skills/magnus919_agent-skills
1
0
Fork 0
mirror of https://github.com/magnus919/agent-skills.git synced 2026-09-11 19:47:12 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(remote-systems-administration): clarify control-plane decisions

Browse Source
This commit is contained in:
Magnus Hedemark
2026-07-13 13:35:50 -04:00
parent ebfc30e71d
commit 3b1b4df413
2 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
remote-systems-administration/SKILL.md
+1 -1
View File
@@ -25,7 +25,7 @@ Use this as an operating decision layer, not a bag of remote commands. Unix-like
| Situation | Default path | Do not do |
|---|---|---|
| Diagnose or make one bounded change on one host | Native `ssh` with a read-only preflight | Do not open an interactive shell and make unrecorded edits |
| Diagnose or make one bounded change on one host | Native `ssh` with a read-only preflight and bounded command/range; do not use a live-follow stream such as `tail -f` | Do not open an interactive shell and make unrecorded edits |
| Repeat the same desired state across hosts | Ansible inventory + playbook, canary/serial rollout | Do not loop `ssh` blindly across production hosts |
| Python must coordinate SSH channels, SFTP, or a custom protocol flow | Paramiko with strict host-key verification and explicit timeouts | Do not disable host-key checks or turn a script into ad hoc fleet control |
| The platform/control plane is unknown | Run bounded discovery from `references/portable-operations.md` | Do not use `systemctl`, `apt`, `pfctl`, or `launchctl` based on a guess |
remote-systems-administration/references/linux.md
+6
View File
@@ -54,6 +54,12 @@ Changes to network configuration, DNS, SSH, sudo, PAM, routing, firewall state,
Linux firewall control planes include nftables and systems layered above it, such as firewalld or distribution tooling. Discover which system owns rules before changing anything. Do not mix direct nftables edits with a higher-level manager unless its documentation permits it, and never mechanically translate PF, iptables, or cloud firewall rules.
| Evidence | Decision |
|---|---|
| A firewall binary exists or `firewalld` is active | Ownership is still unknown. Inspect the managed configuration and sanctioned control path; do not select a tool from presence or service state alone, and do not use a trial rule or any other mutation to decide ownership. |
| firewalld is the confirmed policy owner | Use its documented interface; do not add direct nftables rules beside it. |
| Native nftables configuration is the confirmed policy owner | Use nftables only through that configuration's documented management path. |
For nftables, inspect the existing ruleset and ownership before edits. Policy changes can sever the live SSH session. Validate rule syntax where available, retain a recovery path, apply a bounded change, and verify both expected traffic and retained administrative access.
## Reboot and lifecycle