How the homelab models application delivery — the plain Kustomize base/overlay pattern that ships every app today, versus the KubeVela/OAM layer that is installed with two custom TraitDefinitions but zero Applications in Git, and how the two coexist under Flux.
How every backed-up app gets a restic target on Backblaze B2 — the k8up Schedule declares intent, the Crossplane TofuWorkspace composition provisions the bucket and a bucket-scoped application key, and External Secrets fences the one human-managed credential to the workspace namespaces.
Where every certificate in the homelab comes from and how it renews — cert-manager with the all-inkl DNS-01 webhook feeding Envoy Gateway listeners, kubelet-serving-cert-approver closing the node-cert gap, and Talos' own internal PKI underneath it all.
From "production is gone" to "Talos reinstalled, Flux reconciled, persistent data restored" — the documented end-to-end recovery path for the homelab.
End-to-end walkthrough of the homelab's GitOps loop — how a single Renovate-opened pull request becomes a digest-pinned container image running in production, touching every layer of the stack along the way.
How an Intel iGPU inside a NUC becomes a schedulable Kubernetes resource — Proxmox PCI passthrough, Talos system extensions, the Intel GPU device plugin, and the transcoding workloads (Jellyfin, FileFlows) that consume it.
How the homelab's three identity services fit together — LLDAP as the user directory, Keycloak as the OIDC/SAML broker, Pocket ID as the passkey-first provider — which apps authenticate against which, and what a full SSO login looks like from browser to app.
Who owns what between OpenTofu (everything outside Kubernetes), Ansible (mutable hosts), Talos machine config (the nodes themselves), and Crossplane (external resources whose lifecycle belongs to an app namespace) — and where the handoff boundaries between the four layers sit.
How the homelab layers Kyverno admission policies, Policy Reporter visibility, Tetragon eBPF runtime observability, and Cilium-enforced network policy into one defense-in-depth story — what each layer catches, what is enforced versus audited, and where the deliberate gaps are.
How the NetBird WireGuard overlay is woven through every layer of the homelab — the identity-owning Tofu environment, per-site networks and routing peers, workload sidecars, the in-cluster operator, and the two private DNS zones that keep everything reachable without public exposure.
When dependency PRs auto-merge and when they wait for a human — the rules that make the homelab safe to upgrade in its sleep, and the audit trail that catches the inevitable bad week.
Rotating the in-cluster age key without breaking Flux reconciliation — walk-through of regenerating the key, re-encrypting every committed Secret, and rolling the cluster onto the new key without downtime.
Where live data actually sits in the homelab — the physical disks under it all, how Longhorn carves them into five storage classes with different replica counts and encryption schemes, when an app gets NFS from the TrueNAS instead, and how to pick the right tier for a new workload.
How a container image travels through the homelab — digest pinning in Git, Renovate proposing the bump, CI validating text it never runs, and Spegel + containerd on Talos turning one internet pull into a cluster-wide local copy.
End-to-end walkthrough of the homelab's ingress path — how a browser hitting immich.web.kueber.eu resolves DNS, lands on the Hetzner edge, crosses the NetBird mesh with PROXY protocol v2, terminates TLS on the production Envoy Gateway, and reaches the pod through Cilium.
How a byte written to a Longhorn PVC ends up in three places — warm (Restic to Hetzner S3), hot (Syncthing to the off-site Synology), cold (encrypted WD Elements drives) — and what it takes to restore from each.
Long-form, cross-cutting deep-dives — articles that don't belong to any one section because they explain something that touches several.
End-to-end trace of every alerting path in the homelab — how a metric threshold, a failed uptime probe, or a policy violation travels from its source through VictoriaMetrics, Gatus, or policy-reporter to a phone via ntfy, an inbox via SMTP, or a dashboard nobody is forced to look at.
How the homelab decides whether a workload runs on the Talos production cluster, the Hetzner edge cluster, or a plain Docker host — and how the base/talos/edge overlay pattern in k8s/ encodes that placement decision in Git.