How the homelab models application delivery — the plain Kustomize base/overlay pattern that ships every app today, versus the KubeVela/OAM layer that is installed with two custom TraitDefinitions but zero Applications in Git, and how the two coexist under Flux.
Where every certificate in the homelab comes from and how it renews — cert-manager with the all-inkl DNS-01 webhook feeding Envoy Gateway listeners, kubelet-serving-cert-approver closing the node-cert gap, and Talos' own internal PKI underneath it all.
Backup and restore recipes for in-cluster PostgreSQL using kubectl, pg_dump, and psql.
Step-by-step guide to restoring a PostgreSQL database dump into a CloudNativePG cluster using k8up, Restic snapshots, and pv for streamed progress.
GitOps reconciler running in both clusters — pulls manifests from Gitea (with Codeberg as the documented migration target) and applies them via Kustomize + SOPS decryption.
End-to-end walkthrough of the homelab's GitOps loop — how a single Renovate-opened pull request becomes a digest-pinned container image running in production, touching every layer of the stack along the way.
Legacy lightweight Kubernetes distribution that ran on the AMD Athlon mini-server cluster. Retired and replaced by the Talos cluster on the Intel NUCs. Kept here as historical reference.
How the homelab layers Kyverno admission policies, Policy Reporter visibility, Tetragon eBPF runtime observability, and Cilium-enforced network policy into one defense-in-depth story — what each layer catches, what is enforced versus audited, and where the deliberate gaps are.
Use PROXY protocol v2 to carry the real client IP through netbird/SNAT and a multi-proxy chain — with Gitea (HTTP + SSH) as a worked example showing both mental models.
How the NetBird WireGuard overlay is woven through every layer of the homelab — the identity-owning Tofu environment, per-site networks and routing peers, workload sidecars, the in-cluster operator, and the two private DNS zones that keep everything reachable without public exposure.
Where live data actually sits in the homelab — the physical disks under it all, how Longhorn carves them into five storage classes with different replica counts and encryption schemes, when an app gets NFS from the TrueNAS instead, and how to pick the right tier for a new workload.
Three identical ASUS NUC 13 Pro nodes running Talos Linux, racked in a 1.5U tray as the primary Kubernetes cluster.
Immutable, API-driven Linux distribution purpose-built for Kubernetes — running on every node of the production and edge clusters, configured declaratively via Talhelper.
How a container image travels through the homelab — digest pinning in Git, Renovate proposing the bump, CI validating text it never runs, and Spegel + containerd on Talos turning one internet pull into a cluster-wide local copy.
End-to-end trace of every alerting path in the homelab — how a metric threshold, a failed uptime probe, or a policy violation travels from its source through VictoriaMetrics, Gatus, or policy-reporter to a phone via ntfy, an inbox via SMTP, or a dashboard nobody is forced to look at.
How the homelab decides whether a workload runs on the Talos production cluster, the Hetzner edge cluster, or a plain Docker host — and how the base/talos/edge overlay pattern in k8s/ encodes that placement decision in Git.
Reusable Kustomize component that bootstraps an app's namespace — Namespace resource, RBAC stub, ServiceAccount, and the labels every other component expects.