From azzist
Expose a deployed azzist container publicly: detect the server's existing reverse proxy (Traefik container, host nginx, or none) and wire the app non-invasively, then upsert the Cloudflare DNS record and provision TLS. Use after azzist-deploy, when the user says "azzist server", "attach domain", or "make it public". Never disturbs existing proxies/services.
How this skill is triggered — by the user, by Claude, or both
Slash command
/azzist:azzist-serverThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Front the running container at `127.0.0.1:<port>` with a reverse proxy and a public domain.
Front the running container at 127.0.0.1:<port> with a reverse proxy and a public domain.
Inputs: <name> = project.name, <domain>, <port> (from azzist-deploy), deploy.proxy,
and cloudflare secrets from azzist.local.yaml. Source ssh helpers first:
source ${CLAUDE_PLUGIN_ROOT}/scripts/ssh-helpers.sh (with AZZIST_SSH_* exported).
This skill is used in two modes:
bash ${CLAUDE_PLUGIN_ROOT}/scripts/detect-proxy.sh — what proxy is actually running?azzist_ssh 'docker ps --filter name=azzist_<name>' — is OUR container up?azzist_ssh 'curl -fsS http://127.0.0.1:<port>/healthz' — is the app healthy on the loopback?azzist_ssh 'ss -tlnH | grep <port>' — is the port bound?azzist_ssh 'sudo nginx -T 2>/dev/null | grep -A5 azzist_<name>' — is OUR vhost present?azzist_ssh 'docker logs --tail=200 traefik' (or our app) — what does the proxy say?dig +short <domain> and curl -sSIv https://<domain> — DNS + TLS reachable?cf-dns.sh-style call to inspect the current record.
Diagnose at the boundary that broke (container → proxy → DNS → TLS) and propose the
minimal fix. Same isolation rule applies: do not touch resources outside azzist_<name>*.If deploy.proxy: auto, detect:
bash ${CLAUDE_PLUGIN_ROOT}/scripts/detect-proxy.sh -> traefik | nginx | none.
If deploy.proxy is nginx or traefik, honor it (still verify it actually exists).
Integrate purely via Docker labels and Traefik's network. No file or Traefik-config edits.
azzist_ssh "docker inspect \$(docker ps -qf ancestor=traefik | head -n1) --format '{{range \$k,\$v := .NetworkSettings.Networks}}{{\$k}}{{end}}'"
(or ask the user which network Traefik watches). Call it <traefiknet>.azzist_ssh 'docker network connect <traefiknet> azzist_<name>_app 2>/dev/null || true'azzist_<name> network too. Drop the host port publish — Traefik routes internally:
azzist_ssh 'docker rm -f azzist_<name>_app'
azzist_ssh 'docker run -d --name azzist_<name>_app \
--network azzist_<name> \
--restart unless-stopped \
--label traefik.enable=true \
--label "traefik.http.routers.azzist_<name>.rule=Host(\`<domain>\`)" \
--label traefik.http.services.azzist_<name>.loadbalancer.server.port=3000 \
azzist_<name>_app:latest'
azzist_ssh 'docker network connect <traefiknet> azzist_<name>_app'
--label traefik.http.routers.azzist_<name>.tls.certresolver=<resolver>. Do NOT create or
edit Traefik's resolver config. If unknown, ask the user; otherwise leave TLS to Traefik defaults.Write exactly ONE isolated vhost file; never edit existing config.
sed -e 's/__DOMAIN__/<domain>/g' -e 's/__PORT__/<port>/g' -e 's/__NAME__/<name>/g' \ ${CLAUDE_PLUGIN_ROOT}/templates/nginx.vhost.conf.tmpl > /tmp/azzist_<name>.confazzist_scp /tmp/azzist_<name>.conf /tmp/azzist_<name>.conf
then azzist_ssh 'sudo mv /tmp/azzist_<name>.conf /etc/nginx/conf.d/azzist_<name>.conf'.azzist_ssh 'sudo nginx -t && sudo systemctl reload nginx'.azzist_ssh 'sudo certbot --nginx -d <domain> --non-interactive --agree-tos -m <email> --redirect'.
Install certbot first only if absent.Confirm with the user, then install nginx (apt-get install -y nginx / distro equiv) and
follow the nginx strategy. Installing nginx adds a service; it does not alter others.
Upsert the A record domain -> server public IP:
bash ${CLAUDE_PLUGIN_ROOT}/scripts/cf-dns.sh "<zone_id>" "<api_token>" "<domain>" "<server_ip>" true
<server_ip> = the server's public IP (from servers.<server>.host if public, else ask).
curl -fsS -I https://<domain> should return 200/301. Allow a minute for DNS + cert.
Report the final status code and the public URL.
State: detected proxy strategy, what was wired (vhost file path or Traefik labels), the
Cloudflare record result, and the final curl https://<domain> status.
Provides behavioral guidelines to reduce common LLM coding mistakes, focusing on simplicity, surgical changes, assumption surfacing, and verifiable success criteria.
Searches, retrieves, and installs Agent Skills from prompts.chat registry using MCP tools like search_skills and get_skill. Activates for finding skills, browsing catalogs, or extending Claude.
npx claudepluginhub ghulammuzz/azzist-skills --plugin azzist