Where every certificate in the homelab comes from and how it renews — cert-manager with the all-inkl DNS-01 webhook feeding Envoy Gateway listeners, kubelet-serving-cert-approver closing the node-cert gap, and Talos' own internal PKI underneath it all.
From "production is gone" to "Talos reinstalled, Flux reconciled, persistent data restored" — the documented end-to-end recovery path for the homelab.
How an Intel iGPU inside a NUC becomes a schedulable Kubernetes resource — Proxmox PCI passthrough, Talos system extensions, the Intel GPU device plugin, and the transcoding workloads (Jellyfin, FileFlows) that consume it.
Who owns what between OpenTofu (everything outside Kubernetes), Ansible (mutable hosts), Talos machine config (the nodes themselves), and Crossplane (external resources whose lifecycle belongs to an app namespace) — and where the handoff boundaries between the four layers sit.
Draining, rebooting and replacing Talos nodes on the production cluster without losing Longhorn replicas, including the order that keeps the iGPU and the disk encryption happy.
Four Intel NUC hosts — three ASUS NUC 13 Pro and one NUC 14 — running Proxmox VE with the Talos control-plane and worker VMs of the primary Kubernetes cluster.
Immutable, API-driven Linux distribution purpose-built for Kubernetes — running on every node of the production and edge clusters, configured declaratively via topf.
Single source of truth for the on-prem production Kubernetes cluster — hardware, hypervisor, OS, controllers, apps, network, storage, backups, lifecycle.
How a container image travels through the homelab — digest pinning in Git, Renovate proposing the bump, CI validating text it never runs, and Spegel + containerd on Talos turning one internet pull into a cluster-wide local copy.
Who proposes an upgrade, who rolls it out and how, for every layer from application images down to hypervisor packages, with the pre-flight checks and the way back.
How the homelab decides whether a workload runs on the Talos production cluster, the Hetzner edge cluster, or a plain Docker host — and how the base/talos/edge overlay pattern in k8s/ encodes that placement decision in Git.