From upcloud
Provision full-stack infrastructure on UpCloud using the upctl CLI. Creates cloud servers, managed PostgreSQL databases (with pgvector, pg_cron, pg_trgm), S3-compatible object storage, Infisical secret management, database roles, and optional load balancers. Generates a .deploy.json config file for the project. Use this skill whenever the user wants to set up infrastructure on UpCloud, provision a new server, create a database, set up object storage, configure secrets management, or bootstrap a new deployment project — even if they just say "set up the backend" or "create the infrastructure" or "provision a server".
How this skill is triggered — by the user, by Claude, or both
Slash command
/upcloud:upcloud-setupThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Provisions the full backend stack on UpCloud for a project. Asks the user which features the project needs, then executes the provisioning sequence using `upctl`.
Provisions the full backend stack on UpCloud for a project. Asks the user which features the project needs, then executes the provisioning sequence using upctl.
upctl installed and authenticated (upctl account login --with-token or UPCLOUD_TOKEN env var)~/.ssh/id_ed25519.pub or similar)~/.config/upcloud-deploy/tokenVerify prerequisites before starting:
upctl account show -o json | jq '.username'
Ask the user:
fi-hel1 (Helsinki). Options: fi-hel1, de-fra1, nl-ams1, uk-lon1, us-nyc1, us-chi1, sg-sin12xCPU-4GB. List with: upctl server plansPresent this table and help the user choose. Default to the lowest-risk option that fits their effort budget:
| Option | How it works | Effort | Risk | Best for |
|---|---|---|---|---|
| Infisical (self-hosted) | Container on same server, inject via infisical run | Medium | Low — rotation, audit trail, open source | Production apps with compliance needs |
| Docker Secrets | Native Compose secrets, mounted as tmpfs at runtime | Low (already using Compose) | Low — no third-party dep, but no rotation or audit | Simple apps, single-server setups |
| UpCloud Object Storage | Encrypted secret bundle in S3, fetch at runtime via scoped keys | Low | Acceptable — you own encryption/rotation logic | Teams with existing S3 tooling |
| Recommendation logic: |
❗ Encrypted .env in containers is never an option — secrets end up in image layers, no rotation, no audit trail. This skill does not support it.
The chosen strategy is stored in .deploy.json under secrets.provider (infisical, docker-secrets, or s3-bundle).
Read .deploy.json in the project root. If it exists, skip resources that are already provisioned (idempotent). Show the user what already exists and what will be created.
Execute in order. Each step checks if the resource already exists before creating.
Read references/provision-server.md for the full playbook.
Quick reference:
upctl server create \
--hostname "{project}-prod" \
--zone "{zone}" \
--plan "{plan}" \
--os "Ubuntu Server 24.04 LTS (Noble Numbat)" \
--ssh-keys ~/.ssh/id_ed25519.pub \
--enable-firewall \
--enable-metadata \
--wait
After creation, SSH in to install Docker + Caddy + Infisical CLI.
Read references/provision-db.md for the full playbook.
Quick reference:
upctl database create \
--title "{project}-pg" \
--zone "{zone}" \
--hostname-prefix "{project}-pg" \
--type pg \
--plan "2x2xCPU-4GB-100GB" \
--wait
Then connect and enable extensions (vector, pg_cron, pg_trgm) and create roles.
Read references/provision-storage.md for the full playbook.
Important: Object storage regions differ from server zones. Map the server zone to the nearest EU region:
| Server Zone | Object Storage Region |
|---|---|
fi-hel1 | FI-HEL2 |
se-sto1 | SE-STO1 |
de-fra1 | DE-FRA1 |
Only EU regions are allowed (EU data residency policy). Run upctl object-storage regions to verify availability.
Quick reference:
upctl object-storage create \
--name "{project}-uploads" \
--region "{region}" \
--network type=public,name=public,family=IPv4 \
--wait
Then create user, access keys, and default bucket.
Read references/provision-secrets.md for the full playbook. The playbook covers all three supported backends:
Create three PostgreSQL roles:
app_rw — read-write for the appapp_ro — read-only for analyticsapp_migrate — DDL only (CREATE, ALTER, DROP)Only if user requested scaling support:
upctl load-balancer plans # show available plans first
Write .deploy.json to the project root. Read templates/.deploy.json.template for the schema.
Also generate from templates:
docker-compose.prod.ymlCaddyfile# Server reachable
ssh -o ConnectTimeout=5 root@{server_ip} 'echo ok'
# Database running
upctl database show "{project}-pg" -o json | jq '.state'
# Storage ready (if created)
upctl object-storage show "{project}-uploads" -o json | jq '.configured_status'
Report results to the user with a summary table.
Show before provisioning:
| Resource | Plan | ~EUR/month |
|---|---|---|
| Cloud Server | 2xCPU-4GB | ~22 |
| Managed PostgreSQL | 1xCPU-2GB-25GB | ~16 |
| Object Storage | 250GB | ~5 |
| Total (typical) | ~43 |
Multiple lightweight projects can share one server + one PG instance (separate databases).
fi-hel1 unless user specifies otherwiseupctl ... delete commandnpx claudepluginhub emerging-tech-visma/et-upcloudProvides behavioral guidelines to reduce common LLM coding mistakes, focusing on simplicity, surgical changes, assumption surfacing, and verifiable success criteria.
Searches, retrieves, and installs Agent Skills from prompts.chat registry using MCP tools like search_skills and get_skill. Activates for finding skills, browsing catalogs, or extending Claude.