Work on the Just-based operational entry points in the home-ops repository. Use when adding or modifying recipes in the root `.justfile` or any `**/mod.just`, adjusting mod-group wiring, aligning command flows with repo workflows, or validating how operators should run existing commands. Do not use this skill for domain logic changes when the recipe definitions themselves are untouched.
Plan and implement non-platform Flux-managed application workloads in the home-ops repository. Use when adding a new app under kubernetes/apps/selfhosted or another non-platform app subtree, reshape ks.yaml or app manifests, choose chart, dependency, security, storage, or routing patterns, wire routine app-level ExternalSecret or VolSync settings into a workload, or validate application changes that do not redesign the networking, external-secrets, or volsync-system platforms.
Work on Renovate tracking and dependency update behavior in the home-ops repository. Use when modifying .renovaterc.json5 or its imported fragments under .renovate/, preserve or add inline
Modify shared networking platform resources in the home-ops repository. Use when changing Envoy Gateway, Gateway API resources, Cloudflare Tunnel, ExternalDNS, Cilium LB-IPAM / L2 announcement, cluster-wide CiliumNetworkPolicy baseline, networking Flux ordering, or shared ingress behavior in kubernetes/apps/networking. Do not use this skill for routine application routes that do not alter the platform exposure chain.
Work on Flux and shared GitOps wiring in the home-ops repository. Use when modifying kubernetes/flux resources, Flux bootstrap files, Flux-managed cluster variables, flux-system add-ons such as GitHub webhooks, or shared Kustomization dependency wiring above one specific app. Do not use this skill for routine app manifest edits that stay inside a single application subtree.
Work on shared secret delivery in the home-ops repository. Use when modifying the external-secrets platform, 1Password Connect, the `onepassword-connect` ClusterSecretStore, or non-routine app-level ExternalSecret wiring and validation patterns that depend on the shared secret delivery model. Do not use this skill for routine app edits that merely consume an unchanged Secret.
Review security posture and hardening changes in the home-ops repository. Use when assessing real exploitability, blast radius, exposure surface, detection gaps, or hardening regressions across Kubernetes, Flux, secrets, networking, Cloudflare, or Just-driven operational workflows. Do not use this skill for open-ended destructive testing or for ordinary implementation work with no explicit security angle.
Work on backup and restore behavior in the home-ops repository using VolSync and Kopia. Use when integrating non-trivial app backup settings, change shared schedule, jitter, retention, or storage defaults, inspect ReplicationSource behavior, trigger maintenance or snapshot flows, or perform or review restore workflows driven by the `just volsync` recipes. Do not use this skill for unrelated secret delivery changes.