homelab VS firewalla

k8s is a lot easier for homelabs than it used to be, and imo it's quicker than nix for building a declarative homelab. templates like this one can deploy a cluster in a few hours: https://github.com/onedr0p/cluster-template

here's my home assistant deployment as a single file: https://github.com/pl4nty/homelab/blob/main/kubernetes/clust...

I deliberately nuked my onprem cluster a few weeks ago, and was fully restored within 2 hours (including host OS reinstalls). and most of that was waiting for backup restores over my slow internet connection

Can't talk about work, but my homelab is Azure and Oracle managed k8s (AKS/OKE), with onprem Talos soon (Turing Pi 2). My Flux monorepo has the details. OKE performs noticably worse (update cycle, features, control plane performance), but it provides 4 ARM cores and 24GB RAM free so I can't complain

Here's my cluster's IaC if you want to take a look, it's pretty optimised for web services though. It's all Linux too - I've attempted Windows containers but Windows apps don't often handle state well

It's been a good way to test ARM before I build a Pi cluster. My manifests and container builder are public if you want to take a look. I use a base layer for networking and observability, so it's easy to move stateless workloads, but I still need to sort out volume replication/backups

firewalla is open source https://github.com/firewalla/firewalla

Just to follow up because I think I misread OP—they’re looking at Firewalla who publishes their source on github, and it looks a lot like your classic FOSS firewall running suricata and probably doing DNS-based filtering. I bet if you dig into their source you’ll find dnscryptproxy, unbound, or dnsmasq with filter sets.

Using the Firewalla VPN Client for a 3rd party connection is one way. What this means is that devices on your network can initiate connections through the VPN to external addresses, and those external addresses can respond and make use of the established connection (ex: your machine uses a browser to request the webpage https://help.firewalla.com through the vpn connection, and the server hosting the webpage receives the request and is able to respond, by sending the requested webpage)

search https://help.firewalla.com you will find more articles on this topic. And if not, the communitly likely have more https://help.firewalla.com/hc/en-us/community/topics/360001948014-Expanding-Firewalla-Docker-Third-Party-Apps-Scripts-

there are a few threads https://help.firewalla.com like this https://help.firewalla.com/hc/en-us/community/posts/4411622449811-Omada-Controller-Docker

From my understanding zeek does the inspection (probably not https / tls ) and generates alerts (internally) which Firewallas software (https://github.com/firewalla/firewalla) picks up and analyses then throws out alerts / blocks as they see fit.

Technically yes, but also maybe no. Firewalla's software is open source. You can download and modify it on GitHub. If you really wanted to, you could fork it and strip out all of the firewalla-specific code (ie licensing, app integration, etc.) and replace it with your own code.