https://blogs.law.harvard.edu/tech/rss https://this-is-fine.io/tags/gateway-api/ Recent content in Gateway-API on Fuchsbau https://this-is-fine.io/tags/gateway-api/ https://source.unsplash.com/2000x1322/?fox 1440 Hugo 0.125.4 de-DE Wed, 20 May 2026 22:26:11 UT https://this-is-fine.io/posts/20251122-envoy-gateway-headscale-routes/ Sat, 22 Nov 2025 08:00:00 UT ff0x https://this-is-fine.io/posts/20251122-envoy-gateway-headscale-routes/ The lab used to run Traefik with its own CRDs (IngressRoute, Middleware, and friends). Gateway API standardises routes; Envoy Gateway is the controller here — one Helm install, three shared Gateways, and per-app HTTPRoute resources instead of Traefik-only objects. Traefik is excellent at the edge, but its CRDs are controller-specific. Moving to Gateway API was less about feature envy and more about portability: the same HTTPRoute can be read by another implementation if you ever switch controllers. Envoy Gateway is the implementation here; the routes stay standard Kubernetes objects. Infrastructure https://this-is-fine.io/posts/20251121-irc-inspircd-znc/ Fri, 21 Nov 2025 10:00:00 UT ff0x https://this-is-fine.io/posts/20251121-irc-inspircd-znc/ IRC is still a simple model: one server, many channels, text over a long-lived TCP session. InspIRCd runs the network; ZNC is a bouncer that stays logged in when your client disconnects and replays backlog when you return. In the lab both are plain Deployments under Flux, with TLS from cert-manager and a Gateway API TCPRoute for TLS on port 6697. IRC is a good contrast to HTTP-only homelab apps: clients expect a long-lived TCP session and often TLS on a non-443 port. Gateway API TCPRoute covers that without bolting IRC into an HTTP ingress controller as a special case. Infrastructure https://this-is-fine.io/posts/20251121-tailscale-headscale-mesh/ Fri, 21 Nov 2025 09:00:00 UT ff0x https://this-is-fine.io/posts/20251121-tailscale-headscale-mesh/ Tailscale builds a WireGuard mesh with little configuration. Headscale is an open control server for the same clients — you run policy and issue keys yourself. The lab does not use the Tailscale Kubernetes operator; a handful of Deployments and DaemonSets do the job instead. The goal is one tailnet for laptops and nodes, with Kubernetes APIs and internal HTTP on *.tif.internal without putting those names on the public internet. Self-hosting the control plane means you own ACL files, preauth keys, and MagicDNS base domains. The trade-off is operational work: upgrades, backups, and policy edits are yours. For a multi-cluster lab that already runs GitOps everywhere else, that trade-off is acceptable. Infrastructure