Menu
Deploy the local Terraform demo environment in hal. Use to provision and initialize Terraform lab resources.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Route Terraform lab requests to deploy, destroy, inspect status, and manage workspace automation in hal.
Deploy local Vault in hal. Use when the user asks to start Vault, initialize the local control plane, or recover from Vault being offline.
Route user intent to the right Vault lab skill in hal, including CE versus Enterprise constraints, observability wiring, and full-stack scenario guidance.
Deploy, verify, and troubleshoot the Vault JWT auth lab in hal. Use this skill when the user asks to enable JWT auth, configure CI/CD authentication with Vault, debug bound claims, test GitLab or pipeline logins, or reset the JWT demo. Triggers include "enable jwt", "configure jwt", "gitlab vault auth", "pipeline auth", "bound claims", and "hal vault jwt".
Deploy, verify, and troubleshoot the Vault OIDC lab in hal. Use this skill when the user asks to enable OIDC, set up human SSO, debug browser login redirects, inspect Authentik-backed roles, reset the OIDC demo, or configure SCIM provisioning. Triggers include "enable oidc", "Vault SSO", "Authentik", "OIDC callback", "configure oidc", "hal vault oidc", "enable scim", and "vault scim".
Deploy, verify, and troubleshoot the TFE SAML lab in hal. Use this skill when the user asks to enable SAML SSO for TFE, set up TFE single sign-on, debug SAML redirects or attribute mapping, configure SCIM provisioning for TFE teams, or reset the TFE SSO demo. Triggers include "enable saml", "TFE SSO", "TFE SAML", "Authentik TFE", "SAML callback", "configure saml", "hal tf saml", "tfe scim", "tfe teams scim", and "saml sso tfe".
| name | deploy |
| description | Deploy the local Terraform demo environment in hal. Use to provision and initialize Terraform lab resources. |
Handle hal terraform create requests with a stable lifecycle pattern.
hal terraform obs createhal terraform obs updatehal terraform obs deletehal terraform obs statushal terraform obs create expects the obs stack to already be running; otherwise it should ask the user to run hal obs create first.hal-tfe-proxy) in front of TFE.https://tfe.localhost:8443 in this mode./app reachability (to catch redirect loops).:8443 in proxied responses.agent-run must keep /tmp/terraform writable; the read-only mount is TFE's required disk cache (TFE_DISK_CACHE_VOLUME_NAME, cannot be removed) and causes remote plan/apply failures ("read-only file system") when downloading Terraform binaries. TFE renders the run config from /etc/task-worker/config.hcl.tmpl ~40ms into boot, so HAL bind-mounts a patched template (extracted from the exact image, readonly flipped to false) over that path at container creation — a post-start patch cannot win the race and this image has no supervisord to restart the task-worker.