#Tag
Posts tagged "gitops"
A healthy deployment is not a reachable one
On 2026-09-02 a new service behind my lab's Traefik gateway was Ready by every check it could run on itself, and every request from outside died at the gateway's own egress policy. Readiness, routing and network policy each cover a different part of the path a request takes, and only the whole path is reachability.
Observe first, deny second
Everyone writes network policy from the architecture diagram, and the diagram is always wrong. The only allowlist that survives contact with production is one written from the flows you actually watched - applied out-of-band, proven enforcing, and only then handed to GitOps.
The first secret is the one you can't commit
Secrets management has a bootstrap paradox: the credential that pulls every other secret can't itself live in git. Here's how a homelab fleet breaks the cycle - zero plaintext secrets in any repo, and a clean rule for which is the one exception.
Shipping this site: GitOps from a homelab to the public internet
How this portfolio is built and served - Astro to a container image, a self-hosted Gitea registry, Argo CD, and a Cloudflare Tunnel - with security as acceptance criteria, not polish.