azzist-init

azzist-init

Create the two-file config split so secrets never land in a public repo.

This skill is idempotent and only concerns config files — it creates or updates azzist.yaml + azzist.local.yaml, nothing else.

• If azzist-analyze ran just before this, REUSE its proposed yaml fields to populate azzist.yaml (project name, stack, port, db/cache, repo, branch). Don't re-ask for things analyze already figured out — just confirm with the user once.
• If azzist.yaml already exists AND azzist.local.yaml already exists with the expected keys filled in, STOP and tell the user: "already initialized — azzist.yaml at and azzist.local.yaml (gitignored) are in place. Re-run azzist-analyze to refresh detection, or edit the files directly." Don't overwrite them silently.
• If only one of the two exists, create the missing one. If both exist but fields drifted (e.g. analyze detected a new stack), offer to UPDATE specific fields rather than regenerating from scratch.

Security first (do this BEFORE writing any secret file)

1. Ensure the project .gitignore excludes the secrets file. If .gitignore does not already contain azzist.local.yaml, append these lines:

   azzist.local.yaml
   **/azzist.local.yaml
   

   Verify with git check-ignore azzist.local.yaml (should print the path) before continuing. If the project is not a git repo, still create .gitignore so it is safe the moment it becomes one.

Steps

2. Copy the skeleton to the project root as azzist.yaml:
   • Source: ${CLAUDE_PLUGIN_ROOT}/templates/config/azzist.yaml
   • Fill in what you already know from the conversation (project name, stack, domain).
3. Copy the secrets template to the project root as azzist.local.yaml:
   • Source: ${CLAUDE_PLUGIN_ROOT}/templates/config/azzist.local.yaml.example
   • Do NOT invent secrets. Leave placeholders and ask the user to fill: Cloudflare api_token + zone_id, and per-server host, ssh_user, auth mode.
4. Recommend SSH auth order: ssh_config alias > key > password. Only use password if the user insists, and warn it needs sshpass locally.
5. Confirm to the user:
   • azzist.yaml is committed (no secrets).
   • azzist.local.yaml is gitignored (holds secrets) — never commit it.

Output

Report which files were created and exactly which fields the user still needs to fill in azzist.local.yaml before deploy can run.