Where every certificate in the homelab comes from and how it renews — cert-manager with the all-inkl DNS-01 webhook feeding Envoy Gateway listeners, kubelet-serving-cert-approver closing the node-cert gap, and Talos' own internal PKI underneath it all.
From "production is gone" to "Talos reinstalled, Flux reconciled, persistent data restored" — the documented end-to-end recovery path for the homelab.
How an Intel iGPU inside a NUC becomes a schedulable Kubernetes resource — Proxmox PCI passthrough, Talos system extensions, the Intel GPU device plugin, and the transcoding workloads (Jellyfin, FileFlows) that consume it.
Who owns what between OpenTofu (everything outside Kubernetes), Ansible (mutable hosts), Talos machine config (the nodes themselves), and Crossplane (external resources whose lifecycle belongs to an app namespace) — and where the handoff boundaries between the four layers sit.
Three identical ASUS NUC 13 Pro nodes running Talos Linux, racked in a 1.5U tray as the primary Kubernetes cluster.
Immutable, API-driven Linux distribution purpose-built for Kubernetes — running on every node of the production and edge clusters, configured declaratively via Talhelper.
Single source of truth for the on-prem production Kubernetes cluster — hardware, hypervisor, OS, controllers, apps, network, storage, backups, lifecycle.
How a container image travels through the homelab — digest pinning in Git, Renovate proposing the bump, CI validating text it never runs, and Spegel + containerd on Talos turning one internet pull into a cluster-wide local copy.
How the homelab decides whether a workload runs on the Talos production cluster, the Hetzner edge cluster, or a plain Docker host — and how the base/talos/edge overlay pattern in k8s/ encodes that placement decision in Git.