Topics

Long-form deep-dives. The pages here explain something that touches several layers of the stack at once — they don't fit into apps, platform, foundation, or fabric alone.

Page	What it covers
GitOps flow	How a Renovate PR becomes a running container, end-to-end.
Three-tier backups end-to-end	The path from "byte written to a PVC" through warm / hot / cold tiers, and what each costs to restore.
Backblaze B2 backup location	How k8up, Crossplane, and External Secrets provision the provider-diverse restic target — buckets and scoped keys included.
Disaster recovery drill	From "production is gone" back to a fully reconciled cluster — the documented procedure.
SOPS / age key rotation	Rotating the load-bearing age key without breaking Flux, including the two-recipient phase.
Renovate auto-merge policy	When dependency PRs auto-merge and when they wait for a human.
Real client IPs across the chain	PROXY-protocol-v2 wiring through netbird/SNAT and a multi-proxy chain, with Gitea as the example.
Hardware-backed SSH keys	Generate and use SSH keys whose private material never leaves a Nitrokey 3 or YubiKey 5.
Fedora LUKS2 + TPM2 + Secure Boot	Set up, manage, and recover full-disk encryption bound to TPM PCRs 7 and 14.
IaC layers	Who owns what between OpenTofu, Ansible, Talos machine config, and Crossplane — and where the handoff boundaries sit.
Identity end-to-end	How LLDAP, Keycloak, and Pocket ID divide the identity stack, which apps use which provider, and every hop of an SSO login.
Life of a request	One request end-to-end: public DNS, the Hetzner edge, PROXY protocol v2 across NetBird, TLS + GeoIP on the production gateway, Cilium's last hop to the pod.
Certificate lifecycle	The three certificate planes: cert-manager with the all-inkl DNS-01 webhook, kubelet-serving-cert-approver, and Talos' internal PKI.
Multi-cluster topology	Why a workload lands on the Talos cluster, the edge cluster, or a plain Docker host — and how the base/talos/edge overlays encode it.
NetBird connectivity	The WireGuard overlay through every layer: Tofu-owned identity, site networks and routing peers, sidecars, the operator, and private DNS.
Policy & runtime security	Kyverno admission, Policy Reporter visibility, Tetragon runtime observability, and Cilium default-deny — what's enforced versus audited.
Storage tiers	Where live data sits: Longhorn's five storage classes, TrueNAS NFS for bulk media, deliberate ephemeral state — and how to pick a tier.
Observability & alerting	Which signal reaches a human, and how: vmalert → Alertmanager → ntfy/email versus the pull-only Gatus and policy-reporter dashboards.
Image supply chain	How image bytes reach a node: digest pinning, Renovate bumps, CI validation, and Spegel's P2P mirror on Talos containerd.
KubeVela delivery	The Kustomize pattern that ships every app today versus the installed-but-unused KubeVela/OAM layer, and what adopting it would take.
Hardware acceleration	From silicon to stream: Intel iGPUs through Proxmox passthrough, Talos extensions, and the device plugin to Jellyfin and FileFlows.