, logs, traces, alerts, SLOs and cost, collected on the hub.

All three clusters

Beta and Prod

Management

Beta

Security and identityWho can get in, where secrets live, and what is allowed to run.

Beta and Prod

Management

Beta

Prod

DataThe databases and object stores the products and agents use.

Beta and Prod

Management

Prod

Backup and recoveryGetting everything back after a bad day, and proving it with drills.

All three clusters

Management

OperationsPipelines, upgrades and the developer portal that keep it running.

Beta and Prod

Management

Prod

Lima: Runs the three Linux VMs on one Mac with Apple’s Virtualization framework. Each VM is a whole cluster.

K3s: Lightweight Kubernetes in every VM, with a SQLite datastore and a built-in Helm controller.

Rancher: One UI and API over all three clusters. Sign-in goes through Keycloak; a break-glass admin covers the rest.

Fleet: Rancher’s GitOps engine. Here it only delivers Rancher’s own agents to the clusters; Argo CD does the rest.

Traefik: The ingress controller in each cluster. Routes incoming HTTP to the right service.

cert-manager: Issues and renews the TLS certificates used inside the clusters.

Argo CD: The GitOps hub. Keeps beta in step with the beta branch and prod with main; prod syncs only when started by hand.

Argo Workflows: Runs the image build pipelines, one workflow per product image.

BuildKit: Builds the container images inside the workflows, with layer caching.

Registry: The private image registry (CNCF Distribution) that every cluster pulls from.

Prometheus: The metrics hub on Management. Beta and prod run Prometheus agents that write to it.

Alertmanager: Groups, silences and routes alerts to email, including failed backup jobs.

Grafana: Dashboards over the metrics, logs and traces, behind Keycloak sign-in.

Loki: The central log store for every cluster.

Grafana Alloy: The collector on every cluster that ships logs to Loki.

Tempo: The trace store, next to Loki.

OpenTelemetry Operator: Manages OpenTelemetry collectors and auto-instrumentation, trialled on beta first.

Pyrra: Turns SLO definitions into Prometheus rules and burn-rate alerts.

Blackbox Exporter: Uptime probes against the public sites and APIs, from outside the app.

OpenCost: Shows what each namespace and workload costs in CPU and memory.

Keycloak: Single sign-on for the products, Rancher, Grafana and kubectl.

OpenBao: The secrets store, an open-source fork of Vault. The source of truth for app secrets.

External Secrets: Copies secrets from OpenBao into Kubernetes Secrets on beta and prod.

Kyverno: The policy engine: admission rules on what workloads may do.

Falco: Runtime threat detection from kernel events; findings arrive as alerts.

Trivy Operator: Scans the running images and their configuration for known vulnerabilities.

Cloudflare Tunnel: Publishes the sites with no open inbound ports. Cloudflare Access gates the admin hosts.

CloudNativePG: The Postgres operator: failover, nightly base backups and continuous WAL archiving to the backup store.

Postgres: The product databases, one per product, with business logic in stored procedures.

Neo4j: The knowledge graphs behind the agents. Dumped nightly to the backup store.

Redis: Cache and queues for the apps and for Airflow.

MinIO: S3-compatible object storage for the apps’ files.

SeaweedFS: The S3 backup store every cluster writes to. Its data sits in a folder on the Mac, so backups outlive a lost VM.

Velero: Nightly backups of every cluster’s objects and volumes, with Kopia file copies.

Rancher Backup: An encrypted nightly backup of Rancher itself. Drilled on a throwaway VM: back in under a minute.

Apache Airflow: One shared scheduler with a worker per product for the data pipelines.

Backstage: The developer portal: a catalog of every service with its docs.

Reloader: Restarts a workload when its ConfigMap or Secret changes, so new config takes effect.

System Upgrade Controller: Carries out K3s upgrades started from Rancher, one cluster at a time.

Services by layer

The map groups every service by the job it does:

Foundation: the Lima VMs, K3s, Rancher and Fleet, Traefik for ingress, cert-manager for certificates.
Delivery: Argo CD for GitOps, Argo Workflows and BuildKit for image builds, a private registry to hold the images.
Observability: a Prometheus hub with agents on beta and prod, Alertmanager, Grafana, Loki for logs, Grafana Alloy to collect them, Tempo and the OpenTelemetry Operator for traces, Pyrra for SLOs, Blackbox probes that check the sites from outside, and OpenCost to show where the resources go.
Security and identity: Keycloak, OpenBao with External Secrets, Kyverno policies, Falco for runtime alerts, Trivy scans, Cloudflare Tunnel and Access.
Data: Postgres on CloudNativePG, Neo4j, Redis, MinIO, and SeaweedFS as the backup store.
Backup and recovery: Velero every night with Kopia, Rancher Backup, and K3s control-plane snapshots.
Operations: one shared Airflow scheduler with a worker per product, Backstage as the catalog, Reloader to restart pods when their config changes, and System Upgrade Controller for K3s upgrades.

Backups and the restore drill

Velero backs up the clusters every night, with Kopia moving the data. Rancher Backup saves Rancher's own state, and K3s takes snapshots of its control plane. All of these backups go to the SeaweedFS store on the management cluster, which writes to a folder on the Mac outside the VMs. A Rancher restore was tested on a throwaway VM, and Rancher came back in under a minute.

What the homelab costs

The setup added no new spend. Every piece is open source and runs on hardware that was already owned. The costs are memory and disk on one machine, and the time it takes to learn how the pieces fit together.

Hover any service on the map for a short summary and a link to its resource page. Some of those pages are still being written.

A Kubernetes homelab on one Mac with Rancher, K3s and Lima

What the management, beta and prod clusters do

Services by layer

Backups and the restore drill

What the homelab costs

Continue reading

Off Docker Desktop, without stopping anything

Code got cheap. Shipping it shouldn't be the bottleneck.

Where the model runs