Loading...
Loading...
Found 31 Skills
Configure nginx and Traefik as reverse proxies. Implement SSL termination and routing. Use when setting up application gateways.
Hardening-audit module for reverse-proxy edges and TLS termination (nginx primary; Caddy, HAProxy, Apache secondary) covering inventory, protocol/cipher posture, HSTS and edge headers, request limits, admin-path shielding, proxy-to-app hop trust, and ACME renewal hygiene.
Use when setting up, hardening, or reviewing a Linux VPS or cloud server for self-hosting, including DNS, SSH, firewalls, Nginx, static-site hosting, reverse-proxying an app, HTTPS with Let's Encrypt or ACME clients, safe HTTP-to-HTTPS redirects, or optional post-launch network tuning such as BBR.
Use when self-hosting OpenClaw on a Linux VPS or cloud server, hardening a remote OpenClaw gateway, choosing between SSH tunneling, Tailscale, or reverse-proxy exposure, or reviewing Podman, pairing, sandboxing, token auth, and tool-permission defaults for a secure personal deployment.
Hunt Host Header Injection — password reset poisoning → ATO, web cache poisoning via unkeyed Host/X-Forwarded-Host, routing-based SSRF (Host picks upstream → cloud metadata/internal services), path-override SSRF/ACL-bypass (X-Original-URL/X-Rewrite-URL), OAuth redirect_uri/issuer poisoning, and absolute-URL link poisoning in emails. High to Critical when it reaches ATO or mass cache poisoning. Built on public Host-header research (PortSwigger 'Practical web cache poisoning' + James Kettle, and the classic password-reset-poisoning class). Use on any forgot-password flow, CDN/reverse-proxy-fronted app, OAuth/OIDC endpoint, or absolute-URL-in-email feature.
Sa-Token advanced security features skill. Covers secondary authentication (`safe-auth` re-verification), account banning (full bans/category-specific bans/tiered bans), impersonation and identity switching, multi-account authentication (`StpUserUtil`/`StpKit`), global listeners (login/logout/kick/ban/token renewal events), global filters (`SaServletFilter`/`SaReactorFilter`), password encryption (MD5/SHA1/SHA256/AES/RSA/BCrypt/TOTP), session queries (terminal lists/global Token searches), HTTP Basic/Digest authentication, firewalls (IP allowlists and blocklists/rate limiting), custom authorization annotations, dynamic route authorization, reverse-proxy URI repair, asynchronous Mock contexts, and Redis key-value data architecture design. Use when the user needs to implement secondary verification for sensitive operations, tiered account bans, user impersonation, multi-account systems (User/Admin separation), global event monitoring, or password encryption utilities. For basic login authentication, use the sa-token skill.
Caddyfile configuration, auto-HTTPS, and FastCGI.
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for reverse proxies, Host headers, forwarded headers, vhost routing, websocket upgrades, path-prefix rewriting, base-URL derivation, and multi-node route resolution. Use when the user asks which host or container serves a route, why a public-looking domain still belongs to the sandbox, how headers or proxies change behavior, or how a route resolves across proxy, container, and worker boundaries. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Interactively adds a new subdomain to the network infrastructure by gathering service details, configuring domains.toml, and applying changes. Use when you need to add a new service, create a subdomain, expose a new application, or set up reverse proxy for a service. Triggers on "add subdomain", "new subdomain", "add service to network", "expose service", "create domain for", "set up reverse proxy", or "add [name] to infrastructure". Works with domains.toml, manage-domains.sh, and Cloudflare Tunnel.
Production-ready Docker and docker-compose setup for Odoo with PostgreSQL, persistent volumes, environment-based configuration, and Nginx reverse proxy.
Nginx configuration and optimization
Verifica a Stack do Traefik. Além disso analisa parâmetros, rotas Traefik, volumes, recursos e conformidade do stack Traefik de Acordo com as Recomendações da Promovaweb.