Kubernetes

two winding paths leading to one server cabinet with its door open — the robot walking up the left path holding a key past a pi symbol, the boy in the cap walking up the right path holding a padlock past a cloud

🔐 Same Hostname, Two Traffic Paths: Local HTTPS Without a VPN

No open ports. Real TLS at home. One IngressRoute per app. This is the networking setup I landed on after ruling out everything that required a compromise.

the boy in the cap plugging a network cable into a server rack while the robot stands beside him holding a small server box in both hands, eyes closed and grinning

🏗️ My Homelab Runs on GitOps. Here's What That Actually Means.

I wanted to learn production-grade Kubernetes patterns without breaking production. One node, a full GitOps stack, and a hard rule: no manual kubectl after bootstrap.

the boy in the cap holding a phone showing a GitLab sign-in screen with a Continue button, a small ticket marked with a key travelling along an arrow from the phone to a QR code on the robot's chest, the robot's antenna lighting up

📱 Building a QR Code Login for a Homelab (And Learning oauth2-proxy's Session Format the Hard Way)

My homelab uses oauth2-proxy for GitLab SSO. I wanted a QR code login for the TV dashboard. Two days and four complete rewrites later, I knew more about oauth2-proxy’s session format than I ever planned to.