How to Set Up a Home Lab for Learning DevOps in 2026

# After install — disable subscription nag (optional)
sed -i.bak "s/NotFound/Active/" /etc/apt/sources.list.d/pve-enterprise.list || true
echo "deb http://download.proxmox.com/debian/pve bookworm pve-no-subscription"   >> /etc/apt/sources.list.d/pve-no-subscription.list
apt-get update && apt-get dist-upgrade -y

# Install Docker Engine (official method)
curl -fsSL https://get.docker.com | sh

# Add your user to docker group (avoid sudo)
usermod -aG docker $USER
newgrp docker

# Install Docker Compose v2 (built-in plugin)
apt-get install -y docker-compose-plugin

# Verify
docker --version          # Docker version 27.x
docker compose version    # Docker Compose version v2.x

# docker-compose.yml — Nginx + Portainer (container management UI)
services:
  portainer:
    image: portainer/portainer-ce:latest
    restart: always
    ports:
      - "9000:9000"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - portainer_data:/data

  nginx:
    image: nginx:alpine
    restart: always
    ports:
      - "80:80"
    volumes:
      - ./html:/usr/share/nginx/html:ro

volumes:
  portainer_data:

docker compose up -d
# Access Portainer at http://YOUR_IP:9000

# On k3s-master VM:
curl -sfL https://get.k3s.io | sh -

# Get the join token for worker nodes
cat /var/lib/rancher/k3s/server/node-token

# On each k3s-worker VM (replace with your master IP and token):
export K3S_MASTER_IP="192.168.1.100"
export K3S_TOKEN="your-token-here"
curl -sfL https://get.k3s.io | K3S_URL="https://${K3S_MASTER_IP}:6443"   K3S_TOKEN="${K3S_TOKEN}" sh -

# On master — verify cluster
kubectl get nodes
# NAME           STATUS   ROLES                  AGE   VERSION
# k3s-master     Ready    control-plane,master   1m    v1.31.x
# k3s-worker-1   Ready    <none>                 45s   v1.31.x
# k3s-worker-2   Ready    <none>                 30s   v1.31.x

# nginx-deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:alpine
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: nginx-service
spec:
  type: LoadBalancer
  selector:
    app: nginx
  ports:
  - port: 80
    targetPort: 80

kubectl apply -f nginx-deployment.yaml
kubectl get pods -o wide    # see pods spread across worker nodes
kubectl get svc nginx-service  # get the external IP

# docker-compose.yml on the 'gitea' VM
services:
  gitea:
    image: gitea/gitea:latest
    environment:
      - USER_UID=1000
      - USER_GID=1000
    restart: always
    ports:
      - "3000:3000"   # Web UI
      - "222:22"      # SSH git
    volumes:
      - gitea_data:/data

  woodpecker-server:
    image: woodpeckerci/woodpecker-server:latest
    restart: always
    ports:
      - "8080:8000"
    environment:
      - WOODPECKER_OPEN=true
      - WOODPECKER_GITEA=true
      - WOODPECKER_GITEA_URL=http://gitea:3000
      - WOODPECKER_AGENT_SECRET=supersecret123
    depends_on:
      - gitea

  woodpecker-agent:
    image: woodpeckerci/woodpecker-agent:latest
    restart: always
    environment:
      - WOODPECKER_SERVER=woodpecker-server:9000
      - WOODPECKER_AGENT_SECRET=supersecret123
      - WOODPECKER_BACKEND=docker
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    depends_on:
      - woodpecker-server

volumes:
  gitea_data:

# .woodpecker.yml — in your app repo
steps:
  test:
    image: python:3.12-slim
    commands:
      - pip install -r requirements.txt
      - python -m pytest tests/ -v

  build:
    image: docker
    commands:
      - docker build -t myapp:$CI_COMMIT_SHA .
    when:
      branch: main

  deploy:
    image: bitnami/kubectl:latest
    commands:
      - kubectl set image deployment/myapp myapp=myapp:$CI_COMMIT_SHA
    when:
      branch: main

# Install Helm
curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash

# Add Prometheus community charts
helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm repo update

# Install the full monitoring stack (Prometheus + Grafana + Alertmanager)
helm install monitoring prometheus-community/kube-prometheus-stack   --namespace monitoring --create-namespace   --set grafana.adminPassword=admin123

# Access Grafana
kubectl port-forward -n monitoring svc/monitoring-grafana 3000:80
# Browse to http://localhost:3000 (admin / admin123)

# Install Traefik via Helm
helm repo add traefik https://helm.traefik.io/traefik
helm install traefik traefik/traefik   --namespace traefik --create-namespace

# IngressRoute for Gitea (Traefik CRD)
apiVersion: traefik.containo.us/v1alpha1
kind: IngressRoute
metadata:
  name: gitea
  namespace: default
spec:
  entryPoints:
    - web
  routes:
    - match: Host(`gitea.lab.local`)
      kind: Rule
      services:
        - name: gitea
          port: 3000