/deploy

name: deploy
description: "Deploy and infrastructure: web deploy, dev branches, cron, package install, shell configuration."
user-invocable: true
allowed-tools:
  - Read
  - Write
  - Bash
  - Grep
  - Glob
  - Edit
  - Agent
routing:
  force_route: true
  not_for: "Kubernetes or Helm (use kubernetes skill), Ansible (agents handle directly), code review (use review), security scanning (use security)"
  triggers:
    - "deploy website"
    - "deploy site"
    - "go live"
    - "public site"
    - "public website"
    - "static site"
    - "landing page"
    - "make it public"
    - "make public"
    - "set up https"
    - "nginx public site"
    - "host a website"
    - "use my domain"
    - "website online"
    - "put online"
    - "put this online"
    - "put site online"
    - "serve this website"
    - "point my domain"
    - "dev branch"
    - "deploy to dev"
    - "dev lane"
    - "create cron job"
    - "scheduled task"
    - "cron safety"
    - "background automation"
    - "fish shell"
    - "config.fish"
    - "zsh"
    - ".zshrc"
    - "shell cleanup"
    - "background process"
    - "nohup"
    - "trap handler"
  category: infrastructure
  pairs_with:
    - assessment
    - kubernetes
    - pr-workflow

Deploy Skill

Six modes. Match the request to a section.

| Signal | Section | |--------|---------| | Deploy site, HTTPS, nginx, go live, public site | A. Public Web Deploy | | Dev branch, Concourse dev lane, hermes/maia | B. Dev-Branch Deploy | | Cron job, scheduled task, audit cron script | C. Cron Automation | | Headless agent, wrapper script, recurring Claude task | D. Headless Cron Creator | | Install toolkit, verify setup, health check | E. Toolkit Install | | Fish shell, Zsh, shell config, migration | F. Shell Configuration | | Background process, nohup, trap, PID, signals | G. Process Management |

When the request spans modes, compose the relevant sections.

---

A. Public Web Deploy

Serve public sites through nginx/Caddy/Apache -- never a raw dev server. Local preview binds `127.0.0.1`; public sites require HTTPS + hardened nginx.

**5-phase workflow**: DNS -> Web Server -> HTTPS -> Hardening -> Verify.

1. **DNS**: Create A/AAAA record. Verify: `dig +short A <fqdn>`. Gate: resolves to intended IP. 2. **Web Server**: nginx server block with explicit docroot. Backend proxied to `127.0.0.1`. Test: `nginx -t && systemctl reload nginx`. 3. **HTTPS**: `certbot --nginx -d <fqdn>`. Verify renewal: `certbot renew --dry-run`. Verify redirect: `curl -sI http://<fqdn> | grep -iE '301|308'`. 4. **Hardening**: Firewall (ufw allow 80/443/SSH only), nginx deny rules (`location ~ /\. { deny all; }`), security headers (HSTS, X-Content-Type-Options, CSP in Report-Only), rate limiting (`limit_req`), fail2ban. 5. **Verify**: Run the 13-item security checklist. Spot-check: `curl -s https://<fqdn>/.env -w '%{http_code}\n'` (expect 403/404), `ss -tlnp` (no app ports public).

Load `references/public-web-deploy.md` for the full 13-item checklist, nginx config blocks, and error handling.

---

B. Dev-Branch Deploy

Test Hermes or Maia stack changes in a live lab region before merging to master via Concourse `dev` lane.

1. **Preflight**: Verify dev branch on both repos + pipeline wired. 2. **Merge feature into dev branch**: `git checkout <stack>-dev-branch && git merge --no-ff origin/<feature> && git push`. Never force-push. 3. **Validate**: Dev lane green. `fly -t <target> watch -j <stack>/deploy-to-dev-<region>`. 4. **Merge to master** via PR after dev validation.

Load `references/dev-branch-deploy.md` for stack parameters, preflight commands, and pipeline regeneration.

---

C. Cron Automation

Static analysis of cron scripts against a 9-point reliability checklist. Read-only -- never execute scripts.

1. **DISCOVER**: Locate scripts in `scripts/*.sh`, `cron/*.sh`, `jobs/*.sh`. Verify shell shebang. 2. **AUDIT**: Run all 9 checks via regex (verify matches not in comments):

| # | Check | Severity | Key patterns | |---|-------|----------|-------------| | 1 | Error handling | CRITICAL | `set -e`, `set -o errexit` | | 2 | Exit code checking | HIGH | `$?`, `if [ $? -eq` | | 3 | Logging with timestamps | HIGH | `>> *.log`, `$(date)` | | 4 | Log rotation | MEDIUM | `find -mtime -delete`, `logrotate` | | 5 | Working directory | HIGH | `cd "$(dirname"`, `SCRIPT_DIR=` | | 6 | PATH environment | MEDIUM | `PATH=`, `export PATH` | | 7 | Lock file / concurrency | HIGH | `.lock`, `flock`, `.pid` | | 8 | Cleanup on exit | MEDIUM | `trap ... EXIT` | | 9 | Failure notification | LOW | `mail -s`, `curl *webhook` |

3. **REPORT**: Per-script scores with paste-ready fixes for every FAIL/WARN. Aggregate summary for multi-script audits.

Load `references/cron-automation.md` for the best-practices reference script.

---

D. Headless Cron Creator

Create headless Claude Code cron jobs. All crontab mutations go through `crontab-manager.py`.

1. **PARSE**: Extract name (kebab-case), prompt, schedule, workdir, budget ($2.00 default). 2. **GENERATE**: `python3 ~/.claude/scripts/crontab-manager.py generate-wrapper --name <name> ...`. Verify: `flock`, `--permission-mode auto`, `--max-budget-usd`, `tee` logging, dry-run default. 3. **VALIDATE**: `bash -n scripts/<name>-cron.sh`. Run 9-point cron checklist. 4. **INSTALL**: Dry-run first (`--dry-run`), ask user confirmation, then install. 5. **REPORT**: Script path, schedule, log dir, budget, management commands.

Load `references/headless-cron-creator.md` for the full methodology and schedule conversion table.

---

E. Toolkit Install

1. Run `python3 ~/.claude/scripts/install-doctor.py check` and `python3 ~/.claude/scripts/toolkit-health.py --json`. 2. If issues: guide user to `./install.sh --symlink`. Fix permissions and deps as needed. 3. Show inventory: `python3 ~/.claude/scripts/install-doctor.py inventory`. 4. Show MCP status: `python3 ~/.claude/scripts/mcp-registry.py list`. 5. Orient: `/do`, `/comprehensive-review`, `/install` commands.