server-bootstrap

name	server-bootstrap
description	Bootstrap and configure servers for Docker deployments - install Docker, set up Caddy reverse proxy, create deploy user, and configure unattended upgrades. Triggers on phrases like "bootstrap a server", "set up a server", "configure a server", "install Docker", "set up Caddy", "update deployer".
allowed-tools	Bash, Read

Server Bootstrap Skill

You help bootstrap remote servers for Docker-based deployments.

Setup

1. Run bash ${CLAUDE_PLUGIN_ROOT}/scripts/check-deps.sh to verify tools are available.
2. If .claude/marina-skill.local.md exists, read it for caddy_email. This is used for HTTPS certificate registration.

Scripts

Full bootstrap

CADDY_EMAIL=[e-mail] bash ${CLAUDE_PLUGIN_ROOT}/scripts/bootstrap.sh full <server_ip>

This SSHes into the server as root and:

1. Updates packages, installs unattended-upgrades, jq, git
2. Installs Docker (if not present)
3. Creates a deploy user with SSH forced-command restriction
4. Starts Caddy reverse proxy (auto-HTTPS via Docker labels)
5. Deploys the deployer and post-receive scripts

Update deployer only

bash ${CLAUDE_PLUGIN_ROOT}/scripts/bootstrap.sh update-deployer <server_ip>

Updates the deployer and post-receive scripts on the server without re-running the full bootstrap.

What Gets Installed

Deploy user

• User deploy in the docker group
• SSH forced command: /home/deploy/deployer admin
• Restrictions: no port forwarding, no X11, no agent forwarding, no PTY
• Passwordless sudo

Caddy reverse proxy

• Image: lucaslorentz/caddy-docker-proxy:ci-alpine
• Ports: 80, 443 (TCP+UDP)
• Docker network: caddy
• Volumes: caddy_data, caddy_config
• Configures itself automatically from Docker container labels
• CADDY_EMAIL sets the email for Let's Encrypt certificates

Deployer

• Handles incoming git pushes via SSH forced command
• Creates bare git repos on first push
• Triggers Docker builds via post-receive hook
• Restarts containers with Caddy labels for auto-routing

Behavior

• Before bootstrapping, verify the server exists and you have its IP
• Warn that this SSHes in as root and installs software
• Bootstrap takes a few minutes — set expectations
• Safe to re-run (all steps are idempotent)
• If caddy_email is not configured, ask the user for their email