How the homelab models application delivery — the plain Kustomize base/overlay pattern that ships every app today, versus the KubeVela/OAM layer that is installed with two custom TraitDefinitions but zero Applications in Git, and how the two coexist under Flux.
Where every certificate in the homelab comes from and how it renews — cert-manager with the all-inkl DNS-01 webhook feeding Envoy Gateway listeners, kubelet-serving-cert-approver closing the node-cert gap, and Talos' own internal PKI underneath it all.
GitOps reconciler running in both clusters — pulls manifests from Gitea (with Codeberg as the documented migration target) and applies them via Kustomize + SOPS decryption.
End-to-end walkthrough of the homelab's GitOps loop — how a single Renovate-opened pull request becomes a digest-pinned container image running in production, touching every layer of the stack along the way.
What to look at first when something is down — locating the fault, the first action for every alert the cluster can raise, and where each subsystem's failure table lives.
Legacy lightweight Kubernetes distribution that ran on the AMD Athlon mini-server cluster. Retired and replaced by the Talos cluster on the Intel NUCs. Kept here as historical reference.
Draining, rebooting and replacing Talos nodes on the production cluster without losing Longhorn replicas, including the order that keeps the iGPU and the disk encryption happy.
How the homelab layers Kyverno admission policies, Policy Reporter visibility, Tetragon eBPF runtime observability, and Cilium-enforced network policy into one defense-in-depth story — what each layer catches, what is enforced versus audited, and where the deliberate gaps are.
Ad-hoc dumps and restores against a CloudNativePG cluster, and the full restore of a database from a k8up Restic snapshot.
Use PROXY protocol v2 to carry the real client IP through netbird/SNAT and a multi-proxy chain — with Gitea (HTTP + SSH) as a worked example showing both mental models.
How the NetBird WireGuard overlay is woven through every layer of the homelab — the identity-owning Tofu environment, per-site networks and routing peers, workload sidecars, the in-cluster operator, and the two private DNS zones that keep everything reachable without public exposure.
Where live data actually sits in the homelab — the physical disks under it all, how Longhorn carves them into five storage classes with different replica counts and encryption schemes, when an app gets NFS from the TrueNAS instead, and how to pick the right tier for a new workload.
Four Intel NUC hosts — three ASUS NUC 13 Pro and one NUC 14 — running Proxmox VE with the Talos control-plane and worker VMs of the primary Kubernetes cluster.
Immutable, API-driven Linux distribution purpose-built for Kubernetes — running on every node of the production and edge clusters, configured declaratively via topf.
How a container image travels through the homelab — digest pinning in Git, Renovate proposing the bump, CI validating text it never runs, and Spegel + containerd on Talos turning one internet pull into a cluster-wide local copy.
Who proposes an upgrade, who rolls it out and how, for every layer from application images down to hypervisor packages, with the pre-flight checks and the way back.
End-to-end trace of every alerting path in the homelab — how a metric threshold, a failed uptime probe, or a policy violation travels from its source through VictoriaMetrics, Gatus, or policy-reporter to a phone via ntfy, an inbox via SMTP, or a dashboard nobody is forced to look at.
How the homelab decides whether a workload runs on the Talos production cluster, the Hetzner edge cluster, or a plain Docker host — and how the base/talos/edge overlay pattern in k8s/ encodes that placement decision in Git.