How the homelab models application delivery — the plain Kustomize base/overlay pattern that ships every app today, versus the KubeVela/OAM layer that is installed with two custom TraitDefinitions but zero Applications in Git, and how the two coexist under Flux.
GitOps reconciler running in both clusters — pulls manifests from Gitea (with Codeberg as the documented migration target) and applies them via Kustomize + SOPS decryption.
End-to-end walkthrough of the homelab's GitOps loop — how a single Renovate-opened pull request becomes a digest-pinned container image running in production, touching every layer of the stack along the way.
How secrets are committed encrypted with SOPS and age, which key encrypts what, and how Flux decrypts them in-cluster.
Rotating the in-cluster age key without breaking Flux reconciliation — walk-through of regenerating the key, re-encrypting every committed Secret, and rolling the cluster onto the new key without downtime.
Who proposes an upgrade, who rolls it out and how, for every layer from application images down to hypervisor packages, with the pre-flight checks and the way back.
How the homelab decides whether a workload runs on the Talos production cluster, the Hetzner edge cluster, or a plain Docker host — and how the base/talos/edge overlay pattern in k8s/ encodes that placement decision in Git.