docs

How kien/stack works

One installer, three packs, everything driven from Git. Each pack adds a layer on top of the previous one.

Overview

All-In-OnePrometheus · Grafana · Authentik SSO · SeaweedFS S3 · Radar · Argo Rollouts · image-updater · Renovate · app-template · Terraformpaid

Private AIOnyx · Ollama · LiteLLM · OpenClaw · Coderpaid

StarterArgoCD · Traefik · cert-manager · external-dns · Infisical + External Secrets · CloudNativePG · OpenEBS · metrics-serverfree

Your clusterk3s · EKS · GKE · AKS · Scaleway · OVH · minikube (Cilium on k3s / bare metal)you bring

Every component is open source and installed from its upstream Helm chart, at a pinned version. ArgoCD owns all of them, including itself.

GitOps workflow

You edit stack.yaml or a values file
git push to your repo
ArgoCD detects the change
Cluster converges, drift is reverted

Single source of truth: stack.yaml selects the pack, domain, TLS issuer, DNS provider and AI providers.
App of apps: one root platform Application generates one Application per component, ordered by sync waves.
Secrets never in Git: stored in Infisical, synced into Kubernetes by External Secrets.

Starter free

DNS (external-dns)
Traefik + TLS (cert-manager)
Your apps
Postgres (CNPG) · secrets (Infisical)

Ingress: Traefik, automatic HTTPS (self-signed, Let's Encrypt HTTP-01 or DNS-01).
Data: CloudNativePG operator for HA Postgres with backups.
Needs: 2 vCPU / 6 GB RAM (8 GB recommended). No load balancer at home? With Cilium, set ingress.ciliumLB to a free IP range of your LAN: Traefik gets a real LoadBalancer IP announced in L2, no MetalLB needed.
Optional Cilium: optional.cilium: true installs Cilium first (eBPF CNI, replaces kube-proxy) on a bare cluster, e.g. k3s without flannel.
No domain? Leave domain empty: you get <ip>.sslip.io addresses with self-signed certificates.

Private AI paid

User asks in Onyx
Onyx searches your indexed docs
LiteLLM routes the prompt
Ollama (local) or Anthropic / Gemini / Bedrock

Onyx: chat + RAG over your documents (OpenSearch index, connectors).
LiteLLM: one OpenAI-compatible gateway for local and cloud models.
OpenClaw: AI agent wired to LiteLLM. Coder: cloud dev environments.
Data stays home with Ollama; external providers are opt-in, under your own account.
Needs: 8 vCPU / 24 GB RAM, NVIDIA GPU recommended.

All-In-One paid

Renovate / image-updater bump a version
Commit in Git
ArgoCD syncs
Argo Rollouts canary

Observability: Prometheus, Grafana dashboards and alerts for every component.
SSO: Authentik (OIDC) for your platform tools.
app-template: one Helm chart to deploy any app from a values file (Deployment, StatefulSet, CronJob, Service, Ingress + TLS, secrets), with a ready-to-copy ArgoCD example.
S3 storage: SeaweedFS, S3-compatible buckets for backups (CNPG), artifacts and apps.
Radar: Kubernetes UI with resources, topology, timeline, Helm and GitOps (ArgoCD) views. Read-only by default, private until you put SSO in front.
Terraform: creates an EKS cluster (VPC on 3 AZs, gp3) and runs the installer.

Radar dashboard: pods, deployments, nodes, resource usage, topology, timeline and active issues of the cluster — Radar, included in All-In-One: a live view of your cluster.

Install

cp stack.example.yaml stack.yaml   # pack, domain, providers
./install.sh doctor                # checks tools, cluster, resources
./install.sh install --pack starter

The installer bootstraps ArgoCD with Helm, registers your Git repo, then hands everything over to ArgoCD and waits until all apps are Healthy.

Updates

Releases are versioned (v1.2.0); component versions are pinned in one file.
To upgrade: pull the new tag into your repo; ArgoCD applies it. The changelog flags breaking changes.

Questions? See the packs or order.