unorouter revenue stack. Three Talos Linux control planes on Hetzner (node11, node12, node13, nbg1, cx43) on their own WireGuard mesh, no provider network, no SSH; Cilium without kube-proxy, ArgoCD app-of-apps, CloudNativePG with PITR to Hetzner Object Storage, ClickHouse for the gateway logs, OpenBao, ESO, cloudflared, kube-prometheus-stack, Loki, Vector, Tetragon.
Everything enters through the Cloudflare tunnel. Two firewalls in series allow Tailscale, the
WireGuard mesh and ICMP, nothing else: Hetzner's in front of the NIC and Talos's own on the
node (talos/patches/firewall.yaml), which alone protects a node outside Hetzner. Every daily action is a named, expiring Teleport session;
nothing standing lives on a laptop.
export KUBECONFIG=~/.kube/teleport-unorouter.yaml # systemd --user unit tsh-kube
kubectl get nodes| Topic | |
|---|---|
| Access and break-glass | kubectl, psql, OpenBao, nodes, Teleport, what to do when SSO is down |
| Operations | DNS, tofu, node disk, gotchas, deploying a service, pod isolation, rotating secrets, upgrading |
| Monitoring | rules, pollers, responders, logs, the Cloudflare edge |
| DR runbook | backups, rebuild from nothing, node swap, quorum loss, switchover |
| Nodes | machine configs, image, adding a node |
| incidents/ | post-mortems |
After cloning: git config core.hooksPath .githooks (gitleaks, sops encryption check and an alert routing check on every commit).