4 docs tagged with "opentofu"

The IaC + cluster-bootstrap layer that turns hardware and the network fabric into a running Kubernetes cluster — Proxmox, Hetzner, Talos, Flux, OpenTofu, Ansible.

Who owns what between OpenTofu (everything outside Kubernetes), Ansible (mutable hosts), Talos machine config (the nodes themselves), and Crossplane (external resources whose lifecycle belongs to an app namespace) — and where the handoff boundaries between the four layers sit.

OpenTofu workflow that provisions everything outside Kubernetes — Hetzner edge VMs, Proxmox production VMs, UniFi home network, and the NetBird overlay.

How the NetBird WireGuard overlay is woven through every layer of the homelab — the identity-owning Tofu environment, per-site networks and routing peers, workload sidecars, the in-cluster operator, and the two private DNS zones that keep everything reachable without public exposure.