Split deployment: k3s single-node (build-box) + Docker Compose (NAS) Build-box: Vault, Keycloak, GitLab, Runner via Helm on k3s NAS: Zot registry mirror, Garage S3, cosign-signer via Docker Compose See install/build-box/README.md for architecture details.