Migrating 19 Services to a
Tailscale-Private K3s Cluster

Migrate 19 self-hosted services from Docker Compose to a 2-node k3s cluster, where:

1. Both nodes are Tailscale-only — zero public ports on the new node
2. Orchestration happens from one box — this server is the mission control
3. The cluster doubles as a CKA exam lab — covers ~80% of exam domains
4. Risk is minimized — Docker Compose keeps running in parallel throughout

This is a Project Level Up Javid deliverable — career dev, not just sysadmin.

┌──────────────────────────────────────────────────────────────────┐
│                TAILNET (100.64.0.0/10, encrypted mesh)            │
│                                                                   │
│    ┌────────────────────────────┐  ┌──────────────────────────┐    │
│    │  THIS BOX                  │  │  NEW NODE                │    │
│    │  (worker-1)                │  │  (control-plane-1)       │    │
│    │                            │  │                          │    │
│    │  • 19 Docker services      │  │  • k3s control-plane    │    │
│    │  • k3s agent (worker)      │◄─┤  • etcd (single node)   │    │
│    │  • kubectl → remote API    │  │  • No public ingress    │    │
│    │  • Mission control hub     │  │  • Tailscale-only access │    │
│    └────────────────────────────┘  └──────────────────────────┘    │
│                                                                   │
│  Tailscale ACL: tag:k3s-worker can SSH to tag:k3s-cp             │
│  Only admins can claim these tags                                │
└──────────────────────────────────────────────────────────────────┘

The single most important property of this plan: Docker Compose keeps running in parallel throughout.

At any point, if k3s fails:

ssh cp-1 "sudo systemctl stop k3s"     # 30 seconds
sudo systemctl stop k3s-agent            # 10 seconds
docker compose ps                         # all 19 services STILL HEALTHY

That's it. Zero data loss. Five minutes total.

This is what makes the plan risk-free: every k3s experiment is reversible in less time than it takes to make a coffee.

My recommendation: Old laptop or Pi 5. CKA exam is 100% software — it doesn't care about cloud vs. bare metal.

Path A+ is the lowest-cost option that still gives production-grade multi-node k3s experience.

A hiring manager reading this case study sees:

1. Real migration experience — not a tutorial, actual production code
2. Risk management thinking — rollback strategy, parallel run, phased rollout
3. Modern infrastructure choices — Tailscale mesh, Longhorn storage, GitOps-ready
4. Cost-conscious engineering — Path A+ beats Contabo + EKS by ~90%
5. Career alignment — directly maps to CKA cert + Senior PE job tier

This is the difference between "I have a homelab" and "I run a production-grade platform."

The narrative for hiring managers:

"I migrated 19 production services from Docker Compose to k3s, with multi-node HA, Tailscale CNI, Longhorn replicated storage, and a 5-minute rollback strategy — using only Tailscale for node-to-node networking. $0 cost. Covers ~80% of CKA exam domains."

That's a senior-tier story, not a junior story.

The migration is successful when:

• All 19 services running in k3s (excluding crowdsec on host)
• Zero downtime longer than 60 min for any service during migration
• Rollback tested and works in <5 min
• CKA exam passed (target: Q2 2027)
• Blog post published: "Migrating 19 services from Docker Compose to k3s"
• Cluster IDP/Backstage layer added (Phase 6)