メニュー
Deploy local Vault in hal. Use when the user asks to start Vault, initialize the local control plane, or recover from Vault being offline.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Deploy the local Terraform demo environment in hal. Use to provision and initialize Terraform lab resources.
Route Terraform lab requests to deploy, destroy, inspect status, and manage workspace automation in hal.
Route user intent to the right Vault lab skill in hal, including CE versus Enterprise constraints, observability wiring, and full-stack scenario guidance.
Deploy, verify, and troubleshoot the Vault JWT auth lab in hal. Use this skill when the user asks to enable JWT auth, configure CI/CD authentication with Vault, debug bound claims, test GitLab or pipeline logins, or reset the JWT demo. Triggers include "enable jwt", "configure jwt", "gitlab vault auth", "pipeline auth", "bound claims", and "hal vault jwt".
Deploy, verify, and troubleshoot the Vault OIDC lab in hal. Use this skill when the user asks to enable OIDC, set up human SSO, debug browser login redirects, inspect Authentik-backed roles, reset the OIDC demo, or configure SCIM provisioning. Triggers include "enable oidc", "Vault SSO", "Authentik", "OIDC callback", "configure oidc", "hal vault oidc", "enable scim", and "vault scim".
Deploy, verify, and troubleshoot the TFE SAML lab in hal. Use this skill when the user asks to enable SAML SSO for TFE, set up TFE single sign-on, debug SAML redirects or attribute mapping, configure SCIM provisioning for TFE teams, or reset the TFE SSO demo. Triggers include "enable saml", "TFE SSO", "TFE SAML", "Authentik TFE", "SAML callback", "configure saml", "hal tf saml", "tfe scim", "tfe teams scim", and "saml sso tfe".
| name | deploy |
| description | Deploy local Vault in hal. Use when the user asks to start Vault, initialize the local control plane, or recover from Vault being offline. |
Handle hal vault create requests with a stable lifecycle pattern.
root.hal vault create --edition ent and VAULT_LICENSE exported (this is still dev mode, just the Enterprise image).--mode prod)hal vault create --mode prod stands up a single-node production Vault Enterprise: real vault server -config with integrated Raft storage on a persistent volume, TLS at https://vault.localhost:8200 (self-signed cert), and automatic init + unseal.--edition ent; requires VAULT_LICENSE / VAULT_LICENSE_PATH. --edition ce --mode prod is rejected.~/.hal/vault-prod/init.json (mode 0600). Tell the user to retrieve it with hal vault status or hal creds status, set VAULT_CACERT=~/.hal/vault-prod/certs/cert.pem for the CLI, and that this file is the only copy of the unseal key.--key-shares (default 1), --key-threshold (default 1), --node-id.http://vault.localhost:8200) and next steps.hal vault obs createhal vault obs updatehal vault obs deletehal vault obs statushal vault obs create expects the obs stack to already be running; otherwise it should ask the user to run hal obs create first.hal vault update) or delete (hal vault delete) path.VAULT_LICENSE, explain the failure and provide the exact export + redeploy command.