Backlog

✓ Done

• Hugo documentation site (CS/EN), see This site,
• public at svejklab.dev via Cloudflare Tunnel, see Public site,
• SSH from anywhere via Tailscale and k9s on the server, see Remote access,
• GitOps: GitHub Actions → GHCR → Flux, see CI/CD and GitOps.

1. Monitoring

• kube-prometheus-stack in a lightweight setup (alertmanager.enabled=false, 7-day retention, ~1 Gi memory limit) or the lighter victoria-metrics-k8s-stack,
• deployed through Flux (HelmRelease),
• Grafana via Tailscale only, not public.

2. Custom MCP server

• image from GitHub Actions to GHCR, deployed through Flux like the site,
• access via Tailscale only.

3. Backups

• k3s: /var/lib/rancher/k3s/server/db and /var/lib/rancher/k3s/server/token,
• application data on the 1 TB SSHD, backups to the Synology NAS.

4. Pipeline maintenance

• automated update PRs for GitHub Actions, Hugo and image versions (Dependabot or Renovate),
• renew the ghcr-pull token once a year.

5. Certifications

CKAD (Kubernetes v1.35):

• every exercise in its own namespace,
• imperative style: k run, k create … --dry-run=client -o yaml,
• topics: Jobs/CronJobs, probes, resources and LimitRange, ConfigMap and Secret, NetworkPolicy, multi-container pods, Helm, rollout and rollback,
• finally 2× killer.sh.

CKA (later):

• KVM/multipass VMs with kubeadm (control plane 2 vCPU / 2.5 GB, worker 2 vCPU / 2 GB),
• cluster upgrade, etcd backup and restore.