claude-skills

Install the CI/CD layer — Argo CD (GitOps) and/or a self-hosted GitHub Actions runner that trusts the Harbor registry CA. Wraps the cicd-platform skill.

Install a private Harbor container registry (with its own self-signed CA + TLS) on an existing Kubernetes cluster. Wraps the harbor-registry skill.

Provision, join, or reset a bare-metal Kubernetes + Rancher cluster (single-node, HA, or node join). Wraps the k8s-bare-metal skill.

Operate the live MJBL production CA — Vault PKI, OCSP/CRL, CA-host rotation, prod hardening. Wraps the mjbl-ca-operations skill (MJBL mTLS platform).

Cert revocation & rotation on the MJBL mTLS platform (device 3-hop revoke, relay/gateway/CA rotation). Wraps the mjbl-cert-lifecycle skill (MJBL mTLS platform).

This skill should be used when the user asks to "install Argo CD", "set up GitOps on my cluster", "deploy a self-hosted GitHub Actions runner on Kubernetes", "install the actions-runner-controller (ARC)", "set up the CI/CD layer", or "make my CI runner trust the Harbor registry". Also triggers on symptoms: "my runner pod is stuck in ContainerCreating / FailedMount harbor-ca", "the runner won't register with my GitHub org", "x509 / certificate error pushing images to Harbor from CI", or "get the Argo CD initial admin password". Orchestrates the `cicd-infra/` pipeline (00-prereqs → 01-install-argocd → 02-install-actions-runner): Argo CD from the upstream manifest, plus ARC + a Docker-in-Docker RunnerDeployment that trusts the private Harbor CA. Assumes a working cluster from [[k8s-bare-metal]] and a registry from [[harbor-registry]]. Use it whenever the user wants GitOps or self-hosted CI runners on their own cluster, even if they don't name Argo CD or ARC.

This skill should be used when the user asks to "install Harbor", "set up a private container registry", "deploy Harbor on my Kubernetes cluster", "give the cluster its own image registry with TLS", "create a Harbor Root CA and TLS cert", or "make my k8s nodes trust the registry CA". Also triggers on Harbor failure symptoms: "x509 / unknown authority pulling from Harbor", "Harbor returns default backend 404", "Harbor data disappears after restart", or "change the Harbor admin password". Orchestrates the `harbor-infra/` pipeline (00-prereqs → 01-create-harbor-ca → 02-install-harbor): a self-signed 2-cert PKI (Root CA + SAN leaf via openssl) loaded as k8s secrets, then the upstream Harbor Helm chart behind NGINX ingress. Assumes a working cluster from [[k8s-bare-metal]] (cluster + ingress-nginx). Feeds its CA to [[cicd-platform]] so CI runners can push images. Use it whenever the user wants a private registry on their own cluster, even if they don't name Harbor.

This skill should be used when the user asks to "set up an internal CA", "bootstrap a Certificate Authority", "build a 2-tier PKI", "create an internal Root CA and Intermediate CA", "set up Vault PKI", or any variant of standing up internal X.509 certificate infrastructure on a Linux host. Builds a Root + Intermediate + service-cert pipeline with HashiCorp Vault PKI, OCSP responder, CRL HTTP server, Ansible deploy automation, and a 3-mode revocation ("nuke") script. Designed for demo/lab use with explicit production-hardening pointers.

This skill should be used when the user asks to "set up / bootstrap / provision a bare-metal (or on-prem / Proxmox / LXC) Kubernetes cluster", "stand up a single-node k8s cluster with Rancher", "install kubeadm + Calico + Longhorn + Rancher", "set up an HA control-plane node", "join a worker or control-plane node to my cluster", "resume a failed k8s setup", or "reset / clean up / tear down a Kubernetes node". Orchestrates the battle-tested `k8s-single-node-cluster-setup.sh` provisioner (and `k8s-node-cleanup.sh`): kubeadm v1.31 + Calico + Longhorn + metrics-server + cert-manager + optional MetalLB + PostgreSQL + Rancher + ingress-nginx, with checkpoint/resume, LXC-safe node prep, and single-node / HA / join modes. Use it whenever the user wants a working Rancher-managed Kubernetes cluster on their own hardware, even if they don't name the script. Hands off to [[harbor-registry]] for a private registry and [[cicd-platform]] for Argo CD + GitHub Actions runners.

Set up Claude Code on a headless LXD/Linux server (Proxmox or bare). Handles: SSH fingerprint reset, password auth, passwordless key copy, Node.js install, Claude Code install, OAuth login via port forwarding, org/Max subscription auth, and the TUI onboarding loop fix. Use when provisioning a new LXD container for Claude Code agent use.