How the homelab models application delivery — the plain Kustomize base/overlay pattern that ships every app today, versus the KubeVela/OAM layer that is installed with two custom TraitDefinitions but zero Applications in Git, and how the two coexist under Flux.
How every backed-up app gets a restic target on Backblaze B2 — the k8up Schedule declares intent, the Crossplane TofuWorkspace composition provisions the bucket and a bucket-scoped application key, and External Secrets fences the one human-managed credential to the workspace namespaces.
Where every certificate in the homelab comes from and how it renews — cert-manager with the all-inkl DNS-01 webhook feeding Envoy Gateway listeners, kubelet-serving-cert-approver closing the node-cert gap, and Talos' own internal PKI underneath it all.
From "production is gone" to "Talos reinstalled, Flux reconciled, persistent data restored" — the documented end-to-end recovery path for the homelab.
Set up, manage, and recover Fedora full-disk encryption with LUKS2 + TPM2 + PIN bound to PCRs 7 and 14, with a passphrase fallback in slot 0.
End-to-end walkthrough of the homelab's GitOps loop — how a single Renovate-opened pull request becomes a digest-pinned container image running in production, touching every layer of the stack along the way.
How an Intel iGPU inside a NUC becomes a schedulable Kubernetes resource — Proxmox PCI passthrough, Talos system extensions, the Intel GPU device plugin, and the transcoding workloads (Jellyfin, FileFlows) that consume it.
Generate and use SSH keys whose private material never leaves a Nitrokey 3 or YubiKey 5, using FIDO2 resident credentials.
The repo's timeline from a three-mini-server K3s cluster with Traefik in 2023 to the SecureBoot Talos generation of 2026 — every major migration, replatforming, and lesson, newest first.
How the homelab's two identity services fit together — LLDAP as the user directory, Keycloak as the OIDC/SAML broker — how every app is wired to the one provider, and what a full SSO login looks like from browser to app.
Who owns what between OpenTofu (everything outside Kubernetes), Ansible (mutable hosts), Talos machine config (the nodes themselves), and Crossplane (external resources whose lifecycle belongs to an app namespace) — and where the handoff boundaries between the four layers sit.
How the homelab layers Kyverno admission policies, Policy Reporter visibility, Tetragon eBPF runtime observability, and Cilium-enforced network policy into one defense-in-depth story — what each layer catches, what is enforced versus audited, and where the deliberate gaps are.
Use PROXY protocol v2 to carry the real client IP through netbird/SNAT and a multi-proxy chain — with Gitea (HTTP + SSH) as a worked example showing both mental models.
How the NetBird WireGuard overlay is woven through every layer of the homelab — the identity-owning Tofu environment, per-site networks and routing peers, workload sidecars, the in-cluster operator, and the two private DNS zones that keep everything reachable without public exposure.
When dependency PRs auto-merge and when they wait for a human — the rules that make the homelab safe to upgrade in its sleep, and the audit trail that catches the inevitable bad week.
Roto Designo i8 roof windows with integrated shutters look like a smart-home dead end at first glance: the windows speak a proprietary Roto radio protocol, and there's no official Home Assistant integration. Every guide points you at a Mediola gateway as the bridge.
Controlling Somfy io-homecontrol shutters from Home Assistant without the cloud, through the cheap official gateway in local mode.
Rotating the in-cluster age key without breaking Flux reconciliation — walk-through of regenerating the key, re-encrypting every committed Secret, and rolling the cluster onto the new key without downtime.
Where live data actually sits in the homelab — the physical disks under it all, how Longhorn carves them into five storage classes with different replica counts and encryption schemes, when an app gets NFS from the TrueNAS instead, and how to pick the right tier for a new workload.
How a container image travels through the homelab — digest pinning in Git, Renovate proposing the bump, CI validating text it never runs, and Spegel + containerd on Talos turning one internet pull into a cluster-wide local copy.
End-to-end walkthrough of the homelab's ingress path — how a browser hitting immich.web.kueber.eu resolves DNS, lands on the Hetzner edge, crosses the NetBird mesh with PROXY protocol v2, terminates TLS on the production Envoy Gateway, and reaches the pod through Cilium.
How a byte written to a Longhorn PVC ends up in three places — warm (Restic to Hetzner and Backblaze), hot (Syncthing to the off-site Synology), cold (encrypted WD Elements drives) — and what it takes to restore from each.
Long-form, cross-cutting deep-dives — articles that don't belong to any one section because they explain something that touches several.
End-to-end trace of every alerting path in the homelab — how a metric threshold, a failed uptime probe, or a policy violation travels from its source through VictoriaMetrics, Gatus, or policy-reporter to a phone via ntfy, an inbox via SMTP, or a dashboard nobody is forced to look at.
How the homelab decides whether a workload runs on the Talos production cluster, the Hetzner edge cluster, or a plain Docker host — and how the base/talos/edge overlay pattern in k8s/ encodes that placement decision in Git.