Home-ops community

Before this stack existed, other people had published theirs. The home-ops community is the loose group that keeps a cluster at home and every decision in a public repository: onedr0p/home-ops with its cluster-template for Talos plus Flux is the best-known pair, and k8s-at-home was the chart commons that came before helmforge.

Read three of those repositories and the same layout appears, without anyone coordinating it.

Conventions copied here

• One repository per cluster. Talos patches, controllers, applications, DNS and secret references live in one tree, so a change spanning four layers is one review.
• Flux plus Renovate. Flux applies what git says; Renovate opens the version bumps.
• Image tags are pointers. $imagepolicy setters let automation rewrite the tag; nobody types a digest by hand.
• Secrets are synced, never committed. An external store plus an operator that pulls values into the cluster.
• Layers, not folders of pods. Talos, networking, storage, monitoring, apps: the same words, in the same order, across repositories written by strangers.

Where this stack differs

OpenBao instead of the community's secret defaults, because the operator and policy model were already in use. Zitadel for identity instead of an in-cluster SSO bolt-on. Rust for this site. NetBird alongside Tailscale, because the cluster spans two sites and one mesh was not enough.

Deviations are cheap when the rest is shared: the parts I did not invent are the parts I rarely have to debug.