mirror of
https://github.com/magnus919/agent-skills.git
synced 2026-09-11 19:47:12 +03:00
docs(remote-systems-administration): enrich platform operations (#37)
This commit is contained in:
Magnus Hedemark
@@ -24,11 +24,13 @@ Use `pkg` for binary packages. The FreeBSD Handbook distinguishes packages from
|
||||
|
||||
Base-system updates and third-party packages are distinct lifecycles. Do not use package commands as a substitute for an OS release procedure. For release changes, kernel/base updates, boot-environment strategy, and ZFS rollback planning, follow the release-specific FreeBSD documentation.
|
||||
|
||||
On a ZFS host that supports it, `bectl` manages bootable ZFS clones. It can provide a deliberate pre-change recovery path because a boot environment can be selected by the boot loader. First verify `bectl check`, dataset scope, and excluded datasets; do not present a ZFS snapshot or boot environment as a universal rollback mechanism.
|
||||
|
||||
Before a broad package operation, inventory installed packages, update candidates, held policy if applicable, application compatibility, disk space, backups/snapshots, and restart impact. `pkg audit -F` is an advisory/vulnerability check, not a change command.
|
||||
|
||||
## Firewalls and networking
|
||||
|
||||
FreeBSD may use PF, IPFW, or another installed system. Discover the active firewall and configuration owner. PF and IPFW have distinct grammars and persistence mechanisms. Do not copy OpenBSD PF assumptions without checking the FreeBSD documentation and installed version.
|
||||
FreeBSD may use PF, IPFW, or another installed system. Discover the active firewall and configuration owner. PF and IPFW have distinct grammars and persistence mechanisms. Validate FreeBSD PF rules on the target and do not copy OpenBSD PF syntax or assumptions.
|
||||
|
||||
Firewall, route, DNS, interface, and remote-access changes require a retained session plus another recovery path. Validate syntax/configuration, make the smallest change, confirm that the administrator path remains open, then test the intended traffic flow.
|
||||
|
||||
|
||||
@@ -19,7 +19,7 @@ Other Linux systems may use OpenRC, SysV-style scripts, runit, s6, or a distribu
|
||||
| Did configuration parse? | service-specific validation before `reload` or `restart` |
|
||||
| Did it serve traffic? | endpoint/socket check plus relevant client/dependent check |
|
||||
|
||||
Do not blindly restart a service because configuration changed. Validate the configuration first where the service provides a check, then use reload only when documented as safe; otherwise plan the restart, effect, and rollback.
|
||||
Do not blindly restart a service because configuration changed. Validate the configuration first where the service provides a check, then use reload only when documented as safe; otherwise plan the restart, effect, and rollback. If a systemd unit file or drop-in changed, run `systemctl daemon-reload` before the lifecycle action so the manager rereads unit metadata.
|
||||
|
||||
## Packages and updates
|
||||
|
||||
|
||||
@@ -18,7 +18,7 @@ A Homebrew service, an application helper, a LaunchDaemon, and a LaunchAgent can
|
||||
|
||||
`softwareupdate` addresses Apple-provided update workflows. Use Apple deployment documentation and the target release's supported management path before planning an update. An OS update can affect restarts, FileVault unlock, management enrollment, kernel/system extensions, application compatibility, and recovery behavior.
|
||||
|
||||
Homebrew is a separate third-party package manager. If it is present and authorized for the target, use its documented commands and respect formula/cask provenance, update behavior, service ownership, and user context. Do not install Homebrew merely to obtain a Unix package without an explicit directive.
|
||||
Homebrew is a separate third-party package manager. If it is present and authorized for the target, use its documented commands and respect formula/cask provenance, update behavior, service ownership, and user context. Its prefix is architecture and installation dependent, so discover it with `brew --prefix` rather than hardcoding a path. Do not install Homebrew merely to obtain a Unix package without an explicit directive.
|
||||
|
||||
Before any broad update:
|
||||
|
||||
@@ -36,7 +36,7 @@ System Integrity Protection, privacy controls, TCC, signed system volumes, and A
|
||||
|
||||
## Networking and firewall
|
||||
|
||||
macOS has multiple security/networking layers, including PF and the Application Firewall. They serve different purposes. Discover which layer owns the requested policy before altering it. Never assume a PF rule changes application-level firewall behavior, or vice versa.
|
||||
macOS has multiple security/networking layers, including PF and the Application Firewall. They serve different purposes. Discover which layer owns the requested policy before altering it. Never assume a PF rule changes application-level firewall behavior, or vice versa. For macOS network-service configuration, `networksetup` is the native command-line control plane: inspect its target service and current state before changing DNS, routing, addressing, proxies, or interface behavior.
|
||||
|
||||
Network, PF, remote-login, VPN, DNS, routing, and firewall changes can strand a remote session. Preserve a current session and an independent authorized recovery path, validate candidate configuration, make the smallest change, and verify both retained administrative access and intended traffic behavior. Apple's Application Firewall is app/service admission control, whereas PF is a packet-filter control plane; identify which question is being asked before changing either.
|
||||
|
||||
|
||||
@@ -17,7 +17,7 @@ service <name> status
|
||||
service <name> restart
|
||||
```
|
||||
|
||||
A package can install an rc.d script, but that does not automatically make it an active boot service. Identify the script location, enablement/configuration, daemon process/listener, and dependent application boundary before declaring success.
|
||||
A package can install an rc.d script, but that does not automatically make it an active boot service. By default, pkgsrc package scripts live under `/usr/pkg/share/examples/rc.d` and must be copied to `/etc/rc.d`; `PKG_RCD_SCRIPTS=yes` automates that only when set before package installation. Identify the script location, enablement/configuration, daemon process/listener, and dependent application boundary before declaring success.
|
||||
|
||||
## pkgsrc and packages
|
||||
|
||||
@@ -29,4 +29,4 @@ Base-system maintenance is separate from pkgsrc. Use release-specific NetBSD doc
|
||||
|
||||
## Firewalls, networking, and verification
|
||||
|
||||
Discover the active firewall and network configuration owner before changing rules, routes, interfaces, or DNS. Preserve remote access with a retained session and an independent authorized recovery channel. Validate candidate configuration where possible, apply the smallest scoped change, test the administration path and intended flow, then validate the application boundary.
|
||||
Discover the active firewall and network configuration owner before changing rules, routes, interfaces, or DNS. NPF is NetBSD's native packet filter, but a target can instead use PF or IPF; its active control plane is a discovery fact, not an assumption. Preserve remote access with a retained session and an independent authorized recovery channel. Validate candidate configuration where possible, apply the smallest scoped change, test the administration path and intended flow, then validate the application boundary.
|
||||
|
||||
@@ -25,7 +25,7 @@ OpenBSD separates packages from system distribution files. `pkg_add` installs an
|
||||
|
||||
`pkg_add -u` can update installed packages and their dependencies. Before a package update, inspect package origin, dependencies, service impact, disk space, and application compatibility. Use its non-mutating modes only as previews with the documented limitations understood.
|
||||
|
||||
For base-system errata and release lifecycle, use the appropriate OpenBSD mechanisms and release documentation, such as `syspatch` where applicable. Do not conflate package updates, syspatch, and a release upgrade.
|
||||
For base-system errata, `syspatch` fetches, verifies, installs, and can revert OpenBSD binary patches for official releases. Treat it as distinct from package updates and release upgrades; consult the release documentation before selecting the lifecycle path.
|
||||
|
||||
## PF
|
||||
|
||||
|
||||
@@ -12,13 +12,19 @@ This skill is a routing and safety guide, not a frozen command reference. Re-che
|
||||
| Linux firewall | [nftables wiki](https://wiki.nftables.org/wiki-nftables/index.php/Main_Page) | nftables architecture and CLI concepts | 2026-07-13 |
|
||||
| Arch packages | [pacman(8)](https://man.archlinux.org/man/pacman.8) | package database, transaction, cache, and dependency controls | 2026-07-13 |
|
||||
| Alpine packages | [Alpine Package Keeper](https://wiki.alpinelinux.org/wiki/Alpine_Package_Keeper) | configuration conflict files, persistence modes, and package state | 2026-07-13 |
|
||||
| FreeBSD | [FreeBSD Handbook: configuration](https://docs.freebsd.org/en/books/handbook/config/), [firewalls](https://docs.freebsd.org/en/books/handbook/firewalls/), [ports and packages](https://docs.freebsd.org/en/books/handbook/ports/) | rc framework, remote-firewall caution, base/package distinction, package/ports lifecycle | 2026-07-13 |
|
||||
| NetBSD services | [NetBSD rc.d guide](https://www.netbsd.org/docs/guide/en/chap-rc.html) | rc.d configuration, service lifecycle, and `service` alias | 2026-07-13 |
|
||||
| FreeBSD configuration | [FreeBSD Handbook: configuration](https://docs.freebsd.org/en/books/handbook/config/) | rc framework and base-system configuration conventions | 2026-07-13 |
|
||||
| FreeBSD packages and ports | [FreeBSD Handbook: ports and packages](https://docs.freebsd.org/en/books/handbook/ports/) | package/ports lifecycle and package-management boundaries | 2026-07-13 |
|
||||
| FreeBSD boot environments | [bectl(8)](https://man.freebsd.org/cgi/man.cgi?query=bectl&sektion=8) | ZFS boot-environment discovery, activation, and recovery boundaries | 2026-07-13 |
|
||||
| FreeBSD firewalls | [FreeBSD Handbook: firewalls](https://docs.freebsd.org/en/books/handbook/firewalls/) | PF/IPFW distinctions and remote-firewall recovery caution | 2026-07-13 |
|
||||
| NetBSD services | [NetBSD rc.d guide](https://www.netbsd.org/docs/guide/en/chap-rc.html) | rc.d configuration, package-script activation, service lifecycle, and `service` alias | 2026-07-13 |
|
||||
| NetBSD packages | [pkgsrc guide](https://www.netbsd.org/docs/pkgsrc/using.html), [pkg_add(1)](https://man.netbsd.org/pkg_add.1) | pkgsrc package origins, binary packages, and pkg tools | 2026-07-13 |
|
||||
| NetBSD firewall | [NetBSD networking guide](https://www.netbsd.org/docs/guide/en/chap-net-practice.html) | NPF ownership and separate firewall control plane | 2026-07-13 |
|
||||
| OpenBSD services | [rcctl(8)](https://man.openbsd.org/rcctl) | daemon configuration, enablement, and actions | 2026-07-13 |
|
||||
| OpenBSD packages | [pkg_add(1)](https://man.openbsd.org/pkg_add) | package install/update, signatures, package/base distinction | 2026-07-13 |
|
||||
| OpenBSD base patches | [syspatch(8)](https://man.openbsd.org/syspatch) | official-release binary patch lifecycle and rollback behavior | 2026-07-13 |
|
||||
| OpenBSD PF | [pfctl(8)](https://man.openbsd.org/pfctl), [pf.conf(5)](https://man.openbsd.org/pf.conf) | rule validation/loading and PF control scope | 2026-07-13 |
|
||||
| Apple launchd | [Creating Launch Daemons and Agents](https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/CreatingLaunchdJobs.html) | daemon/agent distinction, labels, and launchd ownership model | 2026-07-13 |
|
||||
| Apple networking | target-host `networksetup(8)` manual (version-specific) | network-service configuration controls | 2026-07-13 |
|
||||
| Apple firewall | [Block connections to your Mac with a firewall](https://support.apple.com/guide/mac-help/change-firewall-settings-mh34041/mac) | application/service firewall behavior | 2026-07-13 |
|
||||
| Apple deployment | [Apple Platform Deployment](https://support.apple.com/guide/deployment/welcome/web) | Apple-supported management and deployment posture | 2026-07-13 |
|
||||
| Homebrew | [Homebrew manpage](https://docs.brew.sh/Manpage) | package-manager behavior and environment controls | 2026-07-13 |
|
||||
|
||||
Reference in New Issue
Block a user