https://blog.derio.net/frank/Building, operating, and deciding: an AI-hybrid Kubernetes homelab with Talos Linux, Cilium, Longhorn, ArgoCD, and GPU computehttps://blog.derio.net/frank/docs/building/37-igpu-retrieval-tier/https://blog.derio.net/frank/docs/building/37-igpu-retrieval-tier/Sun, 02 Aug 2026 00:00:00 +0000Embeddings and reranking on my control plane's idle Arc iGPUs via Kubernetes DRA, plus the CPU control arm that decided whether the accelerator earned ithttps://blog.derio.net/frank/docs/operating/30-silent-failure/https://blog.derio.net/frank/docs/operating/30-silent-failure/Mon, 27 Jul 2026 00:00:00 +0000Five ways a healthy dashboard lies — wrong artifact, unconsumed signal, out of scope, stale view, never applied — and the command that checks eachhttps://blog.derio.net/frank/docs/building/36-metrics-api/https://blog.derio.net/frank/docs/building/36-metrics-api/Sat, 25 Jul 2026 00:00:00 +0000kubectl top was dead for months because nothing served metrics.k8s.io. The fix was one Talos flag and a decision I almost got wrong: build the fancy thing, or the right thing.https://blog.derio.net/frank/docs/operating/29-metrics-api/https://blog.derio.net/frank/docs/operating/29-metrics-api/Sat, 25 Jul 2026 00:00:00 +0000How to check the resource Metrics API is healthy, add a CPU/mem HPA, and diagnose the one failure mode where the pod is Ready but top is empty.https://blog.derio.net/frank/docs/building/35-gitea-actions-ci/https://blog.derio.net/frank/docs/building/35-gitea-actions-ci/Mon, 20 Jul 2026 00:00:00 +0000GitHub Actions burned its free tier in 19 days, so the workflows now run on Frank's Gitea mirrors — same YAML, new engine, statuses flowing backhttps://blog.derio.net/frank/docs/building/34-first-vcluster-tenant/https://blog.derio.net/frank/docs/building/34-first-vcluster-tenant/Mon, 20 Jul 2026 00:00:00 +0000Registering a vCluster as an ArgoCD cluster target crashed every app I run. The fix is six lines, and the order you apply them in matters.https://blog.derio.net/frank/docs/building/33-hermes-shell/https://blog.derio.net/frank/docs/building/33-hermes-shell/Sat, 11 Jul 2026 00:00:00 +0000Retiring the custom agent-shell image and rebuilding hermes on Nous Research's official hermes-agent image as a three-container pod — bare official image, an SSH sidecar, and a…https://blog.derio.net/frank/docs/operating/28-hermes-shell/https://blog.derio.net/frank/docs/operating/28-hermes-shell/Sat, 11 Jul 2026 00:00:00 +0000Checking the Hindsight memory sidecar's health, the two-tier memory backup story, the claude-code retain provider, and the pg_restore mechanic.https://blog.derio.net/frank/docs/building/32-automation/https://blog.derio.net/frank/docs/building/32-automation/Wed, 03 Jun 2026 00:00:00 +0000An Ansible controller for the home-lab boxes Talos and ArgoCD cannot reach — two operators, four CrashLoops, a login page with no login, and a ping that finally said pong.https://blog.derio.net/frank/docs/operating/27-automation/https://blog.derio.net/frank/docs/operating/27-automation/Wed, 03 Jun 2026 00:00:00 +0000Onboarding a new host, reading a failed job, rotating the OIDC secret, and getting back in when SSO is the thing that broke.https://blog.derio.net/frank/docs/building/31-edge-observability/https://blog.derio.net/frank/docs/building/31-edge-observability/Sun, 24 May 2026 00:00:00 +0000Collectors on Hop, backend on Frank, AI alert enrichment that knows when 12x baseline is a scraper and when it is Hacker News.https://blog.derio.net/frank/docs/operating/26-edge-observability/https://blog.derio.net/frank/docs/operating/26-edge-observability/Sun, 24 May 2026 00:00:00 +0000Querying the blog log stream, banning a scraper before lunch, tuning Falco out of kube-system noise, and triggering a digest by hand.https://blog.derio.net/frank/docs/papers/20-edge-clusters-public-exposure/https://blog.derio.net/frank/docs/papers/20-edge-clusters-public-exposure/Fri, 22 May 2026 00:00:00 +0000Public exposure from a home cluster is a five-job problem: NAT traversal, TLS termination, DNS, reverse proxy, mesh coordination. The 2026 vendor space splits on one question —…https://blog.derio.net/frank/docs/papers/15-ingress-and-service-catalog/https://blog.derio.net/frank/docs/papers/15-ingress-and-service-catalog/Fri, 22 May 2026 00:00:00 +0000Ingress in 2026 is three jobs stacked — hostname routing and TLS, auth enforcement, and a catalogue humans can read — and six contenders (Traefik, Nginx, Contour/Gateway-API,…https://blog.derio.net/frank/docs/papers/01-heterogeneous-hardware/https://blog.derio.net/frank/docs/papers/01-heterogeneous-hardware/Fri, 22 May 2026 00:00:00 +0000Same boxes or different boxes? Six fleet shapes split on that one question — all-RPi, all-NUC, heterogeneous bare metal, edge+core, single beefy server + VMs, full-cloud…https://blog.derio.net/frank/docs/papers/17-agentic-orchestration/https://blog.derio.net/frank/docs/papers/17-agentic-orchestration/Wed, 20 May 2026 00:00:00 +0000Agent orchestration is a four-job problem — isolation, persistent state, access, and fleet dispatch — and the six contenders in 2026 (secure-agent-pod, VibeKanban, Paperclip +…https://blog.derio.net/frank/docs/papers/13-self-hosted-cicd/https://blog.derio.net/frank/docs/papers/13-self-hosted-cicd/Wed, 20 May 2026 00:00:00 +0000Self-hosted CI/CD is a choice between one tool or three. The six contenders in 2026 — Gitea+Tekton+Zot, GitLab CE, Forgejo+Woodpecker, Drone CI, Jenkins, and the SaaS baseline…https://blog.derio.net/frank/docs/papers/09-secrets-bootstrap/https://blog.derio.net/frank/docs/papers/09-secrets-bootstrap/Wed, 20 May 2026 00:00:00 +0000Secrets management is a five-job problem — storage, distribution, rotation, audit, and the bootstrap chicken-and-egg — and the six contenders in 2026 (Infisical, ESO +…https://blog.derio.net/frank/docs/papers/08-backup-dr/https://blog.derio.net/frank/docs/papers/08-backup-dr/Wed, 20 May 2026 00:00:00 +0000Kubernetes backup & DR is a five-job problem — API-object capture, volume capture, application-consistency hooks, offsite shipment, credential restore — and the six contenders…https://blog.derio.net/frank/docs/papers/05-gpu-scheduling/https://blog.derio.net/frank/docs/papers/05-gpu-scheduling/Wed, 20 May 2026 00:00:00 +0000GPU scheduling on Kubernetes is a four-job problem — driver lifecycle, device discovery, allocation, partitioning — and the six contenders in 2026 (NVIDIA GPU Operator, Intel…https://blog.derio.net/frank/docs/papers/03-ebpf-networking/https://blog.derio.net/frank/docs/papers/03-ebpf-networking/Wed, 20 May 2026 00:00:00 +0000Six options dominate Kubernetes networking in 2026 — Cilium, Calico, kube-proxy + iptables, Istio, Linkerd2, and the cloud-managed VPC CNI — and they split on two axes:…https://blog.derio.net/frank/docs/papers/14-progressive-delivery/https://blog.derio.net/frank/docs/papers/14-progressive-delivery/Tue, 19 May 2026 00:00:00 +0000Progressive delivery is a four-job problem — staged exposure, metric-gated promotion, automated rollback, traffic routing — and the six contenders in 2026 (Argo Rollouts,…https://blog.derio.net/frank/docs/papers/11-identity-heterogeneous-stack/https://blog.derio.net/frank/docs/papers/11-identity-heterogeneous-stack/Tue, 19 May 2026 00:00:00 +0000Ten web UIs, three CLIs, and a gRPC service all want to ask the same question: who's on the other side of this URL? The identity-provider slot has seven serious vendors —…https://blog.derio.net/frank/docs/papers/10-self-hosted-inference/https://blog.derio.net/frank/docs/papers/10-self-hosted-inference/Tue, 19 May 2026 00:00:00 +0000Inference is a build-versus-buy question dressed up in GPU language. The engine tier (Ollama, vLLM, llama.cpp, TGI) decides whether the model runs on your metal; the gateway…https://blog.derio.net/frank/docs/papers/07-observability-honestly/https://blog.derio.net/frank/docs/papers/07-observability-honestly/Tue, 19 May 2026 00:00:00 +0000Cluster observability is a five-job problem — metrics, logs, traces, dashboards, alerts — and the six contenders in 2026 (Grafana+Prometheus+Loki, VictoriaMetrics, Mimir,…https://blog.derio.net/frank/docs/papers/06-gitops-at-small-scale/https://blog.derio.net/frank/docs/papers/06-gitops-at-small-scale/Tue, 19 May 2026 00:00:00 +0000GitOps on Kubernetes is a four-jobs-in-one bundle — reconcile, drift- detect, gate write access, audit — and the six contenders in 2026 (ArgoCD, Flux v2, Jenkins X,…https://blog.derio.net/frank/docs/papers/04-distributed-storage/https://blog.derio.net/frank/docs/papers/04-distributed-storage/Tue, 19 May 2026 00:00:00 +0000Distributed storage on bare-metal Kubernetes is a four-job problem — synchronous replication, snapshots, off-cluster backup, RWX — and the six contenders in 2026 (Longhorn,…https://blog.derio.net/frank/docs/papers/02-immutable-os/https://blog.derio.net/frank/docs/papers/02-immutable-os/Tue, 19 May 2026 00:00:00 +0000Immutable OS for Kubernetes nodes is a four-job problem — read-only root, transactional updates, declarative config, and (at the strict end) no SSH at all — and the six 2026…https://blog.derio.net/frank/docs/building/30-frank-papers/https://blog.derio.net/frank/docs/building/30-frank-papers/Mon, 18 May 2026 00:00:00 +0000A third blog series — research-grade landscape reviews framed as decisions, gated behind a committed dossier before any paper can be drafted.https://blog.derio.net/frank/docs/operating/25-frank-papers/https://blog.derio.net/frank/docs/operating/25-frank-papers/Mon, 18 May 2026 00:00:00 +0000Scaffolding a paper, getting the dossier past the gate, the five papers/ shortcodes, cover-image generation, and the publish flow.https://blog.derio.net/frank/docs/papers/00-why-homelab-in-2026/https://blog.derio.net/frank/docs/papers/00-why-homelab-in-2026/Mon, 18 May 2026 00:00:00 +0000Three philosophies dominate infrastructure decisions in 2026: cloud (pay the bill, ignore the metal), managed homelab-as-code (own the iron, outsource lifecycle), and DIY…https://blog.derio.net/frank/docs/building/29-ruflo/https://blog.derio.net/frank/docs/building/29-ruflo/Sun, 03 May 2026 00:00:00 +0000Standing up ruvnet's claude-flow as a 24/7 hybrid pod — a ruvocal web UI plus a shell sidecar — to run as the chaotic-swarm counterpoint to Paperclip's org-chart agents.https://blog.derio.net/frank/docs/operating/24-ruflo/https://blog.derio.net/frank/docs/operating/24-ruflo/Sun, 03 May 2026 00:00:00 +0000Connecting via SSH/Mosh, curating the inventory ConfigMap, bumping images, backups, and a worked swarm-run cookbook.https://blog.derio.net/frank/docs/building/28-agent-images-sidecar/https://blog.derio.net/frank/docs/building/28-agent-images-sidecar/Sat, 18 Apr 2026 00:00:00 +0000Splitting VibeKanban out of the Kali agent pod into a shared-volume sidecar, and moving Dockerfiles into a new multi-image repo with matrix CI and cross-repo dispatch.https://blog.derio.net/frank/docs/operating/23-argocd-drift-detective/https://blog.derio.net/frank/docs/operating/23-argocd-drift-detective/Thu, 16 Apr 2026 00:00:00 +0000How 20 of 52 ArgoCD apps were permanently OutOfSync, why it was seven different bugs, and how fixing the noise unmasked a 21-day crashloop.https://blog.derio.net/frank/docs/building/27-cicd-platform/https://blog.derio.net/frank/docs/building/27-cicd-platform/Mon, 13 Apr 2026 00:00:00 +0000Deploying a full Kubernetes-native CI/CD platform on pc-1 — Gitea for git mirroring, Tekton for pipelines, Zot for container images, and cosign for supply chain signing.https://blog.derio.net/frank/docs/building/26-vk-remote-self-host/https://blog.derio.net/frank/docs/building/26-vk-remote-self-host/Mon, 13 Apr 2026 00:00:00 +0000The VibeKanban cloud announced shutdown with 30 days' notice. This is how we deployed the self-hosted remote crate — PostgreSQL, ElectricSQL, and a Rust API — before the lights…https://blog.derio.net/frank/docs/building/25-vk-relay/https://blog.derio.net/frank/docs/building/25-vk-relay/Mon, 13 Apr 2026 00:00:00 +0000Deploying a relay server sidecar to tunnel the VK remote web UI through to the local agent's workspace data — because a dashboard that cannot show your work is not a dashboard.https://blog.derio.net/frank/docs/operating/22-cicd-platform/https://blog.derio.net/frank/docs/operating/22-cicd-platform/Mon, 13 Apr 2026 00:00:00 +0000Gitea mirror syncs, Tekton pipeline runs, Zot registry health, cosign verification, and webhook delivery debugging.https://blog.derio.net/frank/docs/operating/21-vk-remote/https://blog.derio.net/frank/docs/operating/21-vk-remote/Mon, 13 Apr 2026 00:00:00 +0000Self-hosted VK Remote stack — PostgreSQL health, ElectricSQL sync status, API verification, and troubleshooting.https://blog.derio.net/frank/docs/operating/20-vk-relay/https://blog.derio.net/frank/docs/operating/20-vk-relay/Mon, 13 Apr 2026 00:00:00 +0000VK relay server health checks, tunnel status, re-pairing, and troubleshooting the browser-to-agent connection.https://blog.derio.net/frank/docs/operating/19-git-credentials-without-a-shell/https://blog.derio.net/frank/docs/operating/19-git-credentials-without-a-shell/Sat, 11 Apr 2026 00:00:00 +0000Why $GITHUB_TOKEN is set in your terminal but missing in VS Code's git — and a credential helper that fixes it permanently by reading /proc/1/environ.https://blog.derio.net/frank/docs/operating/17-ingress/https://blog.derio.net/frank/docs/operating/17-ingress/Fri, 10 Apr 2026 00:00:00 +0000Checking Traefik routes, renewing ACME certificates, restarting Homepage, and debugging HTTP routing failures.https://blog.derio.net/frank/docs/operating/18-paperclip/https://blog.derio.net/frank/docs/operating/18-paperclip/Thu, 09 Apr 2026 00:00:00 +0000Checking Paperclip health, database access and secret sync, handling the RWO PVC constraint, and bootstrapping the pure-upstream instance after the 2026-10 fresh start.https://blog.derio.net/frank/docs/building/24-in-cluster-ingress/https://blog.derio.net/frank/docs/building/24-in-cluster-ingress/Wed, 08 Apr 2026 00:00:00 +0000Moving TLS termination and reverse proxying into the cluster with Traefik, Let's Encrypt wildcard certs, Authentik forward-auth, and a gethomepage.dev dashboard.https://blog.derio.net/frank/docs/building/23-health-bridge/https://blog.derio.net/frank/docs/building/23-health-bridge/Sat, 04 Apr 2026 00:00:00 +0000A lightweight Go service that receives Grafana webhook alerts and automatically updates GitHub Project lifecycle states — turning monitoring signals into actionable project…https://blog.derio.net/frank/docs/building/22-health-monitoring/https://blog.derio.net/frank/docs/building/22-health-monitoring/Sat, 04 Apr 2026 00:00:00 +0000Adding feature-level health monitoring to the cluster — Blackbox probes for endpoints, Pushgateway for cron heartbeats, and Grafana alerting that fires to Telegram when things…https://blog.derio.net/frank/docs/operating/16-health-bridge/https://blog.derio.net/frank/docs/operating/16-health-bridge/Sat, 04 Apr 2026 00:00:00 +0000Day-to-day commands for managing the health-bridge service — testing webhooks, managing alert labels, recovering stranded board tiles, and auto-closing healed bug issues.https://blog.derio.net/frank/docs/operating/15-health-monitoring/https://blog.derio.net/frank/docs/operating/15-health-monitoring/Sat, 04 Apr 2026 00:00:00 +0000Day-to-day commands for managing feature health probes, heartbeat metrics, file-provisioned Grafana alerts, and Telegram notifications — including the silent delivery failures…https://blog.derio.net/frank/docs/building/21-secure-agent-pod/https://blog.derio.net/frank/docs/building/21-secure-agent-pod/Tue, 31 Mar 2026 00:00:00 +0000Rebuilding the Kali workstation as a hardened, non-root pod with layered defenses — because giving an AI agent skip-permissions demands more than trust.