Sounds very cool, and I’m going to be a huge ass and say that could have easily been done with k3s and either flux or argo image watcher.

+1 for terraform at home tho, I do the same and people look at me like I’ve curb stomped their child

I’ve had hit and miss success with OVH. For some reason K3s would fail to install with some weird errors on their infra. This is probably fixed now.

If you intend to use OVH, get familiar with their Openstack UI and then Openstack terraform provider as it makes storing everything in git and state alot easier.

Hetzner I’ve not personally used, but lots of people preach about it.

​

RE K3s. Maybe I suck at english but from what you’re saying it sounds like you want to host the control plane for k3s on prem and have a VPN to the nodes on the cloud? I would avoid this, Kubernetes gets a little funky when high latency, pod status may not be reported properly etc.

If that’s not the case and you have the entire k3s cluster on your cloud provider of choice, then you’ll be fine. One thing to note is Load balancing etc on your own cluster on a cloud provider can get a little tricky, but if you plane to just use kind: service with type: ClusterIP or using nginx ingress or traefik on the lan on the cloud provider, and connect the 2 networks (home and cp) via VPN, you could get away with no fiddly LB.

If you’re not 100% set on k3s and rolling your own k8s, use the cloud providers managed solution, as they make life a little easier with things like storage CSI dirvers and LB controllers.

I hope this helps at all? This was quite a word vomit so sorry if this just ruined everything

For cloudflare tunnels no, it does a nat punch through I think it’s called, where it connects from inside your network out to 2 edge locations to cloudlfare, where it then can send traffic back and forwards.

​

If I wanted to expose by port forwarding, then yes you are correct, I could configure ddns.

Personally, I would configure my own version of DDNS where it’s just a cron job once every 5 minutes to run terraform and check if my public IP has changed, and if it has run an apply.

​

Does that answer the question?

I use it within my Kubernetes to expose services outsides my house, and then I use Azure AD to manage access.

I know this isn’t very self hosted, but for me where I have a dynamic IP and don’t want to play with port forwarding, it’s really good. Nice and easy especially with Kubernetes and the helm chart I wrote