Self-hosted Kubernetes platform across home and cloud

A Talos Kubernetes cluster across home nodes and a cloud VPS, with single sign-on, DNS, tunnels and encrypted secrets, all managed as code.

Context and problem

Services run on hardware at home and on a cloud VPS. They must be reachable from outside, use one login, and keep no secrets in plain text.

Talos Linux, three control-plane nodes and one worker at home, one cloud worker over a WireGuard mesh (KubeSpan).
Flux GitOps: cluster state is reconciled from the repository.
Two Traefik ingress controllers: internal (home) and external. Cloudflare Tunnel (cloudflared, two replicas) for external access.
Authentik as identity provider; OIDC bootstrap jobs configure Paperless, n8n, Node-RED and Home Assistant.
Secrets encrypted with SOPS and age, stored in the repository.
Longhorn for replicated storage; CloudNativePG for PostgreSQL.
Talos upgrades run automatically through Renovate and an in-cluster executor.