Verify

Goal: confirm every layer works together. Run each check; any failure points back to its phase.

Checks

DNS split: public services resolve to the VPS, everything else to the LAN gateway.

dig +short grafana.madhan.app    # 178.156.199.250
dig +short headlamp.madhan.app   # 192.168.1.220

OpenBao is unsealed.

kubectl exec -n openbao openbao-0 -c openbao -- bao status | grep Sealed   # false

Mesh: in the NetBird UI, Peers shows bifrost-agent and k8s-routing-peer connected; Routes shows 192.168.1.0/24 active.
SSO: open https://grafana.madhan.app, sign in with GitHub through Authentik, land in Grafana.
Apps: every Argo CD application is Synced and Healthy.
Terminal window
```
kubectl get applications -n argocd
```

Failing check	Go back to
DNS	Phase 3
Sealed	Phase 2
Peers or route	Phase 6
SSO	Phase 4, Phase 7
Applications	Phase 8, Troubleshooting

LAN access without the Hetzner hop

Public hostnames resolve to the VPS for every client, LAN included, so LAN traffic leaves the house and comes back through the tunnel. Override the record locally to go straight to the gateway:

192.168.1.220  grafana.madhan.app

Details: Traffic flow, Exposure.