Homelab v6

Every infrastructure change is a commit; the nodes pull it themselves on an hourly timer. Secrets are encrypted with SOPS and age and decrypted only at deploy time, Authentik is the single sign-on in front of every service, and backups follow 3-2-1 with restic.

The part worth defending in an interview is the coverage check: it fails loudly when data silently leaves the backup set. It exists because a backup that reports success while capturing nothing is the failure nobody notices — and on its first run it found a database that had been backed up for weeks without a consistent dump.