Where every certificate in the homelab comes from and how it renews — cert-manager with the all-inkl DNS-01 webhook feeding Envoy Gateway listeners, kubelet-serving-cert-approver closing the node-cert gap, and Talos' own internal PKI underneath it all.
Kubernetes Gateway API implementation backed by Envoy Proxy.
Shared cluster resource that defines the internal `HTTPRoute` parent — the Gateway that internal-only apps attach to so their hostnames resolve on the home/mesh side without ever being routed publicly.
How the homelab's three identity services fit together — LLDAP as the user directory, Keycloak as the OIDC/SAML broker, Pocket ID as the passkey-first provider — which apps authenticate against which, and what a full SSO login looks like from browser to app.
Use PROXY protocol v2 to carry the real client IP through netbird/SNAT and a multi-proxy chain — with Gitea (HTTP + SSH) as a worked example showing both mental models.
End-to-end walkthrough of the homelab's ingress path — how a browser hitting immich.web.kueber.eu resolves DNS, lands on the Hetzner edge, crosses the NetBird mesh with PROXY protocol v2, terminates TLS on the production Envoy Gateway, and reaches the pod through Cilium.