home-ops

Work on the Just-based operational entry points in the home-ops repository. Use when adding or modifying recipes in the root `.justfile` or any `**/mod.just`, adjusting mod-group wiring, aligning command flows with repo workflows, or validating how operators should run existing commands. Do not use this skill for domain logic changes when the recipe definitions themselves are untouched.

Plan and implement non-platform Flux-managed application workloads in the home-ops repository. Use when adding a new app under kubernetes/apps/selfhosted or another non-platform app subtree, reshape ks.yaml or app manifests, choose chart, dependency, security, storage, or routing patterns, wire routine app-level ExternalSecret or VolSync settings into a workload, or validate application changes that do not redesign the networking, external-secrets, or volsync-system platforms.

Work on Renovate tracking and dependency update behavior in the home-ops repository. Use when modifying .renovaterc.json5 or its imported fragments under .renovate/, preserve or add inline

Modify shared networking platform resources in the home-ops repository. Use when changing Envoy Gateway, Gateway API resources, Cloudflare Tunnel, ExternalDNS, Cilium LB-IPAM / L2 announcement, cluster-wide CiliumNetworkPolicy baseline, networking Flux ordering, or shared ingress behavior in kubernetes/apps/networking. Do not use this skill for routine application routes that do not alter the platform exposure chain.

Work on Flux and shared GitOps wiring in the home-ops repository. Use when modifying kubernetes/flux resources, Flux bootstrap files, Flux-managed cluster variables, flux-system add-ons such as GitHub webhooks, or shared Kustomization dependency wiring above one specific app. Do not use this skill for routine app manifest edits that stay inside a single application subtree.

Work on shared secret delivery in the home-ops repository. Use when modifying the external-secrets platform, 1Password Connect, the `onepassword-connect` ClusterSecretStore, or non-routine app-level ExternalSecret wiring and validation patterns that depend on the shared secret delivery model. Do not use this skill for routine app edits that merely consume an unchanged Secret.

Review security posture and hardening changes in the home-ops repository. Use when assessing real exploitability, blast radius, exposure surface, detection gaps, or hardening regressions across Kubernetes, Flux, secrets, networking, Cloudflare, or Just-driven operational workflows. Do not use this skill for open-ended destructive testing or for ordinary implementation work with no explicit security angle.

Work on backup and restore behavior in the home-ops repository using VolSync and Kopia. Use when integrating non-trivial app backup settings, change shared schedule, jitter, retention, or storage defaults, inspect ReplicationSource behavior, trigger maintenance or snapshot flows, or perform or review restore workflows driven by the `just volsync` recipes. Do not use this skill for unrelated secret delivery changes.

Review high-level design choices in the home-ops repository. Use when evaluating tradeoffs, compare implementation approaches, assess whether a proposed change fits existing repo principles, or recommend a direction before any manifests, Terraform, or Just recipes are edited. Do not use this skill for direct implementation work.

Work on the Cloudflare Terraform area in the home-ops repository. Use when modifying provision/cloudflare Terraform resources, file layout, the `just cloudflare` recipes, or credential and validation flows tied to Cloudflare DNS, tunnel, workers, redirects, pages, or zone configuration.

Debug operational issues in the home-ops repository and cluster. Use when investigating failed reconciliations, unhealthy workloads, routing failures, secret sync issues, backup or restore problems, or other Kubernetes and infrastructure symptoms where evidence and root cause matter more than immediate implementation. Do not use this skill for planned code changes without an active debugging angle.