القائمة
Policy enforcement for safe infrastructure operations. Automatically active to prevent destructive actions, enforce PR workflows, and ensure backup-before-modify patterns.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
| name | dh-guardrails |
| type | always-on |
| description | Policy enforcement for safe infrastructure operations. Automatically active to prevent destructive actions, enforce PR workflows, and ensure backup-before-modify patterns. |
Enforce safety policies for infrastructure operations, preventing common mistakes and ensuring best practices across all Dockhand workflows.
IMPORTANT: When working with domains in ANY Dockhand operation, you MUST use the user's actual configured domain, never example placeholders.
How to discover the user's domain:
dns_list_records - the zone shows their platform_domaindokploy_list_apps - app domains reveal the platform domaintraefik_check_certs - shows active domains~/.config/dockhand/config.json contains "platform_domain": "actual-domain.com"Always substitute <platform_domain> placeholders with the discovered domain before executing DNS or domain-related operations.
No secrets in git - Never commit .env files, passwords, tokens, or API keys. Warn immediately if user attempts to stage sensitive files.
Environment-based Terraform workflow:
terraform apply on prod.confirmed=true.Destructive operation gating - Block dangerous commands without explicit confirmation:
terraform destroydocker rm, docker volume rmrm -rf on infrastructure pathsBackup before modify - Require backup verification before:
State sync after deploy - Prompt to run state collection after Dokploy deployments to maintain git documentation.
Intervene when user requests:
| Action | Response |
|---|---|
Commit .env or credentials | Refuse, explain risks, suggest 1Password |
terraform apply on prod without PR | Block, explain PR workflow, offer to create branch |
| Delete volumes or services | Require confirmation, suggest backup first |
| Modify production directly | Suggest test environment first |
| Deploy without health check | Recommend running /dh:status after |
confirmed=true for state-changing MCP toolsnotify_send if configuredFull guardrail enforcement via both plugin hooks and MCP server:
terraform_apply - Requires confirmed=truedokploy_redeploy - Requires confirmed=truedns_create_record, dns_update_record, dns_delete_record - Require confirmed=truessh_exec - Blocks destructive commands without confirmationServer-side enforcement only. The remote MCP server scopes access based on the user's portal token:
dockyard_* tool calls through (server enforces permissions)This skill provides the policy layer; MCP tools provide enforcement.
Detects first-run state and prompts user to configure Dockhand. Active when config is missing or incomplete.
Day-to-day application lifecycle management. Use when user wants to manage apps, check app status, list applications, manage domains, start/stop/restart apps, or says "apps", "applications", "services", "my apps".
Guide deployment workflows for applications. Use when user wants to deploy an app, deploy a template, redeploy a service, browse templates, or says "deploy", "launch", "spin up", "install app".
Generate infrastructure status reports and health checks. Use when user asks for platform status, health check, system overview, service status, or says "what's running", "check health", "show status".
Infrastructure-as-code operations with Terraform. Use when user wants to run terraform, manage infrastructure, bootstrap new hosts, change infrastructure, or says "terraform", "infrastructure", "IaC", "provision".
Systematic debugging for infrastructure issues. Use when user reports errors, app not working, 502/504 errors, certificate problems, DNS issues, or says "debug", "not working", "help", "broken", "error".