The big moments in Jothia and Jovery's life

The finale: a disaster-recovery model where only one key is precious, an 8-step rebuild runbook verified twice, a cross-region migration, how to actually read the Azure bill, and trimming cost by swapping disk tiers.

The reusable patterns that make new apps a copy-paste: a stateless static-site template, the shared-Postgres pattern, Headlamp delegating RBAC to the API server, keeping a password manager stateless with a sealed RSA key, and Miniflux OIDC plus an Azure Postgres extension gotcha.

One login for every app: a lightweight LDAP directory (LLDAP) plus Authelia doing both forward-auth and OIDC, global default-protect with a bypass list, provisioning 2FA without email, and the three authentication patterns you end up mixing.

Why I keep state out of the cluster: the storage landscape for Kubernetes, what local-path really costs you, one shared managed Postgres with a database per app, why no Redis, and a three-way storage strategy.

How to put encrypted secrets directly in Git with SealedSecrets: how the asymmetric sealing works, sealing and handing off a secret, and the one key you must back up offline or lose everything.

One wildcard certificate for every subdomain via cert-manager and ACME DNS-01, writing a custom webhook solver when your DNS provider has none, serving it everywhere with a Traefik default TLSStore, and making Traefik itself highly available.

Installing Argo CD, connecting a private repo, the App-of-Apps bootstrap, Kustomize base plus overlay, CI that builds images and bumps tags, private image pulls, and having Argo CD manage its own installation.

A companion story to the Self-Hosted k3s on Azure series: how adding a VMSS to a load balancer backend pool in the Azure portal silently reimaged all three nodes and wiped etcd, why it happened, and the four changes that made it impossible again.

Provisioning the whole cluster as code: one Standard Load Balancer carrying everything, burstable VMs with no public IP, and a cloud-init that bootstraps a k3s HA control plane while keeping etcd on a separate, reimage-safe data disk.