一键在 Manus 中运行任何 Skill

smaqit-infrastructure-domain-tls

星标1

分支0

更新时间2026年6月13日 22:41

Use when configuring a custom domain with a Let's Encrypt TLS certificate for a running nginx server. Covers DNS propagation verification, nginx server_name update, Certbot certificate issuance, HTTPS smoke tests, and auto-renewal verification. Also use when activating a purchased domain for a deployed application, setting up HTTPS post-deployment, or when a spec references INF-TOPOLOGY-004 through INF-TOPOLOGY-007 as pending TLS configuration.

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

在 Manus 中运行

来源

ruifrvaz

ruifrvaz/local-image-generator

打开 GitHub 仓库查看创作者相关仓库

下载

在 Manus 中运行

Configure Domain TLS with Let's Encrypt

Pre-conditions

Operator must complete before invoking:

Domain purchased and DNS A record pointing at the VM's public IP (81.24.10.203 for this project)
nginx installed and serving the app on HTTP
SSH access to the VM

Verify Certbot is available before Step 4: which certbot. It is pre-installed by cloud-init in this project.

Steps

All commands that run on the VM are executed via SSH.

Fix any stale spec reference: Check specs/infrastructure/deployment-topology.md for the DNS prerequisite constraint. If it references "Floating IP", update it to the fixed IP (81.24.10.203) and commit before proceeding.
Verify DNS propagation:
```
dig <domain> A +short
```
Must return 81.24.10.203. If not resolved, wait and retry — do NOT proceed until confirmed.

Update nginx server_name:

sudo sed -i 's/server_name _;/server_name <domain>;/' /etc/nginx/sites-available/him
sudo nginx -t
sudo systemctl reload nginx

Run Certbot:
```
sudo certbot --nginx -d <domain>
```
If www.<domain> is also desired:
```
sudo certbot --nginx -d <domain> -d www.<domain>
```
Certbot obtains the certificate, rewrites the nginx config for HTTPS, and adds the HTTP→HTTPS 301 redirect automatically.

Smoke tests:

curl -sI https://<domain>/            # assert HTTP 200, Content-Type: text/html
curl -sI http://<domain>/             # assert HTTP 301 redirect to https://
curl -sf https://<domain>/api/health  # assert HTTP 200

Certificate verification:
```
curl -vI https://<domain>/
```
Confirm issuer: Let's Encrypt and certificate not expired.
Auto-renewal test:
```
sudo certbot renew --dry-run
```
Must succeed without errors. Run this even if auto-renewal appears configured — the systemd timer may not be active on first boot.
Update specs: Invoke smaqit.spec-status-update for specs/infrastructure/deployment-topology.md — mark INF-TOPOLOGY-004 through INF-TOPOLOGY-007 as [x].

Output

nginx configured with real server_name and TLS
Let's Encrypt certificate issued and auto-renewal configured
INF-TOPOLOGY-004 through INF-TOPOLOGY-007 checked off in specs/infrastructure/deployment-topology.md

Scope

Does NOT purchase the domain — that is a human action (joker.com or equivalent registrar).
Does NOT handle multi-tenant or wildcard certificates.
Does NOT configure HSTS or other security headers (those can be added to nginx separately post-issuance).

Examples

Input: Domain himcorp.com purchased, A record set to 81.24.10.203. User invokes /domain.tls himcorp.com. Output: TLS certificate issued, HTTPS live at https://himcorp.com/, HTTP redirects to HTTPS, health check passing, INF-TOPOLOGY-004–007 checked off.

Gotchas

dig propagation can take minutes to hours depending on DNS TTL. Do NOT run Certbot before DNS is confirmed — Certbot will fail the ACME HTTP-01 challenge if the domain doesn't resolve to the VM.
Certbot rewrites the nginx config file. After issuance, the listen 443 ssl blocks are managed by Certbot — do not manually edit the nginx file for TLS settings post-issuance.
81.24.10.90 (Cyso floating IP) does not route on the flat network. Always use the fixed IP 81.24.10.203 as the DNS A record target.
Port 80 must be open in the VM firewall during the ACME HTTP-01 challenge. If Certbot fails, check ufw status and ensure port 80 is allowed.

Completion

Failure Handling

Situation	Action
Required input not provided	Request the missing information before proceeding
Gathered input is ambiguous	Flag the ambiguity and ask for clarification
Subagent invocation fails	Report the failure with context; do not silently retry
Output artifact already exists	Confirm with user before overwriting
DNS not propagated	Wait 5 minutes and retry `dig`; do not proceed to Certbot until confirmed
Certbot ACME challenge fails	Verify nginx is serving on port 80 with the correct `server_name`; check firewall (port 80 must be open)
`certbot` command not found	Install: `sudo apt install python3-certbot-nginx`
nginx config test fails after `server_name` update	Show the exact nginx error; restore with `sudo sed -i 's/server_name <domain>;/server_name _;/'`

同仓库更多 Skills

同仓库

smaqit-infrastructure-cicd-generate

ruifrvaz/local-image-generator

Use when manually generating or updating the canonical 3-workflow GitHub Actions CI/CD set (deploy.yml, provision.yml, post-merge-deploy.yml) for a Node.js + React application deployed to a VM via Terraform and Docker Compose. Also use when an operator invokes /cicd.generate, or when updating existing workflows to match project conventions. In `smaqit.new-greenfield-project`, the deployment agent generates workflows during Phase 5 using these patterns as reference — invoke this skill directly only when generating CI/CD outside the zero-to-prod flow. Note: `copilot-setup-steps.yml` is provided by the smaqit framework and is not generated by this skill.

2026-06-131

smaqit-infrastructure-deploy-rsync

ruifrvaz/local-image-generator

Use when deploying a Node.js backend + React frontend application to a remote VM via rsync. Used in the Phase 5 dev environment sweep of `smaqit.new-greenfield-project` to validate the deployment approach locally before CI/CD. Also use as a manual fallback for direct VM deployment outside the CI/CD pipeline.

2026-06-131

smaqit-infrastructure-deploy-verify

ruifrvaz/local-image-generator

Use after any deployment to confirm the application is healthy before closing the task or proceeding. Checks the health endpoint, verifies the deployed commit SHA against the current local commit, and validates the SPA root HTTP response. Produces a PASS/FAIL report per check with a final summary. Also use when a deployment task asks to confirm success or when re-verifying after a fix.

2026-06-131

smaqit-infrastructure-hook-post-deploy-stamp

ruifrvaz/local-image-generator

Use when writing deploy stamp files (DEPLOY_SHA, DEPLOY_TIME) to the VM after a successful deployment, or when re-stamping without a full redeploy. Also use when the health endpoint returns "sha":"unknown" after deployment, when a deployed PR needs a notification comment, or when smaqit.infrastructure-deploy-rsync invokes the post-deploy stamp step. Produces DEPLOY_SHA and DEPLOY_TIME files in /opt/him/backend/ on the VM and optionally posts a deploy comment on the merged PR.

2026-06-131

smaqit-infrastructure-hook-pre-commit-validate

ruifrvaz/local-image-generator

Use when validating staged files before committing to catch .env files, plaintext API keys/secrets, draft spec files on main-branch commits, and large files over 1 MB. Also use when setting up the automated git pre-commit hook via the bundled install script so checks run automatically on every commit. Produces a PASS/FAIL report per check, with filenames and matching lines listed for failures.

2026-06-131

smaqit-infrastructure-provider-cyso

ruifrvaz/local-image-generator

Use this skill when making any Cyso Cloud decision — selecting a VM flavor, estimating cost, configuring Terraform credentials, looking up platform endpoints or resource IDs, setting up the OpenStack CLI, or running pre-flight checks. Routes the agent to the correct reference documentation before acting, preventing guesses on Cyso-specific facts (auth URL, image IDs, flavor names, credential formats).

2026-06-131

name	smaqit.infrastructure-domain-tls
description	Use when configuring a custom domain with a Let's Encrypt TLS certificate for a running nginx server. Covers DNS propagation verification, nginx server_name update, Certbot certificate issuance, HTTPS smoke tests, and auto-renewal verification. Also use when activating a purchased domain for a deployed application, setting up HTTPS post-deployment, or when a spec references INF-TOPOLOGY-004 through INF-TOPOLOGY-007 as pending TLS configuration.
metadata	{"version":"1.0.0"}

name	smaqit.infrastructure-domain-tls
description	Use when configuring a custom domain with a Let's Encrypt TLS certificate for a running nginx server. Covers DNS propagation verification, nginx server_name update, Certbot certificate issuance, HTTPS smoke tests, and auto-renewal verification. Also use when activating a purchased domain for a deployed application, setting up HTTPS post-deployment, or when a spec references INF-TOPOLOGY-004 through INF-TOPOLOGY-007 as pending TLS configuration.
metadata	{"version":"1.0.0"}