📜 HomeLab Chronicles: Episode 6 - Source of Truth

Hey all 👋 Last episode a power cut exposed an uncomfortable fact: my cluster's entire memory lived in one SQLite-flavored database, on one laptop, bound to one Wi-Fi address, guarded by one aging battery. Four single points of failure in a trench coat. The fix isn't making that database unkillable. The fix is making it unimportant . If every manifest lives in git and something reconciles the cluster against git continuously, then "the datastore died" stops being a tragedy and becomes a reboot with extra steps. So: Flux . Here's the setup, and the four ways I face-planted installing it. 🗂️ The Shape of the Repo clusters/homelab/ flux-system/ <- Flux writes this at bootstrap; hands off infrastructure.yaml <- points at infrastructure/ apps.yaml <- points at apps/ infrastructure/ controllers/ <- Longhorn + Envoy Gateway HelmReleases configs/ <- GatewayClass, Gateway, StorageClasses apps/homelab/ airflow/ <- the actual point of all this Three Flux Kustomizations, chained: infra-controllers → infra-configs → apps , via dependsOn . That chaining is not decoration. My GatewayClass can't exist until Envoy Gateway's CRDs exist, and the CRDs arrive with the controller's Helm chart. Without dependsOn , Flux sprints ahead, tries to create a GatewayClass into a cluster that's never heard of GatewayClasses, and fails with the enthusiasm of a golden retriever running into a glass door. dependsOn plus wait: true turns that into: install controllers, wait until healthy , then configs, then apps. Boring. Sequential. Correct. The three great virtues. 🔑 Sidequest 1: The Token Bureaucracy flux bootstrap github needs a GitHub token, and the docs-diving summary is: Classic PAT: repo scope. Needed if Flux should create the repo. Fine-grained PAT (pre-created repo): Contents read/write, Metadata read, and — the one everyone misses — Administration read/write , because Flux installs an SSH deploy key on the repo, and deploy keys are an admin operation. Here's the nice part: the deploy key is