菜单
Query or inspect the self-hosted Prefect server at prefect-server.waow.tech, or the k3s cluster it runs on. Use when you need flow-run/deployment/block state, are told you have no credentials, are unsure which kubectl context is prod, or an /api/ call returns Unauthorized.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Register, change, or debug Prefect deployments in this repo — schedules, triggers, parameters, work pools, job variables, secret injection, or dependency/python-version problems in flow runs. Use when editing prefect.yaml or when a flow run fails during pull or dependency install.
Read or debug the daily infra cost snapshot across Fly, Hetzner, Cloudflare, and Neon. Use when asked whether a teardown reduced spend, why a provider total moved, how a resource is attributed to a project, or when adding a cost connector. Also covers Fly volume and snapshot cleanup.
Execute a flow in this repo by hand — locally for debugging, or through the API to exercise the real production worker. Use when asked to run, test, or trigger a flow outside its schedule, and to avoid corrupting production write paths while doing it.
Diagnose the home-pool process worker on heavypad, where all flow runs actually execute. Use when a flow run is stuck in RUNNING, a run died without logs, the worker seems down, or you need to reach the worker box or restart it safely.
| name | server-access |
| description | Query or inspect the self-hosted Prefect server at prefect-server.waow.tech, or the k3s cluster it runs on. Use when you need flow-run/deployment/block state, are told you have no credentials, are unsure which kubectl context is prod, or an /api/ call returns Unauthorized. |
Nothing is exported in the shell, and that is not the same as having no access.
Local tooling secrets live in .env at the repo root (gitignored). The justfile
has set dotenv-load, so every just recipe picks .env up automatically.
Keys: HCLOUD_TOKEN, POSTGRES_PASSWORD, AUTH_STRING, DOMAIN,
LETSENCRYPT_EMAIL, optional GRAFANA_DOMAIN. Live server is
DOMAIN=prefect-server.waow.tech.
If .env is missing, copy .env.example and fill it in — do not conclude the
task is blocked.
Prefer the recipe; it injects both env vars for you:
just prefect flow-run ls
just prefect deployment ls
just prefect block ls
It expands to:
PREFECT_API_URL="https://$DOMAIN/api" PREFECT_API_AUTH_STRING="$AUTH_STRING" \
uv run --with prefect prefect <args>
Raw API when the CLI doesn't expose what you need:
curl -H "Authorization: Basic $(printf "$AUTH_STRING" | base64)" \
"https://$DOMAIN/api/..."
AUTH_STRING is user:pass and is the admin credential. The Zig server's
Prefect-compatible BasicAuth comes from the prefect-auth secret —
unauthenticated /api/* returns Unauthorized, and /ui-settings reports
auth: "BASIC" for the bundled Prefect v2 UI login flow.
Rich tables truncate IDs and names into uselessness, and partial UUIDs are not accepted anywhere. Get full values as JSON:
just prefect api POST /flow_runs/filter --data '{"limit": 5}'
just prefect flow-run inspect <uuid> -o json
Also: --flow-name on flow-run ls does not reliably filter — it will
return unrelated flows. Filter via POST /flow_runs/filter instead of trusting
the flag.
Use prefect --no-prompt ... for anything that would otherwise ask for
confirmation.
The prod stack is a single-node k3s cluster, namespace prefect. A local
orbstack k8s context is not prod — verify context before acting.
kubectl reads kubeconfig.yaml at the repo root (gitignored); the justfile
exports KUBECONFIG := source_directory()/kubeconfig.yaml, so just status /
just logs target prod only once that file exists.
just status
just logs # defaults to component=prefect-server
just logs component=<name>
just health
If kubeconfig.yaml is missing, restore it out-of-band rather than falling back
to ambient kubectl context. just kubeconfig depends on local terraform state,
which may not be present. Re-fetch it after a server restart.
Node SSH access exists out-of-band. Do not commit host/IP/key details.
Flow execution does not happen here — see [[home-pool-worker]]. Registering deployments is [[deployments]].