{ "articles": [ { "commands_change_state": "unknown", "id": "/frank/docs/papers/00-why-homelab-in-2026/", "last_verified": false, "layer": "repo", "markdown_url": "https://blog.derio.net/frank/docs/papers/00-why-homelab-in-2026/index.md", "prerequisites": [], "published": "2026-05-18", "reader_goal": "", "related_building": "docs/building/01-introduction", "related_operating": "docs/operating/01-cluster-nodes", "series": [ "papers" ], "source_path": "docs/papers/00-why-homelab-in-2026/index.md", "summary": "Three philosophies dominate infrastructure decisions in 2026: cloud (pay the bill, ignore the metal), managed homelab-as-code (own the iron, outsource lifecycle), and DIY…", "tags": [ "homelab", "kubernetes", "talos", "architecture" ], "tested_versions": [], "title": "Why Run Your Own Cluster in 2026?", "updated": "2026-05-18", "url": "https://blog.derio.net/frank/docs/papers/00-why-homelab-in-2026/", "content_sha256": "26af5d275347413e177fcd030c66e21ab3c56d8b9d7f8e820a886059921fc597" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/00-overview/", "last_verified": false, "layer": "", "markdown_url": "https://blog.derio.net/frank/docs/building/00-overview/index.md", "prerequisites": [], "published": "2026-03-06", "reader_goal": "Understand Frank's capability layers and how they map to hardware zones", "related_building": "", "related_operating": "", "series": [], "source_path": "docs/building/00-overview/index.md", "summary": "The index to Frank, the Talos Cluster — an AI-hybrid Kubernetes homelab. Technology roadmap, capabilities, cluster state, and the commands to check any of it.", "tags": [ "overview", "roadmap" ], "tested_versions": [], "title": "Frank, the Talos Cluster: Overview & Roadmap", "updated": "2026-08-01", "url": "https://blog.derio.net/frank/docs/building/00-overview/", "content_sha256": "914d3c41a5fd4f1b01760eabbeb41519f7e126e1f042861ff8155f04ebad6a05" }, { "commands_change_state": "unknown", "id": "/frank/docs/papers/01-heterogeneous-hardware/", "last_verified": false, "layer": "hw", "markdown_url": "https://blog.derio.net/frank/docs/papers/01-heterogeneous-hardware/index.md", "prerequisites": [], "published": "2026-05-22", "reader_goal": "", "related_building": "docs/building/01-introduction", "related_operating": "docs/operating/01-cluster-nodes", "series": [ "papers" ], "source_path": "docs/papers/01-heterogeneous-hardware/index.md", "summary": "Same boxes or different boxes? Six fleet shapes split on that one question — all-RPi, all-NUC, heterogeneous bare metal, edge+core, single beefy server + VMs, full-cloud…", "tags": [ "hardware", "heterogeneous", "node-pools", "kubernetes", "talos", "raspberry-pi", "gpu" ], "tested_versions": [], "title": "Heterogeneous Hardware as a Design Choice", "updated": "2026-05-22", "url": "https://blog.derio.net/frank/docs/papers/01-heterogeneous-hardware/", "content_sha256": "3ef2deb2d657ec6487902ccdb702e37af3f3784d2c4a24bc249a053cba5dfb12" }, { "commands_change_state": "unknown", "id": "/frank/docs/operating/01-cluster-nodes/", "last_verified": false, "layer": "os", "markdown_url": "https://blog.derio.net/frank/docs/operating/01-cluster-nodes/index.md", "prerequisites": [], "published": "2026-03-13", "reader_goal": "Diagnose node and networking issues on a Talos+Cilium cluster using kubectl, talosctl, cilium CLI, and Omni's declarative patch system.", "related_building": "", "related_operating": "", "series": [ "operating" ], "source_path": "docs/operating/01-cluster-nodes/index.md", "summary": "Day-to-day commands for checking cluster health, managing Talos nodes, and debugging Cilium networking on Frank — including the real failure patterns the gotcha docs cover.", "tags": [ "operations", "talos", "cilium", "hubble", "networking", "omni", "troubleshooting" ], "tested_versions": [], "title": "Operating on Cluster & Nodes", "updated": "2026-09-19", "url": "https://blog.derio.net/frank/docs/operating/01-cluster-nodes/", "content_sha256": "17cd7cf89dbcc701eb966ce3ab6f318cd536eb968e35116fefd445566ec509ea" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/01-introduction/", "last_verified": false, "layer": "repo", "markdown_url": "https://blog.derio.net/frank/docs/building/01-introduction/index.md", "prerequisites": [], "published": "2026-03-06", "reader_goal": "Decide whether this cluster architecture suits your own homelab goals and map its two-layer management model", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/01-introduction/index.md", "summary": "The motivation behind Frank, the Talos Cluster — learning enterprise infrastructure and building interesting projects on your own hardware.", "tags": [ "introduction", "architecture" ], "tested_versions": [], "title": "Why Build a Kubernetes Homelab?", "updated": "2026-10-31", "url": "https://blog.derio.net/frank/docs/building/01-introduction/", "content_sha256": "9fd2e09737bf5befbbd2db2ab3d884b34180392de97026d490ae3c77e4a291b5" }, { "commands_change_state": "unknown", "id": "/frank/docs/papers/02-immutable-os/", "last_verified": false, "layer": "os", "markdown_url": "https://blog.derio.net/frank/docs/papers/02-immutable-os/index.md", "prerequisites": [], "published": "2026-05-19", "reader_goal": "", "related_building": "docs/building/02-foundation", "related_operating": "docs/operating/01-cluster-nodes", "series": [ "papers" ], "source_path": "docs/papers/02-immutable-os/index.md", "summary": "Immutable OS for Kubernetes nodes is a four-job problem — read-only root, transactional updates, declarative config, and (at the strict end) no SSH at all — and the six 2026…", "tags": [ "os", "talos", "immutable", "kubernetes", "homelab" ], "tested_versions": [], "title": "Immutable OS & Declarative Machines", "updated": "2026-05-19", "url": "https://blog.derio.net/frank/docs/papers/02-immutable-os/", "content_sha256": "d8b099b82a37fb10e84b97862d2d9045e11a13dbf33ad38aae672b233ac217e7" }, { "commands_change_state": "unknown", "id": "/frank/docs/operating/02-storage-backups/", "last_verified": false, "layer": "stor", "markdown_url": "https://blog.derio.net/frank/docs/operating/02-storage-backups/index.md", "prerequisites": [], "published": "2026-03-13", "reader_goal": "Check Longhorn volume health, manage R2 backups, expand a volume, restore from backup, and debug degraded volumes, failed backups, or stuck attachments — without relying on the Longhorn UI.", "related_building": "", "related_operating": "", "series": [ "operating" ], "source_path": "docs/operating/02-storage-backups/index.md", "summary": "Day-to-day commands for managing Longhorn volumes, checking backup health, restoring from Cloudflare R2, and debugging common storage failures on Frank.", "tags": [ "operations", "longhorn", "storage", "backup", "r2", "troubleshooting" ], "tested_versions": [], "title": "Operating on Storage & Backups", "updated": "2026-08-01", "url": "https://blog.derio.net/frank/docs/operating/02-storage-backups/", "content_sha256": "5f35e72f2ece99f5a33ec2ecd024b193e95396b00e715926cff4a60e96632713" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/02-foundation/", "last_verified": false, "layer": "os", "markdown_url": "https://blog.derio.net/frank/docs/building/02-foundation/index.md", "prerequisites": [], "published": "2026-03-06", "reader_goal": "Bootstrap a Talos cluster via Omni and install Cilium with eBPF kube-proxy replacement and L2 LoadBalancer", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/02-foundation/index.md", "summary": "Bootstrapping a Talos Linux cluster with Omni, configuring node labels and zones, and replacing Flannel with Cilium's eBPF networking.", "tags": [ "talos", "cilium", "networking", "bootstrap" ], "tested_versions": [], "title": "Building the Foundation — Talos, Nodes, and Cilium", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/building/02-foundation/", "content_sha256": "6bda7f317ae9c35aeb14bf7738f6d5e4fafa2659536ac21e84c8849c3f86d986" }, { "commands_change_state": "unknown", "id": "/frank/docs/papers/03-ebpf-networking/", "last_verified": false, "layer": "net", "markdown_url": "https://blog.derio.net/frank/docs/papers/03-ebpf-networking/index.md", "prerequisites": [], "published": "2026-05-20", "reader_goal": "", "related_building": "docs/building/02-foundation", "related_operating": "docs/operating/01-cluster-nodes", "series": [ "papers" ], "source_path": "docs/papers/03-ebpf-networking/index.md", "summary": "Six options dominate Kubernetes networking in 2026 — Cilium, Calico, kube-proxy + iptables, Istio, Linkerd2, and the cloud-managed VPC CNI — and they split on two axes:…", "tags": [ "cilium", "ebpf", "kubernetes", "service-mesh", "networking" ], "tested_versions": [], "title": "eBPF Networking Without a Service Mesh", "updated": "2026-05-20", "url": "https://blog.derio.net/frank/docs/papers/03-ebpf-networking/", "content_sha256": "271b05ead7923913e4bb6076a5967bec62800f566249c6e810d8108c902255d9" }, { "commands_change_state": "unknown", "id": "/frank/docs/operating/03-gitops/", "last_verified": false, "layer": "gitops", "markdown_url": "https://blog.derio.net/frank/docs/operating/03-gitops/index.md", "prerequisites": [], "published": "2026-03-13", "reader_goal": "Navigate the full ArgoCD lifecycle on Frank — observe, sync, diff, add apps, and recover from the real failure patterns (symlink blast, stale health, manual syncOptions, self-heal constraint) without consulting four separate runbooks.", "related_building": "", "related_operating": "", "series": [ "operating" ], "source_path": "docs/operating/03-gitops/index.md", "summary": "Day-to-day commands for managing ArgoCD applications, syncing, debugging drift, handling degraded apps, and navigating the gotchas that have bitten Frank.", "tags": [ "operations", "argocd", "gitops", "troubleshooting" ], "tested_versions": [], "title": "Operating on GitOps", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/operating/03-gitops/", "content_sha256": "dccc7eeba6385ea0439d7196d6a4485cfb360b0a5152421e5f7ad6f6b91ee67a" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/03-storage/", "last_verified": false, "layer": "stor", "markdown_url": "https://blog.derio.net/frank/docs/building/03-storage/index.md", "prerequisites": [], "published": "2026-03-06", "reader_goal": "Install Longhorn on Talos and configure a GPU-local StorageClass for AI workloads", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/03-storage/index.md", "summary": "Setting up Longhorn distributed block storage across heterogeneous disks, including a GPU-local StorageClass for AI workloads.", "tags": [ "longhorn", "storage" ], "tested_versions": [], "title": "Persistent Storage with Longhorn", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/building/03-storage/", "content_sha256": "2861c84dcef9f8e50131de79fc6c26fe6f54e229acedcc31719c05f39cc0d47b" }, { "commands_change_state": "unknown", "id": "/frank/docs/papers/04-distributed-storage/", "last_verified": false, "layer": "stor", "markdown_url": "https://blog.derio.net/frank/docs/papers/04-distributed-storage/index.md", "prerequisites": [], "published": "2026-05-19", "reader_goal": "", "related_building": "docs/building/03-storage", "related_operating": "docs/operating/02-storage-backups", "series": [ "papers" ], "source_path": "docs/papers/04-distributed-storage/index.md", "summary": "Distributed storage on bare-metal Kubernetes is a four-job problem — synchronous replication, snapshots, off-cluster backup, RWX — and the six contenders in 2026 (Longhorn,…", "tags": [ "storage", "longhorn", "ceph", "kubernetes", "homelab" ], "tested_versions": [], "title": "Distributed Storage on Bare Metal", "updated": "2026-05-19", "url": "https://blog.derio.net/frank/docs/papers/04-distributed-storage/", "content_sha256": "d61b6867c924b605efda4680922fb9876d076b08edee393e4146e3b419a2f65a" }, { "commands_change_state": "unknown", "id": "/frank/docs/operating/04-gpu-compute/", "last_verified": false, "layer": "gpu", "markdown_url": "https://blog.derio.net/frank/docs/operating/04-gpu-compute/index.md", "prerequisites": [], "published": "2026-03-13", "reader_goal": "Check GPU health, manage GPU workloads, and debug common failures (GPU not allocating, containerd config corruption, stale allocations, reboot loops) on both NVIDIA and Intel GPU stacks on Talos.", "related_building": "", "related_operating": "", "series": [ "operating" ], "source_path": "docs/operating/04-gpu-compute/index.md", "summary": "Day-to-day commands for managing NVIDIA and Intel GPUs, checking utilization, and debugging GPU container issues on Talos.", "tags": [ "operations", "gpu", "nvidia", "intel", "talos", "troubleshooting" ], "tested_versions": [], "title": "Operating on GPU Compute", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/operating/04-gpu-compute/", "content_sha256": "68dedcb2b0db90a14d4f4cb862583d74b98b7f5312d55ba9f11cb2ce5e8e9a91" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/04-gpu-compute/", "last_verified": false, "layer": "gpu", "markdown_url": "https://blog.derio.net/frank/docs/building/04-gpu-compute/index.md", "prerequisites": [], "published": "2026-03-06", "reader_goal": "Deploy NVIDIA GPU Operator on Talos and configure Intel Arc iGPUs via Dynamic Resource Allocation on Kubernetes 1.35", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/04-gpu-compute/index.md", "summary": "Adding GPU compute to the cluster — the NVIDIA RTX 5070 saga, Intel Arc iGPU via DRA, and patching charts for bleeding-edge Kubernetes.", "tags": [ "gpu", "nvidia", "intel", "dra" ], "tested_versions": [], "title": "GPU Compute — NVIDIA and Intel", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/building/04-gpu-compute/", "content_sha256": "34cd78f7dbf82f2bf6e092edd7c63ca93ca2a29f5f43d7f46cc36d18e84570bc" }, { "commands_change_state": "unknown", "id": "/frank/docs/papers/05-gpu-scheduling/", "last_verified": false, "layer": "gpu", "markdown_url": "https://blog.derio.net/frank/docs/papers/05-gpu-scheduling/index.md", "prerequisites": [], "published": "2026-05-20", "reader_goal": "", "related_building": "docs/building/04-gpu-compute", "related_operating": "docs/operating/04-gpu-compute", "series": [ "papers" ], "source_path": "docs/papers/05-gpu-scheduling/index.md", "summary": "GPU scheduling on Kubernetes is a four-job problem — driver lifecycle, device discovery, allocation, partitioning — and the six contenders in 2026 (NVIDIA GPU Operator, Intel…", "tags": [ "gpu", "nvidia", "intel", "dra", "kubernetes" ], "tested_versions": [], "title": "GPU Scheduling for Mixed Workloads", "updated": "2026-05-20", "url": "https://blog.derio.net/frank/docs/papers/05-gpu-scheduling/", "content_sha256": "a3ee2317dd92a44abe83e5302fe942a5ea721ba57162529cc1daaeb8666a2abc" }, { "commands_change_state": "unknown", "id": "/frank/docs/operating/05-observability/", "last_verified": false, "layer": "obs", "markdown_url": "https://blog.derio.net/frank/docs/operating/05-observability/index.md", "prerequisites": [], "published": "2026-03-13", "reader_goal": "Query metrics and logs, check control-plane etcd health, diagnose missing data, and fix alert delivery failures in a VictoriaMetrics + VictoriaLogs + Grafana stack.", "related_building": "", "related_operating": "", "series": [ "operating" ], "source_path": "docs/operating/05-observability/index.md", "summary": "Day-to-day commands for querying metrics and logs, managing Grafana dashboards, debugging alert delivery failures, and fixing the observability pipeline on Frank.", "tags": [ "operations", "victoriametrics", "grafana", "fluent-bit", "observability", "victorialogs", "troubleshooting" ], "tested_versions": [], "title": "Operating on Observability", "updated": "2026-09-14", "url": "https://blog.derio.net/frank/docs/operating/05-observability/", "content_sha256": "55b4bff2f22ed11f9ed79be64b6d50450a77fd7a55deccebdca97242196a5133" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/05-gitops/", "last_verified": false, "layer": "gitops", "markdown_url": "https://blog.derio.net/frank/docs/building/05-gitops/index.md", "prerequisites": [], "published": "2026-03-06", "reader_goal": "Deploy ArgoCD with App-of-Apps and adopt existing Helm releases via annotation-based resource tracking", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/05-gitops/index.md", "summary": "Migrating from Flux to ArgoCD with an App-of-Apps pattern — adopting existing workloads without downtime.", "tags": [ "argocd", "gitops" ], "tested_versions": [], "title": "GitOps Everything with ArgoCD", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/building/05-gitops/", "content_sha256": "e792bff7113907a72bda6c57d3330a84f1fce3fd7d09d5f992a5bc89e9d1ad00" }, { "commands_change_state": "unknown", "id": "/frank/docs/papers/06-gitops-at-small-scale/", "last_verified": false, "layer": "gitops", "markdown_url": "https://blog.derio.net/frank/docs/papers/06-gitops-at-small-scale/index.md", "prerequisites": [], "published": "2026-05-19", "reader_goal": "", "related_building": "docs/building/05-gitops", "related_operating": "docs/operating/03-gitops", "series": [ "papers" ], "source_path": "docs/papers/06-gitops-at-small-scale/index.md", "summary": "GitOps on Kubernetes is a four-jobs-in-one bundle — reconcile, drift- detect, gate write access, audit — and the six contenders in 2026 (ArgoCD, Flux v2, Jenkins X,…", "tags": [ "gitops", "argocd", "flux", "kubernetes", "homelab" ], "tested_versions": [], "title": "GitOps at Small Scale", "updated": "2026-05-19", "url": "https://blog.derio.net/frank/docs/papers/06-gitops-at-small-scale/", "content_sha256": "0d23c6a5188637ac778c645679c9ab80feb378b8688dd49e3fd0d368edebc636" }, { "commands_change_state": "unknown", "id": "/frank/docs/operating/06-secrets/", "last_verified": false, "layer": "secrets", "markdown_url": "https://blog.derio.net/frank/docs/operating/06-secrets/index.md", "prerequisites": [], "published": "2026-03-13", "reader_goal": "Add, rotate, and troubleshoot secrets through Infisical + External Secrets Operator, and apply SOPS-encrypted bootstrap secrets without getting stuck.", "related_building": "", "related_operating": "", "series": [ "operating" ], "source_path": "docs/operating/06-secrets/index.md", "summary": "Day-to-day commands for managing secrets in Infisical, checking ESO sync status, handling SOPS-encrypted bootstrap secrets, and recovering from the real gotchas that have…", "tags": [ "operations", "infisical", "external-secrets", "sops", "security", "troubleshooting" ], "tested_versions": [], "title": "Operating on Secrets", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/operating/06-secrets/", "content_sha256": "eca226a45440c97a8a53fe4745aff817ad4d9dba39c08de8ab864c415d1da577" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/06-fun-stuff/", "last_verified": false, "layer": "fun", "markdown_url": "https://blog.derio.net/frank/docs/building/06-fun-stuff/index.md", "prerequisites": [], "published": "2026-03-06", "reader_goal": "Understand how to expose USB HID devices to Kubernetes pods and why you should check firmware versions before spending a week on HID feature reports", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/06-fun-stuff/index.md", "summary": "The most over-engineered RGB setup — controlling ARGB case fans from a Kubernetes DaemonSet via USB HID.", "tags": [ "openrgb", "hardware" ], "tested_versions": [], "title": "Fun Stuff — Controlling Case LEDs from Kubernetes", "updated": "2026-07-28", "url": "https://blog.derio.net/frank/docs/building/06-fun-stuff/", "content_sha256": "36ea3ed767cfd2739904242cce34937c32e3122e2c2f2d5ca258790de9a2f530" }, { "commands_change_state": "unknown", "id": "/frank/docs/papers/07-observability-honestly/", "last_verified": false, "layer": "obs", "markdown_url": "https://blog.derio.net/frank/docs/papers/07-observability-honestly/index.md", "prerequisites": [], "published": "2026-05-19", "reader_goal": "", "related_building": "docs/building/07-observability", "related_operating": "docs/operating/05-observability", "series": [ "papers" ], "source_path": "docs/papers/07-observability-honestly/index.md", "summary": "Cluster observability is a five-job problem — metrics, logs, traces, dashboards, alerts — and the six contenders in 2026 (Grafana+Prometheus+Loki, VictoriaMetrics, Mimir,…", "tags": [ "observability", "grafana", "prometheus", "loki", "victoriametrics", "kubernetes", "homelab" ], "tested_versions": [], "title": "The Observability Stack, Honestly", "updated": "2026-05-19", "url": "https://blog.derio.net/frank/docs/papers/07-observability-honestly/", "content_sha256": "c586533d47336cbb4ffe99453be12034f7f0018c87e0ef1ac7d5d8380a1655f9" }, { "commands_change_state": "unknown", "id": "/frank/docs/operating/07-inference/", "last_verified": false, "layer": "infer", "markdown_url": "https://blog.derio.net/frank/docs/operating/07-inference/index.md", "prerequisites": [], "published": "2026-03-13", "reader_goal": "Manage Ollama models, route inference through LiteLLM, and correctly diagnose the two different OOM patterns that look identical.", "related_building": "", "related_operating": "", "series": [ "operating" ], "source_path": "docs/operating/07-inference/index.md", "summary": "Day-to-day commands for managing local LLM inference, checking model status, routing through LiteLLM, and debugging GPU memory issues — including the misleading cgroup OOM and…", "tags": [ "operations", "ollama", "litellm", "openrouter", "ai", "gpu", "troubleshooting" ], "tested_versions": [], "title": "Operating on Local Inference", "updated": "2026-08-03", "url": "https://blog.derio.net/frank/docs/operating/07-inference/", "content_sha256": "e48e20b4329a8efa8313ff743d89d86d23fde56fe17292f07b847aa88eaa84e3" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/07-observability/", "last_verified": false, "layer": "obs", "markdown_url": "https://blog.derio.net/frank/docs/building/07-observability/index.md", "prerequisites": [], "published": "2026-03-08", "reader_goal": "Deploy VictoriaMetrics, VictoriaLogs, and Fluent Bit on a Talos cluster and troubleshoot the four most common deployment pitfalls", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/07-observability/index.md", "summary": "Deploying a resource-efficient observability stack with VictoriaMetrics, VictoriaLogs, and Grafana — and the four gotchas that made it interesting.", "tags": [ "observability", "victoriametrics", "grafana", "fluent-bit", "victoria-logs" ], "tested_versions": [], "title": "Observability — Metrics and Logs with VictoriaMetrics", "updated": "2026-09-14", "url": "https://blog.derio.net/frank/docs/building/07-observability/", "content_sha256": "23848c683500d62af094eca95479b1cc4efffb06d4b261ada0db33b11585fe9a" }, { "commands_change_state": "unknown", "id": "/frank/docs/papers/08-backup-dr/", "last_verified": false, "layer": "backup", "markdown_url": "https://blog.derio.net/frank/docs/papers/08-backup-dr/index.md", "prerequisites": [], "published": "2026-05-20", "reader_goal": "", "related_building": "docs/building/08-backup", "related_operating": "docs/operating/02-storage-backups", "series": [ "papers" ], "source_path": "docs/papers/08-backup-dr/index.md", "summary": "Kubernetes backup & DR is a five-job problem — API-object capture, volume capture, application-consistency hooks, offsite shipment, credential restore — and the six contenders…", "tags": [ "backup", "disaster-recovery", "velero", "longhorn", "kasten", "kubernetes" ], "tested_versions": [], "title": "Backup & DR Without a Vendor Contract", "updated": "2026-05-20", "url": "https://blog.derio.net/frank/docs/papers/08-backup-dr/", "content_sha256": "47245a603076480e93ce0fcdac75420826a2d1d88128b9eb36cd648f286ca817" }, { "commands_change_state": "unknown", "id": "/frank/docs/operating/08-auth/", "last_verified": false, "layer": "auth", "markdown_url": "https://blog.derio.net/frank/docs/operating/08-auth/index.md", "prerequisites": [], "published": "2026-03-13", "reader_goal": "Add users, rotate OIDC client secrets, and fix the most common forward-auth redirect failures in Authentik.", "related_building": "", "related_operating": "", "series": [ "operating" ], "source_path": "docs/operating/08-auth/index.md", "summary": "Day-to-day commands for managing Authentik SSO, checking OIDC flows, rotating client secrets, and debugging the forward-auth redirect loop that redirects to 0.0.0.0.", "tags": [ "operations", "authentik", "oidc", "sso", "security", "troubleshooting" ], "tested_versions": [], "title": "Operating on Authentication", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/operating/08-auth/", "content_sha256": "b4b50d8ac20b14a8601f780ae8735b583e08c57d5fbdb5423b2ff1d30dbcf01e" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/08-backup/", "last_verified": false, "layer": "backup", "markdown_url": "https://blog.derio.net/frank/docs/building/08-backup/index.md", "prerequisites": [], "published": "2026-03-08", "reader_goal": "Configure Longhorn backup to an S3-compatible target with RecurringJobs, work around the three main Longhorn 1.11 limitations, and verify a backup actually ran", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/08-backup/index.md", "summary": "Configuring Longhorn backup targets with Cloudflare R2 — and the three Longhorn 1.11 gotchas that rewrote the original plan.", "tags": [ "backup", "longhorn", "cloudflare-r2", "sops", "disaster-recovery", "gitops" ], "tested_versions": [], "title": "Backup — Longhorn to Cloudflare R2", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/building/08-backup/", "content_sha256": "965cf775f5d38af3d9ad2d7313703d3f7c8aa534c3ab7f5e496c9c76a8a0693a" }, { "commands_change_state": "unknown", "id": "/frank/docs/papers/09-secrets-bootstrap/", "last_verified": false, "layer": "secrets", "markdown_url": "https://blog.derio.net/frank/docs/papers/09-secrets-bootstrap/index.md", "prerequisites": [], "published": "2026-05-20", "reader_goal": "", "related_building": "docs/building/09-secrets", "related_operating": "docs/operating/06-secrets", "series": [ "papers" ], "source_path": "docs/papers/09-secrets-bootstrap/index.md", "summary": "Secrets management is a five-job problem — storage, distribution, rotation, audit, and the bootstrap chicken-and-egg — and the six contenders in 2026 (Infisical, ESO +…", "tags": [ "secrets", "infisical", "external-secrets", "sops", "vault", "kubernetes" ], "tested_versions": [], "title": "Secrets Management Without the Bootstrap Chicken-and-Egg", "updated": "2026-05-20", "url": "https://blog.derio.net/frank/docs/papers/09-secrets-bootstrap/", "content_sha256": "29ee81b06aaf5f944ff314bbbcad7365f5bd237c5793d8bbb7a991a9c2f1a78b" }, { "commands_change_state": "unknown", "id": "/frank/docs/operating/09-multi-tenancy/", "last_verified": false, "layer": "tenant", "markdown_url": "https://blog.derio.net/frank/docs/operating/09-multi-tenancy/index.md", "prerequisites": [], "published": "2026-03-13", "reader_goal": "Create, connect to, and troubleshoot vCluster virtual clusters, including resource quota management and sync debugging.", "related_building": "", "related_operating": "", "series": [ "operating" ], "source_path": "docs/operating/09-multi-tenancy/index.md", "summary": "Day-to-day commands for managing vCluster virtual clusters, checking tenant health, creating and deleting vClusters, and debugging sync issues.", "tags": [ "operations", "vcluster", "multi-tenancy", "troubleshooting" ], "tested_versions": [], "title": "Operating on Multi-tenancy", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/operating/09-multi-tenancy/", "content_sha256": "55b204fd3e466a90d1be0503ff12a458d0defca67319220a993d8f746b62a3e8" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/09-secrets/", "last_verified": false, "layer": "secrets", "markdown_url": "https://blog.derio.net/frank/docs/building/09-secrets/index.md", "prerequisites": [], "published": "2026-03-08", "reader_goal": "Deploy Infisical and External Secrets Operator on Talos, working around three Infisical standalone chart bugs", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/09-secrets/index.md", "summary": "Replacing the SOPS-only secrets workflow with Infisical + ESO — and the three Infisical chart bugs that forced splitting one app into three.", "tags": [ "secrets", "infisical", "external-secrets", "eso", "sops", "gitops", "security" ], "tested_versions": [], "title": "Secrets Management — Infisical + External Secrets Operator", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/building/09-secrets/", "content_sha256": "a50a91b9bececae7991e1e02fd208b4f892ac46519f938d8a7dc4c3b2f43df6d" }, { "commands_change_state": "unknown", "id": "/frank/docs/papers/10-self-hosted-inference/", "last_verified": false, "layer": "infer", "markdown_url": "https://blog.derio.net/frank/docs/papers/10-self-hosted-inference/index.md", "prerequisites": [], "published": "2026-05-19", "reader_goal": "", "related_building": "docs/building/10-local-inference", "related_operating": "docs/operating/07-inference", "series": [ "papers" ], "source_path": "docs/papers/10-self-hosted-inference/index.md", "summary": "Inference is a build-versus-buy question dressed up in GPU language. The engine tier (Ollama, vLLM, llama.cpp, TGI) decides whether the model runs on your metal; the gateway…", "tags": [ "inference", "llm", "gpu", "gateway", "litellm", "ollama", "vllm" ], "tested_versions": [], "title": "Self-Hosted Inference & the LLM Gateway Pattern", "updated": "2026-05-19", "url": "https://blog.derio.net/frank/docs/papers/10-self-hosted-inference/", "content_sha256": "15a304f0939cca0d0d72d7266f2e580084c8c20d5bdeb095eb04a803a4d6bca2" }, { "commands_change_state": "unknown", "id": "/frank/docs/operating/10-media-generation/", "last_verified": false, "layer": "media", "markdown_url": "https://blog.derio.net/frank/docs/operating/10-media-generation/index.md", "prerequisites": [], "published": "2026-03-20", "reader_goal": "Run a ComfyUI workflow end-to-end, switch GPU profiles, and recover from the most common media-generation failures.", "related_building": "", "related_operating": "", "series": [ "operating" ], "source_path": "docs/operating/10-media-generation/index.md", "summary": "Starting ComfyUI workflows, switching GPU profiles, transferring files, and recovering from common runtime failures.", "tags": [ "operations", "media", "comfyui", "gpu-switcher", "troubleshooting" ], "tested_versions": [], "title": "Operating on Media Generation", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/operating/10-media-generation/", "content_sha256": "1d2f55fa44db3183d93e2300ca7173e7d3980c344470741e8064f428146173e7" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/10-local-inference/", "last_verified": false, "layer": "infer", "markdown_url": "https://blog.derio.net/frank/docs/building/10-local-inference/index.md", "prerequisites": [], "published": "2026-03-09", "reader_goal": "Deploy Ollama on a GPU node and LiteLLM as a unified inference gateway with local and cloud model routing", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/10-local-inference/index.md", "summary": "A unified OpenAI-compatible gateway fronting a local RTX 5070 Ti running Ollama, built to route to OpenRouter's free tier as well — until that tier was dropped and the gateway…", "tags": [ "ollama", "litellm", "openrouter", "llm", "inference", "gpu", "ai" ], "tested_versions": [], "title": "Local Inference — Ollama, LiteLLM, and OpenRouter", "updated": "2026-08-01", "url": "https://blog.derio.net/frank/docs/building/10-local-inference/", "content_sha256": "a7bd6bac7336a82ca8709b9905cf619b7f3a113a064656a18098cb81a1efb88f" }, { "commands_change_state": "unknown", "id": "/frank/docs/papers/11-identity-heterogeneous-stack/", "last_verified": false, "layer": "auth", "markdown_url": "https://blog.derio.net/frank/docs/papers/11-identity-heterogeneous-stack/index.md", "prerequisites": [], "published": "2026-05-19", "reader_goal": "", "related_building": "docs/building/13-unified-auth", "related_operating": "docs/operating/08-auth", "series": [ "papers" ], "source_path": "docs/papers/11-identity-heterogeneous-stack/index.md", "summary": "Ten web UIs, three CLIs, and a gRPC service all want to ask the same question: who's on the other side of this URL? The identity-provider slot has seven serious vendors —…", "tags": [ "authentik", "identity", "sso", "forward-auth", "oidc" ], "tested_versions": [], "title": "Identity for a Heterogeneous Stack", "updated": "2026-05-19", "url": "https://blog.derio.net/frank/docs/papers/11-identity-heterogeneous-stack/", "content_sha256": "47ccc7dfdf68014466fc65ccf764decc2c70205f394481aac71429c7f414554e" }, { "commands_change_state": "unknown", "id": "/frank/docs/operating/11-public-edge/", "last_verified": false, "layer": "edge", "markdown_url": "https://blog.derio.net/frank/docs/operating/11-public-edge/index.md", "prerequisites": [], "published": "2026-03-20", "reader_goal": "Manage Hop day-to-day: talosctl, Headscale mesh operations, Caddy TLS, CrowdSec, and emergency recovery.", "related_building": "", "related_operating": "", "series": [ "operating" ], "source_path": "docs/operating/11-public-edge/index.md", "summary": "Managing Hop — a standalone single-node Talos cluster on Hetzner Cloud with Headscale mesh, Caddy, and CrowdSec.", "tags": [ "operations", "hop", "talos", "headscale", "tailscale", "caddy", "edge" ], "tested_versions": [], "title": "Operating on Hop — Single-Node Talos Edge Cluster", "updated": "2026-07-30", "url": "https://blog.derio.net/frank/docs/operating/11-public-edge/", "content_sha256": "9d0b14e85e3ec45195dbb43410b378ef415a91906b569eaed050b89f91677234" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/11-agentic-control-plane/", "last_verified": false, "layer": "agents", "markdown_url": "https://blog.derio.net/frank/docs/building/11-agentic-control-plane/index.md", "prerequisites": [], "published": "2026-03-10", "reader_goal": "Deploy Sympozium on Talos, wire LiteLLM routing through auth-secret injection, and work around the git-sourced chart, PodSecurity, and PersonaPack baseURL gotchas", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/11-agentic-control-plane/index.md", "summary": "A Kubernetes-native control plane where every AI agent is a Pod, every policy is a CRD, and every execution is a Job — orchestrated by Sympozium.", "tags": [ "sympozium", "agents", "ai", "control-plane", "nats", "litellm" ], "tested_versions": [], "title": "Agentic Control Plane — Sympozium", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/building/11-agentic-control-plane/", "content_sha256": "ab99fe881d64996d95204aeeb5bc6fbd4533eced34af2cfb43b94253c9bebd6a" }, { "commands_change_state": "unknown", "id": "/frank/docs/operating/12-progressive-delivery/", "last_verified": false, "layer": "deploy", "markdown_url": "https://blog.derio.net/frank/docs/operating/12-progressive-delivery/index.md", "prerequisites": [], "published": "2026-03-27", "reader_goal": "Promote an Argo Rollout through canary steps, switch blue-green, interpret analysis results, and recover from a stuck rollout.", "related_building": "", "related_operating": "", "series": [ "operating" ], "source_path": "docs/operating/12-progressive-delivery/index.md", "summary": "Promoting canary steps, switching blue-green, inspecting analysis results, and handling sparse-traffic pauses.", "tags": [ "operations", "argo-rollouts", "canary", "blue-green", "litellm", "sympozium" ], "tested_versions": [], "title": "Operating on Progressive Delivery", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/operating/12-progressive-delivery/", "content_sha256": "3a77f8b27d5aae9d3f69c314c40cfb01efed1cea177960bc57f1d64199a7a780" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/12-gpu-talos-fix/", "last_verified": false, "layer": "gpu", "markdown_url": "https://blog.derio.net/frank/docs/building/12-gpu-talos-fix/index.md", "prerequisites": [], "published": "2026-03-10", "reader_goal": "Fix the four Talos-specific issues that keep GPU containers stuck at Init, ContainerCreating, or CrashLoopBackOff after the NVIDIA GPU Operator is deployed", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/12-gpu-talos-fix/index.md", "summary": "Getting NVIDIA GPU containers to actually run on Talos Linux — validation markers, machine-specific patches, nvidia default runtime, and the postStart hook trap.", "tags": [ "gpu", "nvidia", "talos", "containerd", "debugging" ], "tested_versions": [], "title": "GPU Containers on Talos — The Validation Fix", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/building/12-gpu-talos-fix/", "content_sha256": "f60e491f3d6d38897ad13864a4da90b106ab7b22d495d7fc28804eb9b05435f4" }, { "commands_change_state": "unknown", "id": "/frank/docs/papers/13-self-hosted-cicd/", "last_verified": false, "layer": "cicd", "markdown_url": "https://blog.derio.net/frank/docs/papers/13-self-hosted-cicd/index.md", "prerequisites": [], "published": "2026-05-20", "reader_goal": "", "related_building": "docs/building/27-cicd-platform", "related_operating": "docs/operating/22-cicd-platform", "series": [ "papers" ], "source_path": "docs/papers/13-self-hosted-cicd/index.md", "summary": "Self-hosted CI/CD is a choice between one tool or three. The six contenders in 2026 — Gitea+Tekton+Zot, GitLab CE, Forgejo+Woodpecker, Drone CI, Jenkins, and the SaaS baseline…", "tags": [ "ci-cd", "tekton", "gitea", "zot", "kubernetes" ], "tested_versions": [], "title": "Self-Hosted CI/CD on a Homelab", "updated": "2026-05-20", "url": "https://blog.derio.net/frank/docs/papers/13-self-hosted-cicd/", "content_sha256": "74ec95c142f1eb0bd32d6e0c14649eed8a73dd691bc3b4e1bdc5596e6e0e55df" }, { "commands_change_state": "unknown", "id": "/frank/docs/operating/13-workflow-automation/", "last_verified": false, "layer": "auto", "markdown_url": "https://blog.derio.net/frank/docs/operating/13-workflow-automation/index.md", "prerequisites": [], "published": "2026-03-29", "reader_goal": "Check n8n health, add new instances, upgrade, and recover from database or runtime failures.", "related_building": "", "related_operating": "", "series": [ "operating" ], "source_path": "docs/operating/13-workflow-automation/index.md", "summary": "Managing n8n instances — health checks, database operations, adding instances, upgrading, and common issues.", "tags": [ "operations", "n8n", "workflow", "automation", "postgresql" ], "tested_versions": [], "title": "Operating on Workflow Automation", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/operating/13-workflow-automation/", "content_sha256": "cc6559675cb25e86c623126c97e84c3c49f0c22aca016d3ac4ad50c5d8fddf69" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/13-unified-auth/", "last_verified": false, "layer": "auth", "markdown_url": "https://blog.derio.net/frank/docs/building/13-unified-auth/index.md", "prerequisites": [], "published": "2026-03-11", "reader_goal": "Deploy Authentik as the cluster-wide IdP with three integration patterns (native OIDC, forward-auth proxy, OIDC kubectl) and work around blueprint syntax gotchas", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/13-unified-auth/index.md", "summary": "One identity provider for every service — Authentik brings OIDC SSO to ArgoCD, Grafana, and Infisical, forward-auth proxy to Longhorn, Hubble, and the Tekton Dashboard, and…", "tags": [ "authentik", "oidc", "sso", "security", "auth", "rbac", "traefik" ], "tested_versions": [], "title": "Unified Auth — Authentik SSO for the Entire Cluster", "updated": "2026-08-01", "url": "https://blog.derio.net/frank/docs/building/13-unified-auth/", "content_sha256": "809da45348406e26057666bc3663be9e18669b216b758f14cc8759f371e53f44" }, { "commands_change_state": "unknown", "id": "/frank/docs/papers/14-progressive-delivery/", "last_verified": false, "layer": "deploy", "markdown_url": "https://blog.derio.net/frank/docs/papers/14-progressive-delivery/index.md", "prerequisites": [], "published": "2026-05-19", "reader_goal": "", "related_building": "docs/building/19-progressive-delivery", "related_operating": "docs/operating/12-progressive-delivery", "series": [ "papers" ], "source_path": "docs/papers/14-progressive-delivery/index.md", "summary": "Progressive delivery is a four-job problem — staged exposure, metric-gated promotion, automated rollback, traffic routing — and the six contenders in 2026 (Argo Rollouts,…", "tags": [ "progressive-delivery", "argo-rollouts", "flagger", "service-mesh", "kubernetes" ], "tested_versions": [], "title": "Progressive Delivery & the Service-Mesh Tax", "updated": "2026-05-19", "url": "https://blog.derio.net/frank/docs/papers/14-progressive-delivery/", "content_sha256": "97ac937aeb17e5a5f9e6526bb53cd2542ba5bdfbd5154ec7e194adc50772dfbe" }, { "commands_change_state": "unknown", "id": "/frank/docs/operating/14-secure-agent-pod/", "last_verified": false, "layer": "agents", "markdown_url": "https://blog.derio.net/frank/docs/operating/14-secure-agent-pod/index.md", "prerequisites": [], "published": "2026-03-31", "reader_goal": "Connect to the secure agent pod via SSH and mosh, check s6-supervised service health, rotate secrets, and recover from OOM or crashloop states.", "related_building": "", "related_operating": "", "series": [ "operating" ], "source_path": "docs/operating/14-secure-agent-pod/index.md", "summary": "Day-to-day commands for managing the secure agent pod — SSH access, process health, s6-overlay supervision, VibeKanban, GitHub App token auth, and recovering from the gotchas…", "tags": [ "operations", "security", "agent", "claude", "ssh", "vibekanban", "cilium", "cron", "telegram", "monitoring", "troubleshooting" ], "tested_versions": [], "title": "Operating on Secure Agent Pod", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/operating/14-secure-agent-pod/", "content_sha256": "639a998d901edb711d61c454cb597d4f424f234c1cac634d83d5a9715bd20bb6" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/14-multi-tenancy/", "last_verified": false, "layer": "tenant", "markdown_url": "https://blog.derio.net/frank/docs/building/14-multi-tenancy/index.md", "prerequisites": [], "published": "2026-03-11", "reader_goal": "Deploy a vCluster virtual cluster on Talos with template-based ArgoCD pattern and work around the v0.32.1 chart schema gotchas", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/14-multi-tenancy/index.md", "summary": "Virtual Kubernetes clusters inside Frank — each one a disposable sandbox with its own control plane, resource quotas, and network policies, deployed via ArgoCD.", "tags": [ "vcluster", "multi-tenancy", "sandbox", "isolation", "argocd" ], "tested_versions": [], "title": "Multi-tenancy — Disposable Kubernetes Clusters with vCluster", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/building/14-multi-tenancy/", "content_sha256": "abc27352f1701ce4228193241275e2bdda2d50b919289dc9b84f5310f23db518" }, { "commands_change_state": "unknown", "id": "/frank/docs/papers/15-ingress-and-service-catalog/", "last_verified": false, "layer": "net", "markdown_url": "https://blog.derio.net/frank/docs/papers/15-ingress-and-service-catalog/index.md", "prerequisites": [], "published": "2026-05-22", "reader_goal": "", "related_building": "docs/building/24-in-cluster-ingress", "related_operating": "docs/operating/17-ingress", "series": [ "papers" ], "source_path": "docs/papers/15-ingress-and-service-catalog/index.md", "summary": "Ingress in 2026 is three jobs stacked — hostname routing and TLS, auth enforcement, and a catalogue humans can read — and six contenders (Traefik, Nginx, Contour/Gateway-API,…", "tags": [ "ingress", "traefik", "authentik", "forward-auth", "homepage", "service-catalog", "kubernetes" ], "tested_versions": [], "title": "Ingress, Forward-Auth, and the Service Catalog", "updated": "2026-05-22", "url": "https://blog.derio.net/frank/docs/papers/15-ingress-and-service-catalog/", "content_sha256": "3fa0b078723104d7abaa201519d35a122d02370a447f74ecbbd9556a8004a7f3" }, { "commands_change_state": "unknown", "id": "/frank/docs/operating/15-health-monitoring/", "last_verified": false, "layer": "obs", "markdown_url": "https://blog.derio.net/frank/docs/operating/15-health-monitoring/index.md", "prerequisites": [], "published": "2026-04-04", "reader_goal": "Verify feature health probes, manage file-provisioned Grafana alert rules, push test heartbeats, and debug silent Telegram delivery failures.", "related_building": "", "related_operating": "", "series": [ "operating" ], "source_path": "docs/operating/15-health-monitoring/index.md", "summary": "Day-to-day commands for managing feature health probes, heartbeat metrics, file-provisioned Grafana alerts, and Telegram notifications — including the silent delivery failures…", "tags": [ "operations", "observability", "blackbox-exporter", "pushgateway", "grafana", "telegram", "alerting", "troubleshooting" ], "tested_versions": [], "title": "Operating on Health Monitoring", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/operating/15-health-monitoring/", "content_sha256": "baf3b26d965e5dbeff4888102635eed96898cb847d9fa4d56f65f61bb6774a9f" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/15-paperclip/", "last_verified": false, "layer": "orch", "markdown_url": "https://blog.derio.net/frank/docs/building/15-paperclip/index.md", "prerequisites": [], "published": "2026-03-14", "reader_goal": "Deploy Paperclip on Talos as a pure upstream pod, work around probe deadlocks, PVC rollout deadlock, fsGroup permissions, and memory tuning, and learn what the retired shell sidecar and LiteLLM-routed agents taught before the 2026-10 fresh start", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/15-paperclip/index.md", "summary": "Deploying Paperclip — an AI orchestrator that organises agents into virtual companies with org charts and budgets — alongside Sympozium, to compare two fundamentally different…", "tags": [ "paperclip", "agents", "ai", "orchestration", "postgresql", "ghcr", "litellm", "opencode", "hermes" ], "tested_versions": [], "title": "Paperclip — An AI Agent Orchestrator on Frank", "updated": "2026-10-05", "url": "https://blog.derio.net/frank/docs/building/15-paperclip/", "content_sha256": "f8b0b027dfdcea811823532187b30a87f352e23922b591b8b7dcb1d426c6604f" }, { "commands_change_state": "unknown", "id": "/frank/docs/operating/16-health-bridge/", "last_verified": false, "layer": "obs", "markdown_url": "https://blog.derio.net/frank/docs/operating/16-health-bridge/index.md", "prerequisites": [], "published": "2026-04-04", "reader_goal": "Test the alert-to-GitHub webhook path, manage alert rule labels for bridge routing, and recover stranded project board tiles after a Grafana outage.", "related_building": "", "related_operating": "", "series": [ "operating" ], "source_path": "docs/operating/16-health-bridge/index.md", "summary": "Day-to-day commands for managing the health-bridge service — testing webhooks, managing alert labels, recovering stranded board tiles, and auto-closing healed bug issues.", "tags": [ "operations", "observability", "grafana", "github", "go", "alerting", "troubleshooting" ], "tested_versions": [], "title": "Operating on Health Bridge", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/operating/16-health-bridge/", "content_sha256": "92879022e66ec06c37bd2e6fef1bde21f11f3f31cc7ec3febfac177846efda0a" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/16-media-generation/", "last_verified": false, "layer": "media", "markdown_url": "https://blog.derio.net/frank/docs/building/16-media-generation/index.md", "prerequisites": [], "published": "2026-03-14", "reader_goal": "Deploy ComfyUI alongside Ollama on a single GPU with a GPU Switcher dashboard, working around ArgoCD self-heal and cross-compilation gotchas", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/16-media-generation/index.md", "summary": "Running ComfyUI for video, image, and audio generation on the same GPU as Ollama — with a custom GPU Switcher dashboard to manage time-sharing.", "tags": [ "comfyui", "diffusion", "gpu", "time-sharing", "video", "image", "audio", "go" ], "tested_versions": [], "title": "Media Generation — ComfyUI and GPU Time-Sharing", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/building/16-media-generation/", "content_sha256": "0fb1f1116bdd6ee6b3e6c84fd08e7bd4f6755c428230ffd030d9a6b62bc90754" }, { "commands_change_state": "unknown", "id": "/frank/docs/papers/17-agentic-orchestration/", "last_verified": false, "layer": "orch", "markdown_url": "https://blog.derio.net/frank/docs/papers/17-agentic-orchestration/index.md", "prerequisites": [], "published": "2026-05-20", "reader_goal": "", "related_building": "docs/building/21-secure-agent-pod", "related_operating": "docs/operating/14-secure-agent-pod", "series": [ "papers" ], "source_path": "docs/papers/17-agentic-orchestration/index.md", "summary": "Agent orchestration is a four-job problem — isolation, persistent state, access, and fleet dispatch — and the six contenders in 2026 (secure-agent-pod, VibeKanban, Paperclip +…", "tags": [ "agents", "orchestration", "secure-workstation", "vibekanban", "paperclip", "kubernetes" ], "tested_versions": [], "title": "Agentic Orchestration & Safe Agent Workstations", "updated": "2026-05-20", "url": "https://blog.derio.net/frank/docs/papers/17-agentic-orchestration/", "content_sha256": "6138a7e076f97e0ca5cea995a4a336dfa9a3165ea0a3e82453606a7c9a5c3975" }, { "commands_change_state": "unknown", "id": "/frank/docs/operating/17-ingress/", "last_verified": false, "layer": "net", "markdown_url": "https://blog.derio.net/frank/docs/operating/17-ingress/index.md", "prerequisites": [], "published": "2026-04-10", "reader_goal": "Diagnose a failing ingress route, renew a TLS certificate, and restart the Homepage dashboard.", "related_building": "", "related_operating": "", "series": [ "operating" ], "source_path": "docs/operating/17-ingress/index.md", "summary": "Checking Traefik routes, renewing ACME certificates, restarting Homepage, and debugging HTTP routing failures.", "tags": [ "operations", "ingress", "traefik", "acme", "homepage", "troubleshooting" ], "tested_versions": [], "title": "Operating on Ingress", "updated": "2026-08-03", "url": "https://blog.derio.net/frank/docs/operating/17-ingress/", "content_sha256": "b95f85c5ba6518502496052e5e07a3de912ba9e0cef2f4387e9eba37ea0f828b" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/17-public-edge/", "last_verified": false, "layer": "edge", "markdown_url": "https://blog.derio.net/frank/docs/building/17-public-edge/index.md", "prerequisites": [], "published": "2026-03-20", "reader_goal": "Deploy a single-node Talos edge cluster on Hetzner with Headscale mesh, Caddy reverse proxy, and Split-DNS — working around the ten deployment deviations", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/17-public-edge/index.md", "summary": "Deploying a single-node Talos cluster on Hetzner Cloud as a public edge — Headscale mesh, Caddy reverse proxy, and everything that went wrong along the way.", "tags": [ "hop", "hetzner", "talos", "headscale", "tailscale", "caddy", "edge", "mesh" ], "tested_versions": [], "title": "Hopping Through the Portal — A Public Edge Cluster", "updated": "2026-07-30", "url": "https://blog.derio.net/frank/docs/building/17-public-edge/", "content_sha256": "8d90bc5897d5e946d867aa10e02de7c49c8aede97ba05802d0ace9d003e271d1" }, { "commands_change_state": "unknown", "id": "/frank/docs/operating/18-paperclip/", "last_verified": false, "layer": "orch", "markdown_url": "https://blog.derio.net/frank/docs/operating/18-paperclip/index.md", "prerequisites": [], "published": "2026-04-09", "reader_goal": "Manage Paperclip day-to-day: health checks, database ops, secret sync, bootstrapping the first admin and a Claude-adapter agent on the pure-upstream instance, and common failure recovery.", "related_building": "", "related_operating": "", "series": [ "operating" ], "source_path": "docs/operating/18-paperclip/index.md", "summary": "Checking Paperclip health, database access and secret sync, handling the RWO PVC constraint, and bootstrapping the pure-upstream instance after the 2026-10 fresh start.", "tags": [ "operations", "paperclip", "ai-agents", "postgresql", "gpu-1", "litellm", "opencode", "hermes" ], "tested_versions": [], "title": "Operating on Paperclip", "updated": "2026-10-05", "url": "https://blog.derio.net/frank/docs/operating/18-paperclip/", "content_sha256": "688dd35bf011f5dc2f9e5469bf6e42fc919025305e2ee6f0cc1e9facd6553dbf" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/18-persistent-agent/", "last_verified": false, "layer": "agents", "markdown_url": "https://blog.derio.net/frank/docs/building/18-persistent-agent/index.md", "prerequisites": [], "published": "2026-03-24", "reader_goal": "Deploy a persistent Kali container on gpu-1 with SSH access, PVC-backed home directory, and headless Claude Code sessions", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/18-persistent-agent/index.md", "summary": "Deploying a persistent Kali Linux container on gpu-1 as an always-on Claude Code workstation — because laptops sleep and mobile apps have limits.", "tags": [ "kali", "claude", "agent", "ssh", "gpu-1", "persistent" ], "tested_versions": [], "title": "Persistent Agent — A Kali Workstation on Kubernetes", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/building/18-persistent-agent/", "content_sha256": "93f6476e527e8e1cb8e72c8014ad5d144fbe356a2cfb93ed105beff3ca3456ac" }, { "commands_change_state": "unknown", "id": "/frank/docs/operating/19-git-credentials-without-a-shell/", "last_verified": false, "layer": "agents", "markdown_url": "https://blog.derio.net/frank/docs/operating/19-git-credentials-without-a-shell/index.md", "prerequisites": [], "published": "2026-04-11", "reader_goal": "Fix git authentication in VS Code and non-interactive contexts inside the agent pod, without exposing credentials subprocess-wide.", "related_building": "", "related_operating": "", "series": [ "operating" ], "source_path": "docs/operating/19-git-credentials-without-a-shell/index.md", "summary": "Why $GITHUB_TOKEN is set in your terminal but missing in VS Code's git — and a credential helper that fixes it permanently by reading /proc/1/environ.", "tags": [ "operations", "secure-agent-pod", "git", "kubernetes", "secrets", "credentials" ], "tested_versions": [], "title": "Git Credentials Without a Shell", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/operating/19-git-credentials-without-a-shell/", "content_sha256": "55c70b1611b6e828bf43131c148409f7525e73cee3010d5d2ff257e47ada891d" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/19-progressive-delivery/", "last_verified": false, "layer": "deploy", "markdown_url": "https://blog.derio.net/frank/docs/building/19-progressive-delivery/index.md", "prerequisites": [], "published": "2026-03-27", "reader_goal": "Deploy Argo Rollouts with replica-count canary and blue-green strategies, and avoid the 5-bug cascade that silently defeated the initial Cilium-plugin approach", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/19-progressive-delivery/index.md", "summary": "Adding canary and blue-green deployment strategies to the cluster with Argo Rollouts — including a 39-day postmortem where the canary never actually ran.", "tags": [ "argo-rollouts", "canary", "blue-green", "cilium", "victoria-metrics", "litellm", "sympozium", "postmortem" ], "tested_versions": [], "title": "Progressive Delivery with Argo Rollouts", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/building/19-progressive-delivery/", "content_sha256": "73ab6b6c01d03fb909583ae2f0d70d23dd627943f2e1ce462e63ee8ee951b3ab" }, { "commands_change_state": "unknown", "id": "/frank/docs/papers/20-edge-clusters-public-exposure/", "last_verified": false, "layer": "edge", "markdown_url": "https://blog.derio.net/frank/docs/papers/20-edge-clusters-public-exposure/index.md", "prerequisites": [], "published": "2026-05-22", "reader_goal": "", "related_building": "docs/building/17-public-edge", "related_operating": "docs/operating/11-public-edge", "series": [ "papers" ], "source_path": "docs/papers/20-edge-clusters-public-exposure/index.md", "summary": "Public exposure from a home cluster is a five-job problem: NAT traversal, TLS termination, DNS, reverse proxy, mesh coordination. The 2026 vendor space splits on one question —…", "tags": [ "edge", "headscale", "cloudflare-tunnel", "tailscale", "talos", "caddy", "kubernetes" ], "tested_versions": [], "title": "Edge Clusters & Public Exposure", "updated": "2026-05-22", "url": "https://blog.derio.net/frank/docs/papers/20-edge-clusters-public-exposure/", "content_sha256": "45f371558954e74c3d4691246ebc4e9ed1380185e374bc33d89d7e684681f6e8" }, { "commands_change_state": "unknown", "id": "/frank/docs/operating/20-vk-relay/", "last_verified": false, "layer": "agents", "markdown_url": "https://blog.derio.net/frank/docs/operating/20-vk-relay/index.md", "prerequisites": [], "published": "2026-04-13", "reader_goal": "Verify the VK relay tunnel is up, re-pair a browser, diagnose 502s and missing workspace data.", "related_building": "", "related_operating": "", "series": [ "operating" ], "source_path": "docs/operating/20-vk-relay/index.md", "summary": "VK relay server health checks, tunnel status, re-pairing, and troubleshooting the browser-to-agent connection.", "tags": [ "operations", "agents", "vibekanban", "relay", "websocket", "troubleshooting" ], "tested_versions": [], "title": "Operating on VK Relay", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/operating/20-vk-relay/", "content_sha256": "2c78f3591973f713b44646a5cd9390e6f540af0f8bfaeda270db79c2b2ada8dc" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/20-workflow-automation/", "last_verified": false, "layer": "auto", "markdown_url": "https://blog.derio.net/frank/docs/building/20-workflow-automation/index.md", "prerequisites": [], "published": "2026-03-29", "reader_goal": "Deploy per-user n8n instances on gpu-1 with forward-auth SSO, persistent PostgreSQL, and Prometheus metrics", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/20-workflow-automation/index.md", "summary": "Deploying per-user n8n instances on gpu-1 for workflow automation — with Authentik forward-auth, dedicated PostgreSQL, and Prometheus metrics.", "tags": [ "n8n", "workflow", "automation", "agents", "gpu-1", "authentik", "postgresql" ], "tested_versions": [], "title": "Workflow Automation with n8n", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/building/20-workflow-automation/", "content_sha256": "1c7239d5e37ffdc6417cc165bab258a7316007f0336ee53b8ae8ed8e74a1fc5f" }, { "commands_change_state": "unknown", "id": "/frank/docs/operating/21-vk-remote/", "last_verified": false, "layer": "agents", "markdown_url": "https://blog.derio.net/frank/docs/operating/21-vk-remote/index.md", "prerequisites": [], "published": "2026-04-13", "reader_goal": "Verify the VK Remote stack is healthy, check ElectricSQL replication, re-trigger the init job, and diagnose sync failures.", "related_building": "", "related_operating": "", "series": [ "operating" ], "source_path": "docs/operating/21-vk-remote/index.md", "summary": "Self-hosted VK Remote stack — PostgreSQL health, ElectricSQL sync status, API verification, and troubleshooting.", "tags": [ "operations", "agents", "vibekanban", "postgresql", "electricsql" ], "tested_versions": [], "title": "Operating on VK Remote", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/operating/21-vk-remote/", "content_sha256": "a5adde0b4d48f97550ed5847be44afedd7e935adac74376a82f922712564a345" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/21-secure-agent-pod/", "last_verified": false, "layer": "agents", "markdown_url": "https://blog.derio.net/frank/docs/building/21-secure-agent-pod/index.md", "prerequisites": [], "published": "2026-03-31", "reader_goal": "Deploy a hardened non-root agent pod with layered security (non-root, dropped capabilities, Cilium egress, s6-overlay supervision) and a VibeKanban sidecar", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/21-secure-agent-pod/index.md", "summary": "Rebuilding the Kali workstation as a hardened, non-root pod with layered defenses — because giving an AI agent skip-permissions demands more than trust.", "tags": [ "security", "agent", "claude", "cilium", "ssh", "gpu-1", "vibekanban", "non-root", "cron", "telegram", "monitoring" ], "tested_versions": [], "title": "Secure Agent Pod — Hardening an AI Coding Workstation", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/building/21-secure-agent-pod/", "content_sha256": "38e8a7d128d1fb96927590c61f7a86aac089811bfcfc97b67e232af95910a6ee" }, { "commands_change_state": "unknown", "id": "/frank/docs/operating/22-cicd-platform/", "last_verified": false, "layer": "cicd", "markdown_url": "https://blog.derio.net/frank/docs/operating/22-cicd-platform/index.md", "prerequisites": [], "published": "2026-04-13", "reader_goal": "Check CI/CD health, trigger a pipeline run, verify an image signature, and debug a failed webhook delivery.", "related_building": "", "related_operating": "", "series": [ "operating" ], "source_path": "docs/operating/22-cicd-platform/index.md", "summary": "Gitea mirror syncs, Tekton pipeline runs, Zot registry health, cosign verification, and webhook delivery debugging.", "tags": [ "operations", "cicd", "gitea", "tekton", "zot", "cosign", "pipelines" ], "tested_versions": [], "title": "Operating on CI/CD Platform", "updated": "2026-07-29", "url": "https://blog.derio.net/frank/docs/operating/22-cicd-platform/", "content_sha256": "f26682cff29b25e9d9fa12e91011cc8512449766913d59d25565b5e320014bc6" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/22-health-monitoring/", "last_verified": false, "layer": "obs", "markdown_url": "https://blog.derio.net/frank/docs/building/22-health-monitoring/index.md", "prerequisites": [], "published": "2026-04-04", "reader_goal": "Deploy Blackbox Exporter + Pushgateway + Grafana alerting to monitor feature-level health (HTTP endpoints, cron heartbeats) and route alerts to Telegram", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/22-health-monitoring/index.md", "summary": "Adding feature-level health monitoring to the cluster — Blackbox probes for endpoints, Pushgateway for cron heartbeats, and Grafana alerting that fires to Telegram when things…", "tags": [ "observability", "blackbox-exporter", "pushgateway", "grafana", "telegram", "alerting", "victoriametrics" ], "tested_versions": [], "title": "Health Monitoring — Feature Probes, Heartbeats, and Telegram Alerts", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/building/22-health-monitoring/", "content_sha256": "003aff09ad9b38a6e8c5e5e5873e52faa99ae51163b5e40c4302beb4bd778a6f" }, { "commands_change_state": "unknown", "id": "/frank/docs/operating/23-argocd-drift-detective/", "last_verified": false, "layer": "gitops", "markdown_url": "https://blog.derio.net/frank/docs/operating/23-argocd-drift-detective/index.md", "prerequisites": [], "published": "2026-04-16", "reader_goal": "Diagnose and fix ArgoCD OutOfSync drift by classifying the root cause — CRD defaults, phantom diffs, orphan CRDs, zombie sub-charts, namespace fights, terminal hooks, and chart-operator disagreement.", "related_building": "", "related_operating": "", "series": [ "operating" ], "source_path": "docs/operating/23-argocd-drift-detective/index.md", "summary": "How 20 of 52 ArgoCD apps were permanently OutOfSync, why it was seven different bugs, and how fixing the noise unmasked a 21-day crashloop.", "tags": [ "operations", "argocd", "gitops", "debugging", "serverside-apply" ], "tested_versions": [], "title": "Operating on ArgoCD Drift", "updated": "2026-07-27", "url": "https://blog.derio.net/frank/docs/operating/23-argocd-drift-detective/", "content_sha256": "626bc51683cd455b59fd16b4a443770e9b3590dbf21e989dae16e23048aaeac6" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/23-health-bridge/", "last_verified": false, "layer": "obs", "markdown_url": "https://blog.derio.net/frank/docs/building/23-health-bridge/index.md", "prerequisites": [], "published": "2026-04-04", "reader_goal": "Deploy a Go webhook receiver that maps Grafana alerts to GitHub Project lifecycle states, bridging monitoring to project management", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/23-health-bridge/index.md", "summary": "A lightweight Go service that receives Grafana webhook alerts and automatically updates GitHub Project lifecycle states — turning monitoring signals into actionable project…", "tags": [ "observability", "grafana", "github", "go", "alerting", "automation", "argocd" ], "tested_versions": [], "title": "Health Bridge — Closing the Loop from Grafana Alerts to GitHub Issues", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/building/23-health-bridge/", "content_sha256": "436e5ee8f900a5801790e98c38b01b136ec5c84af359a3d28c32b5e74ad14f90" }, { "commands_change_state": "unknown", "id": "/frank/docs/operating/24-ruflo/", "last_verified": false, "layer": "orch", "markdown_url": "https://blog.derio.net/frank/docs/operating/24-ruflo/index.md", "prerequisites": [], "published": "2026-05-03", "reader_goal": "Connect to Ruflo, run a claude-flow swarm, manage shell tools, and recover from common failures (wrong LiteLLM key, upload 500s, SSH key bootstrap).", "related_building": "", "related_operating": "", "series": [ "operating" ], "source_path": "docs/operating/24-ruflo/index.md", "summary": "Connecting via SSH/Mosh, curating the inventory ConfigMap, bumping images, backups, and a worked swarm-run cookbook.", "tags": [ "operations", "ruflo", "ruvocal", "agent-shell-base", "ssh", "mosh", "litellm" ], "tested_versions": [], "title": "Operating on Ruflo", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/operating/24-ruflo/", "content_sha256": "699137f7a59c00349327c9a219e53eb4fb3a46767d69a04eeec69c8709d877d0" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/24-in-cluster-ingress/", "last_verified": false, "layer": "net", "markdown_url": "https://blog.derio.net/frank/docs/building/24-in-cluster-ingress/index.md", "prerequisites": [], "published": "2026-04-08", "reader_goal": "Deploy Traefik v3 as an in-cluster ingress controller with ACME wildcard TLS, Authentik forward-auth middlewares, and a gethomepage.dev dashboard", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/24-in-cluster-ingress/index.md", "summary": "Moving TLS termination and reverse proxying into the cluster with Traefik, Let's Encrypt wildcard certs, Authentik forward-auth, and a gethomepage.dev dashboard.", "tags": [ "networking", "traefik", "ingress", "tls", "acme", "authentik", "forward-auth", "homepage" ], "tested_versions": [], "title": "In-Cluster Ingress — Traefik, Wildcard TLS, and a Homepage Dashboard", "updated": "2026-08-03", "url": "https://blog.derio.net/frank/docs/building/24-in-cluster-ingress/", "content_sha256": "d4eccdd8c6410c3cbcaf89e3f5dc8e6bf38f0ff133d113bc532f5a2b03167de6" }, { "commands_change_state": "unknown", "id": "/frank/docs/operating/25-frank-papers/", "last_verified": false, "layer": "repo", "markdown_url": "https://blog.derio.net/frank/docs/operating/25-frank-papers/index.md", "prerequisites": [], "published": "2026-05-18", "reader_goal": "Scaffold a new Paper, pass the dossier gate, write prose with the five shortcodes, generate a cover image, and publish.", "related_building": "", "related_operating": "", "series": [ "operating" ], "source_path": "docs/operating/25-frank-papers/index.md", "summary": "Scaffolding a paper, getting the dossier past the gate, the five papers/ shortcodes, cover-image generation, and the publish flow.", "tags": [ "operations", "papers", "blog", "hugo", "dossier", "mermaid", "research" ], "tested_versions": [], "title": "Operating The Frank Papers — Research, Dossiers, and Publishing", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/operating/25-frank-papers/", "content_sha256": "6c9293de5d290962878bc5d080a3615628ea1ef9920655fa6822603d450c9e8c" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/25-vk-relay/", "last_verified": false, "layer": "agents", "markdown_url": "https://blog.derio.net/frank/docs/building/25-vk-relay/index.md", "prerequisites": [], "published": "2026-04-13", "reader_goal": "Deploy a VibeKanban relay sidecar that tunnels the remote web UI to the local agent's workspace data via WebSocket + yamux multiplexing", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/25-vk-relay/index.md", "summary": "Deploying a relay server sidecar to tunnel the VK remote web UI through to the local agent's workspace data — because a dashboard that cannot show your work is not a dashboard.", "tags": [ "agents", "vibekanban", "relay", "websocket", "sidecar", "traefik", "yamux" ], "tested_versions": [], "title": "VK Relay — Tunneling the Browser to a Local Agent Server", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/building/25-vk-relay/", "content_sha256": "e6e6d6e5ce6fc7415393da1daaaf8092c8261aefff90a9147fe711342d6ac8f2" }, { "commands_change_state": "unknown", "id": "/frank/docs/operating/26-edge-observability/", "last_verified": false, "layer": "obs", "markdown_url": "https://blog.derio.net/frank/docs/operating/26-edge-observability/index.md", "prerequisites": [], "published": "2026-05-24", "reader_goal": "Query VictoriaLogs, ban an IP via CrowdSec, tune Falco noise, check GoatCounter analytics, and trigger a digest manually.", "related_building": "", "related_operating": "", "series": [ "operating" ], "source_path": "docs/operating/26-edge-observability/index.md", "summary": "Querying the blog log stream, banning a scraper before lunch, tuning Falco out of kube-system noise, and triggering a digest by hand.", "tags": [ "operations", "observability", "victoria-logs", "goatcounter", "crowdsec", "falco", "grafana", "hop" ], "tested_versions": [], "title": "Operating Edge Observability", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/operating/26-edge-observability/", "content_sha256": "e124570a91fb7a24d5759db2a60376b4744b11f7cead08dd42d9758392f927b3" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/26-vk-remote-self-host/", "last_verified": false, "layer": "agents", "markdown_url": "https://blog.derio.net/frank/docs/building/26-vk-remote-self-host/index.md", "prerequisites": [], "published": "2026-04-13", "reader_goal": "Deploy a self-hosted VibeKanban remote backend with PostgreSQL + ElectricSQL real-time sync, Rust/Axum API, and Authentik SSO", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/26-vk-remote-self-host/index.md", "summary": "The VibeKanban cloud announced shutdown with 30 days' notice. This is how we deployed the self-hosted remote crate — PostgreSQL, ElectricSQL, and a Rust API — before the lights…", "tags": [ "agents", "vibekanban", "postgresql", "electricsql", "rust", "axum", "authentik", "self-hosting" ], "tested_versions": [], "title": "VK Remote — Self-Hosting the Kanban Backend Before the Cloud Dies", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/building/26-vk-remote-self-host/", "content_sha256": "a2ce85741fa03cffd3eecf3002db7543d0a91086fe8155c0f2eefb989e41ad25" }, { "commands_change_state": "unknown", "id": "/frank/docs/operating/27-automation/", "last_verified": false, "layer": "auto", "markdown_url": "https://blog.derio.net/frank/docs/operating/27-automation/index.md", "prerequisites": [], "published": "2026-06-03", "reader_goal": "Onboard a new host to AWX, read a failed job, rotate the OIDC secret, and break-glass when SSO is down.", "related_building": "", "related_operating": "", "series": [ "operating" ], "source_path": "docs/operating/27-automation/index.md", "summary": "Onboarding a new host, reading a failed job, rotating the OIDC secret, and getting back in when SSO is the thing that broke.", "tags": [ "operations", "awx", "ansible", "automation", "authentik", "oidc", "postgresql" ], "tested_versions": [], "title": "Operating Automation — Day-to-Day Commands for AWX", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/operating/27-automation/", "content_sha256": "3ff8ffdf6d6bad4e418bf197df9b2ce2460bde2d31ab2208d0ec9e1bd8cb7274" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/27-cicd-platform/", "last_verified": false, "layer": "cicd", "markdown_url": "https://blog.derio.net/frank/docs/building/27-cicd-platform/index.md", "prerequisites": [], "published": "2026-04-13", "reader_goal": "Deploy Gitea + Tekton + Zot + cosign on a single worker node, with pull mirrors, webhook-driven pipelines, OCI registry, and supply chain signing", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/27-cicd-platform/index.md", "summary": "Deploying a full Kubernetes-native CI/CD platform on pc-1 — Gitea for git mirroring, Tekton for pipelines, Zot for container images, and cosign for supply chain signing.", "tags": [ "cicd", "gitea", "tekton", "zot", "cosign", "oci", "pipelines", "supply-chain", "kaniko" ], "tested_versions": [], "title": "CI/CD Platform — Gitea, Tekton, Zot, and Cosign", "updated": "2026-07-15", "url": "https://blog.derio.net/frank/docs/building/27-cicd-platform/", "content_sha256": "e39c0edb8d0fc2a8086f44029a07180ea29c22e730f89233f988336b1336e0f6" }, { "commands_change_state": "unknown", "id": "/frank/docs/operating/28-hermes-shell/", "last_verified": false, "layer": "agents", "markdown_url": "https://blog.derio.net/frank/docs/operating/28-hermes-shell/index.md", "prerequisites": [], "published": "2026-07-11", "reader_goal": "Verify Hindsight memory health, back up and restore the memory database, diagnose retain-vs-recall failures, and connect via SSH/Mosh.", "related_building": "", "related_operating": "", "series": [ "operating" ], "source_path": "docs/operating/28-hermes-shell/index.md", "summary": "Checking the Hindsight memory sidecar's health, the two-tier memory backup story, the claude-code retain provider, and the pg_restore mechanic.", "tags": [ "operations", "hermes", "nous-research", "agents", "litellm", "hindsight", "sidecar", "postgres", "pgvector", "memory", "ssh" ], "tested_versions": [], "title": "Operating the Hermes Shell With Its Hindsight Memory Sidecar", "updated": "2026-07-27", "url": "https://blog.derio.net/frank/docs/operating/28-hermes-shell/", "content_sha256": "027c13c5200026b27f55ac365eac92f18d28bf4eb7755e8771824c4c711b75fb" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/28-agent-images-sidecar/", "last_verified": false, "layer": "cicd", "markdown_url": "https://blog.derio.net/frank/docs/building/28-agent-images-sidecar/index.md", "prerequisites": [], "published": "2026-04-18", "reader_goal": "Split a monolithic agent pod into a sidecar architecture with multi-repo CI, matrix builds, and cross-repo dispatch for lockstep image bumps", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/28-agent-images-sidecar/index.md", "summary": "Splitting VibeKanban out of the Kali agent pod into a shared-volume sidecar, and moving Dockerfiles into a new multi-image repo with matrix CI and cross-repo dispatch.", "tags": [ "agents", "docker", "sidecar", "github-actions", "multi-stage", "cross-repo-dispatch", "rust-embed" ], "tested_versions": [], "title": "Agent Images and the VK-Local Sidecar — Unbaking VibeKanban", "updated": "2026-07-16", "url": "https://blog.derio.net/frank/docs/building/28-agent-images-sidecar/", "content_sha256": "5c6a60703eaa74dbc04ba17f45c10d11fb4da7d8aa3167c0a453f8caed5c0758" }, { "commands_change_state": "unknown", "id": "/frank/docs/operating/29-metrics-api/", "last_verified": false, "layer": "obs", "markdown_url": "https://blog.derio.net/frank/docs/operating/29-metrics-api/index.md", "prerequisites": [], "published": "2026-07-25", "reader_goal": "Verify metrics-server health, add a CPU/mem HPA, and diagnose an empty kubectl top.", "related_building": "", "related_operating": "", "series": [ "operating" ], "source_path": "docs/operating/29-metrics-api/index.md", "summary": "How to check the resource Metrics API is healthy, add a CPU/mem HPA, and diagnose the one failure mode where the pod is Ready but top is empty.", "tags": [ "operations", "metrics-server", "metrics-api", "hpa", "kubectl-top", "talos", "obs" ], "tested_versions": [], "title": "Operating the Metrics API — kubectl top, HPAs, and the Silent-Empty Failure", "updated": "2026-08-03", "url": "https://blog.derio.net/frank/docs/operating/29-metrics-api/", "content_sha256": "de147f7e821d0bad69237c1d44cf34366eadcd2abd979cbb36adf853601dc6d1" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/29-ruflo/", "last_verified": false, "layer": "orch", "markdown_url": "https://blog.derio.net/frank/docs/building/29-ruflo/index.md", "prerequisites": [], "published": "2026-05-03", "reader_goal": "Deploy a dual-container agent orchestrator pod with s6-overlay, LiteLLM virtual-key auth, inventory ConfigMap, and swarm-style agent orchestration", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/29-ruflo/index.md", "summary": "Standing up ruvnet's claude-flow as a 24/7 hybrid pod — a ruvocal web UI plus a shell sidecar — to run as the chaotic-swarm counterpoint to Paperclip's org-chart agents.", "tags": [ "ruflo", "ruvocal", "claude-flow", "agents", "ai", "orchestration", "agent-shell-base", "litellm", "openrouter", "s6-overlay" ], "tested_versions": [], "title": "Ruflo — A Swarm Orchestrator Next to Paperclip", "updated": "2026-07-16", "url": "https://blog.derio.net/frank/docs/building/29-ruflo/", "content_sha256": "5918cc29ec418baa9dce619f3db82603c49257e3f03be3aae5be9b423d40c192" }, { "commands_change_state": "unknown", "id": "/frank/docs/operating/30-silent-failure/", "last_verified": false, "layer": "obs", "markdown_url": "https://blog.derio.net/frank/docs/operating/30-silent-failure/index.md", "prerequisites": [], "published": "2026-07-27", "reader_goal": "Verify that a green ArgoCD tile, a Synced Application and a quiet alert stack reflect reality — and know which artifact to assert on for each of the five ways they do not", "related_building": "", "related_operating": "", "series": [ "operating" ], "source_path": "docs/operating/30-silent-failure/index.md", "summary": "Five ways a healthy dashboard lies — wrong artifact, unconsumed signal, out of scope, stale view, never applied — and the command that checks each", "tags": [ "operations", "argocd", "victoriametrics", "longhorn", "tekton", "alerting", "debugging", "obs" ], "tested_versions": [], "title": "Operating on Green", "updated": "2026-09-19", "url": "https://blog.derio.net/frank/docs/operating/30-silent-failure/", "content_sha256": "62fbc6bda44b9de581b83f59b3eb3754b30e23cbeecd0d2e01a43ec8a730af37" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/30-frank-papers/", "last_verified": false, "layer": "repo", "markdown_url": "https://blog.derio.net/frank/docs/building/30-frank-papers/index.md", "prerequisites": [], "published": "2026-05-18", "reader_goal": "Set up a multi-series Hugo paper infrastructure with dossier gate, cross-series linking, custom shortcodes, and agent-executable workflows", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/30-frank-papers/index.md", "summary": "A third blog series — research-grade landscape reviews framed as decisions, gated behind a committed dossier before any paper can be drafted.", "tags": [ "papers", "blog", "hugo", "hextra", "mermaid", "dossier", "research", "shortcodes" ], "tested_versions": [], "title": "Building The Frank Papers — Research Infrastructure for a Third Series", "updated": "2026-08-03", "url": "https://blog.derio.net/frank/docs/building/30-frank-papers/", "content_sha256": "d9752c0153cd518e32cb82103ea5282d247e47776c69a7a847ec66092d7b4e8c" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/31-edge-observability/", "last_verified": false, "layer": "obs", "markdown_url": "https://blog.derio.net/frank/docs/building/31-edge-observability/index.md", "prerequisites": [], "published": "2026-05-24", "reader_goal": "Deploy cross-cluster observability with log shipping, blog analytics, CrowdSec edge security, Falco runtime security, and an AI alert helper", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/31-edge-observability/index.md", "summary": "Collectors on Hop, backend on Frank, AI alert enrichment that knows when 12x baseline is a scraper and when it is Hacker News.", "tags": [ "observability", "victoria-logs", "fluent-bit", "goatcounter", "crowdsec", "falco", "grafana", "litellm", "hop", "talos", "caddy", "fastapi", "tdd" ], "tested_versions": [], "title": "Edge Observability — Watching Frank's Edge Without Watching Frank's Edge Burn", "updated": "2026-07-16", "url": "https://blog.derio.net/frank/docs/building/31-edge-observability/", "content_sha256": "61151dd43c3f347f502dad026c3300c6cff8b9d3b23d3fd77b7af3a1ded20950" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/32-automation/", "last_verified": false, "layer": "auto", "markdown_url": "https://blog.derio.net/frank/docs/building/32-automation/index.md", "prerequisites": [], "published": "2026-06-03", "reader_goal": "Deploy AWX via awx-operator with Authentik SSO, two CrashLoop fixes, and a smoke-test ping against a non-Talos host", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/32-automation/index.md", "summary": "An Ansible controller for the home-lab boxes Talos and ArgoCD cannot reach — two operators, four CrashLoops, a login page with no login, and a ping that finally said pong.", "tags": [ "awx", "ansible", "automation", "authentik", "oidc", "argocd", "operator", "postgresql", "talos", "auto" ], "tested_versions": [], "title": "Building Automation — AWX, the Imperative Counterweight", "updated": "2026-07-16", "url": "https://blog.derio.net/frank/docs/building/32-automation/", "content_sha256": "25f902ce34f3bfb4d410e0f5d23cd6d8c6efeef07e3d67509565bb4d97b258a5" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/33-hermes-shell/", "last_verified": false, "layer": "agents", "markdown_url": "https://blog.derio.net/frank/docs/building/33-hermes-shell/index.md", "prerequisites": [], "published": "2026-07-11", "reader_goal": "Rebuild an agent pod on the official upstream image with three containers, self-hosted Hindsight memory backend, and five layered failure fixes", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/33-hermes-shell/index.md", "summary": "Retiring the custom agent-shell image and rebuilding hermes on Nous Research's official hermes-agent image as a three-container pod — bare official image, an SSH sidecar, and a…", "tags": [ "hermes", "nous-research", "agents", "ai", "litellm", "hindsight", "sidecar", "postgres", "pgvector", "memory", "ssh" ], "tested_versions": [], "title": "Rebuilding the Hermes Shell on the Official Image, With a Hindsight Memory Sidecar", "updated": "2026-07-16", "url": "https://blog.derio.net/frank/docs/building/33-hermes-shell/", "content_sha256": "718e3c224c68cd035501d5038c34513268cff4292225bc8d27667c7eabea14ee" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/34-first-vcluster-tenant/", "last_verified": false, "layer": "tenant", "markdown_url": "https://blog.derio.net/frank/docs/building/34-first-vcluster-tenant/index.md", "prerequisites": [], "published": "2026-07-20", "reader_goal": "Register a vCluster as an ArgoCD cluster target — and get the workloads deployed into it — without crashing the application-controller, plus recover if it already crashed.", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/34-first-vcluster-tenant/index.md", "summary": "Registering a vCluster as an ArgoCD cluster target crashed every app I run. The fix is six lines, and the order you apply them in matters.", "tags": [ "vcluster", "argocd", "multi-tenancy", "gitops", "external-secrets", "debugging" ], "tested_versions": [], "title": "The First Real Tenant: A vCluster That ArgoCD Deploys Into", "updated": "2026-07-20", "url": "https://blog.derio.net/frank/docs/building/34-first-vcluster-tenant/", "content_sha256": "862807a88bad4fb1fee95246e426fc1fd10fe2095f06fc50a006c2920bc65180" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/35-gitea-actions-ci/", "last_verified": false, "layer": "cicd", "markdown_url": "https://blog.derio.net/frank/docs/building/35-gitea-actions-ci/index.md", "prerequisites": [], "published": "2026-07-20", "reader_goal": "Run your GitHub Actions workflows unchanged on a self-hosted Gitea mirror — runner, status writeback, parallel-safety — and diagnose the three failure modes that bite.", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/35-gitea-actions-ci/index.md", "summary": "GitHub Actions burned its free tier in 19 days, so the workflows now run on Frank's Gitea mirrors — same YAML, new engine, statuses flowing back", "tags": [ "gitea-actions", "ci", "github-actions", "gitea", "tekton", "argocd", "cost" ], "tested_versions": [], "title": "CI on the Mirrors: Gitea Actions", "updated": "2026-07-27", "url": "https://blog.derio.net/frank/docs/building/35-gitea-actions-ci/", "content_sha256": "8e7b907485b7cec4c5fbf57ed40841b9a458f227e5be4728f4867609a54ac4fc" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/36-metrics-api/", "last_verified": false, "layer": "obs", "markdown_url": "https://blog.derio.net/frank/docs/building/36-metrics-api/index.md", "prerequisites": [], "published": "2026-07-25", "reader_goal": "Serve the aggregated resource Metrics API on a Talos cluster with metrics-server, and know when NOT to route it through your TSDB", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/36-metrics-api/index.md", "summary": "kubectl top was dead for months because nothing served metrics.k8s.io. The fix was one Talos flag and a decision I almost got wrong: build the fancy thing, or the right thing.", "tags": [ "metrics-server", "metrics-api", "hpa", "kubectl-top", "talos", "argocd", "victoriametrics", "obs" ], "tested_versions": [], "title": "The Metrics API — Teaching Frank to Read His Own Vitals", "updated": "2026-08-01", "url": "https://blog.derio.net/frank/docs/building/36-metrics-api/", "content_sha256": "cf945847e61b77fed8b5b590e4c137d82a5611a155bcb1581be93b7e850b528c" }, { "commands_change_state": "unknown", "id": "/frank/docs/building/37-igpu-retrieval-tier/", "last_verified": false, "layer": "infer", "markdown_url": "https://blog.derio.net/frank/docs/building/37-igpu-retrieval-tier/index.md", "prerequisites": [], "published": "2026-08-02", "reader_goal": "Claim an integrated GPU for an inference workload on Kubernetes via DRA, and prove the accelerator is earning its place with a control arm", "related_building": "", "related_operating": "", "series": [ "building" ], "source_path": "docs/building/37-igpu-retrieval-tier/index.md", "summary": "Embeddings and reranking on my control plane's idle Arc iGPUs via Kubernetes DRA, plus the CPU control arm that decided whether the accelerator earned it", "tags": [ "dra", "resourceclaim", "intel-arc", "igpu", "openvino", "embeddings", "rerank", "talos", "infer" ], "tested_versions": [], "title": "Retrieval on the Idle iGPUs", "updated": "2026-08-02", "url": "https://blog.derio.net/frank/docs/building/37-igpu-retrieval-tier/", "content_sha256": "53b959d308cfc52ddecbdf3b8dbcf20aa9746448950042ae678a22212d684500" }, { "commands_change_state": "unknown", "id": "/frank/topics/choosing-infrastructure/", "last_verified": false, "layer": "", "markdown_url": "https://blog.derio.net/frank/topics/choosing-infrastructure/index.md", "prerequisites": [], "published": "2026-09-05", "reader_goal": "", "related_building": "", "related_operating": "", "series": [], "source_path": "topics/choosing-infrastructure/index.md", "summary": "Networking, storage, recovery, and delivery decisions under real constraints.", "tags": [], "tested_versions": [], "title": "Choosing infrastructure", "updated": "2026-09-05", "url": "https://blog.derio.net/frank/topics/choosing-infrastructure/", "content_sha256": "d0b2e7836a84c73c122e0e7ff5704352e7d0e215257a804f3cbcb1618a7c73c8" }, { "commands_change_state": "unknown", "id": "/frank/topics/debugging-kubernetes/", "last_verified": false, "layer": "", "markdown_url": "https://blog.derio.net/frank/topics/debugging-kubernetes/index.md", "prerequisites": [], "published": "2026-09-05", "reader_goal": "", "related_building": "", "related_operating": "", "series": [], "source_path": "topics/debugging-kubernetes/index.md", "summary": "Understand what a healthy status actually proves, and find the checks that matter.", "tags": [], "tested_versions": [], "title": "Debugging Kubernetes", "updated": "2026-09-05", "url": "https://blog.derio.net/frank/topics/debugging-kubernetes/", "content_sha256": "0a3246c54f9af442bf96597a7d6bd9d8f70bd5c8ab0ebd4ff5973b3c47bc6882" }, { "commands_change_state": "unknown", "id": "/frank/about/agents/", "last_verified": false, "layer": "", "markdown_url": "https://blog.derio.net/frank/about/agents/index.md", "prerequisites": [], "published": "2026-09-05", "reader_goal": "", "related_building": "", "related_operating": "", "series": [], "source_path": "about/agents/index.md", "summary": "Discover and retrieve Frank articles through a versioned JSON catalog, Markdown exports, stable section links, and RSS.", "tags": [], "tested_versions": [], "title": "Read Frank with an agent", "updated": "2026-09-05", "url": "https://blog.derio.net/frank/about/agents/", "content_sha256": "284fc7a08fbc2539c95bc1fc5a3008e24c641ca488ed02c2ef6a3894353b6ce4" }, { "commands_change_state": "unknown", "id": "/frank/topics/running-local-ai/", "last_verified": false, "layer": "", "markdown_url": "https://blog.derio.net/frank/topics/running-local-ai/index.md", "prerequisites": [], "published": "2026-09-05", "reader_goal": "", "related_building": "", "related_operating": "", "series": [], "source_path": "topics/running-local-ai/index.md", "summary": "Put mixed GPUs to work, serve models, and manage inference workloads.", "tags": [], "tested_versions": [], "title": "Running local AI", "updated": "2026-09-05", "url": "https://blog.derio.net/frank/topics/running-local-ai/", "content_sha256": "86c337b14c4ea49e8af843f2d4d31df7f7257286e633d1b06eb173ab82fa0d77" }, { "commands_change_state": "unknown", "id": "/frank/topics/securing-agents/", "last_verified": false, "layer": "", "markdown_url": "https://blog.derio.net/frank/topics/securing-agents/index.md", "prerequisites": [], "published": "2026-09-05", "reader_goal": "", "related_building": "", "related_operating": "", "series": [], "source_path": "topics/securing-agents/index.md", "summary": "Workstations, orchestration, identity, and the boundaries around autonomous tools.", "tags": [], "tested_versions": [], "title": "Securing and operating agents", "updated": "2026-09-05", "url": "https://blog.derio.net/frank/topics/securing-agents/", "content_sha256": "4577797fd5b9200136d013f0759e33eac912c85c23fe82574a6601d934dfafd7" } ], "schema_version": 1, "site": "https://blog.derio.net/frank/" }