ops-skills

English | 简体中文

Ops skill library for AI agents. Splits day-to-day server management (SSH, SFTP, LNMP, sites, SSL, Docker, databases, firewall, monitoring) into skills an agent can call directly.

Structure

Three layers: master entry ops → 6 categories → 21 concrete skills.

Safety conventions

• Destructive commands (rm -rf /, mkfs, FLUSHALL, fork bomb, …) are hard-blocked (case-insensitive)
• Write ops are audited: host, command, decision, exit code → ~/.opsctl/audit.log
• Prefer non-root; root only when explicitly authorized
• Run only against hosts you own or are authorized to manage

Skill list

Category	Skills
infra-ops	ssh-terminal, shell-exec, file-ops, apt-repo, server-settings
web-stack	lnmp, site-manage, ssl-manage, reverse-proxy, nginx-rewrite, php-manage
data-ops	mysql-ops, redis-ops
docker-ops	docker-container, docker-image, docker-install
net-sec	firewall, bbr, ssh-keys
obs-ops	monitor, process-manage

Execution engine (opsctl)

Every skill maps to a real runnable command, not just docs. Zero npm runtime deps — spawns system ssh / sftp.

Configure hosts in ~/.opsctl/hosts.json:

{
  "web1": {
    "host": "1.2.3.4", "port": 22, "username": "root",
    "auth": { "type": "key", "privateKeyPath": "~/.ssh/id_ed25519" },
    "strictHostKeyChecking": true
  }
}

Auth supports key (recommended) and agent. Password auth is not supported (BatchMode=yes); install your public key first (ssh-copy-id or equivalent), then use keys.

Usage:

node bin/opsctl.js shell-exec  --host web1 --cmd "uptime; free -h" --mode auto
node bin/opsctl.js file-read   --host web1 --path /etc/nginx/nginx.conf
node bin/opsctl.js file-write  --host web1 --path /var/www/app.js --content "..." --mode 644
node bin/opsctl.js file-delete --host web1 --path /tmp/old.log --mode yes

Safety gate lives in src/gate.js, always on:

• block: rm -rf /, mkfs, dd … of=/dev/*, DROP TABLE, FLUSHALL/FLUSHDB, fork bomb — never runs (case-insensitive); --mode yes cannot override
• confirm: rm, chmod, systemctl stop/restart, kill, ufw disable, iptables -F — denied by default; allow with --mode yes or interactive prompt
• audit: every decision + host + exit code appended to ~/.opsctl/audit.log (including file-write / file-mkdir)

Exit codes: 0 = ok, 1 = denied / failed / bad args.

Layout:

ops-skills/
├── bin/opsctl.js          # CLI: skill → real execution
├── src/
│   ├── config.js          # reads ~/.opsctl/hosts.json (invalid JSON throws; does not wipe hosts)
│   ├── gate.js            # blacklist (case-insensitive) + confirm + audit
│   ├── transport.js       # system ssh / sftp (ConnectTimeout + total timeout)
│   └── primitives.js      # shell-exec / file-* primitives
└── skills/                # 21 leaf skills + 6 category routers + 1 master = 28 SKILL.md
                           # each leaf EXECUTION section points at the matching opsctl command

Tests

npm test          # selftest.mjs — gate / config / transport / CLI e2e
npm run frontcheck  # frontmatter + description trigger checks for all SKILL.md

Scope

Designed for a single operator, single window: non-interactive SSH batch + SFTP. Out of scope (by design): interactive multi-session terminal UI, password login over opsctl, SSH tunnels, panel-style reboot/flush UX (reboot & Redis FLUSH* are hard-blocked; use a human SSH session if you need them).

License

MIT