How the homelab models application delivery — the plain Kustomize base/overlay pattern that ships every app today, versus the KubeVela/OAM layer that is installed with two custom TraitDefinitions but zero Applications in Git, and how the two coexist under Flux.
GitOps reconciler running in both clusters — pulls manifests from Gitea (with Codeberg as the documented migration target) and applies them via Kustomize + SOPS decryption.
End-to-end walkthrough of the homelab's GitOps loop — how a single Renovate-opened pull request becomes a digest-pinned container image running in production, touching every layer of the stack along the way.
Encrypt Kubernetes secrets at rest with Mozilla SOPS and age, decrypt them in-cluster via the Flux SOPS provider.
Rotating the in-cluster age key without breaking Flux reconciliation — walk-through of regenerating the key, re-encrypting every committed Secret, and rolling the cluster onto the new key without downtime.
How the homelab decides whether a workload runs on the Talos production cluster, the Hetzner edge cluster, or a plain Docker host — and how the base/talos/edge overlay pattern in k8s/ encodes that placement decision in Git.