Claude Skills by po4yka

Create a RIPDPI VPN deployment portfolio task and its mdtask or OpenSpec execution scaffold.

Select and start the next unblocked RIPDPI VPN deployment portfolio task.

Inspect and update RIPDPI VPN deployment execution steps through the repository-pinned mdtask wrapper.

Implement tasks from an OpenSpec change. Use when the user wants to start implementing, continue implementation, or work through tasks.

Archive a completed RIPDPI VPN deployment OpenSpec change through the fail-closed taskctl lifecycle.

Enter explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements. Use when the user wants to think through something before or during a change.

Propose a new change with all artifacts generated in one step. Use when the user wants to quickly describe what they want to build and get a complete proposal with design, specs, and tasks ready for implementation.

Sync delta specs from a change to main specs. Use when the user wants to update main specs with changes from a delta spec, without archiving the change.

Update an OpenSpec change by revising its existing planning artifacts and keeping them coherent with one another. Use when the user wants to revise a change's plan, fold new decisions into it, or reconcile its artifacts after an edit. Never edits code.

Use when creating, updating, triaging, executing, reviewing, or closing RIPDPI VPN deployment portfolio tasks, backlog items, bugs, epics, and OpenSpec-backed work.

Route RIPDPI VPN deployment changes through the risk-based OpenSpec specification workflow.

Bash conventions for vpn-deploy scripts/ — strict mode, shellcheck gates, SOPS handling, no piped installers. Use when editing scripts/**, role-level shell tasks, or Makefile recipes. vpn-deploy project variant.

Conventional Commits for vpn-deploy — drives release-please versioning. Defines allowed types, repo-specific scopes, and forbidden trailers. Use when authoring any commit message in this repo. vpn-deploy project variant.

Linux hardening conventions for vpn-deploy nodes — baseline role, nftables (not UFW/iptables), SSH, sysctl, fail2ban/sshguard, watchdog. RU-TSPU-aware. Use when editing ansible/roles/baseline, ansible/roles/firewall, ansible/roles/watchdog, or auditing a fresh node. vpn-deploy project variant.

Nginx config for the vpn-deploy P1 profile (nginx + XHTTP direct) and the subscription-host role. Reverse proxy, HTTP/2, TSPU-aware TLS hardening. Use when editing ansible/roles/nginx-xhttp/** or ansible/roles/subscription-host/**. vpn-deploy project variant.

Async Rust patterns for the vpnd convenience CLI — tokio runtime, anyhow/thiserror error handling, graceful shutdown, and timeout wrappers. Use when editing vpnd/src/**, adding a new subcommand, or debugging async behaviour. vpn-deploy project variant.

Idiomatic Rust for the vpnd convenience CLI — clippy gates, error strategy, snapshot tests, no panics outside tests. vpn-deploy project variant of the Apollo handbook.

Security review against the vpn-deploy threat model (RU-internet / TSPU-aware). Catches secrets-in-git, layer-boundary breaches, shared per-device material, admin-panel exposure, and CDN-as-baseline mistakes. Use before any merge that touches secrets, Terraform, cloud-init, Ansible runtime state, or vpnd. vpn-deploy project variant.

Systemd unit conventions for vpn-deploy services (xray, hysteria, nginx, amneziawg-quick, naive, vpnd-watchdog). Hardening directives, ExecReload, journalctl recipes, drop-in overrides. Use when authoring or auditing service units in ansible/roles/**. vpn-deploy project variant — replaces the upstream Chinese SKILL.md.

Terraform conventions for the vpn-deploy multi-provider layout (Hetzner / UpCloud / Vultr). Provider-root strategy, not module composition. Use when adding a provider, editing terraform/providers/**, or wiring inventory rendering. vpn-deploy project variant — does NOT cover AWS/Azure/GCP/OCI patterns from upstream.