deploy

Routes Kamal, Terraform, and Grafana Cloud infrastructure operations to canonical docs and verified invariants.

23|1|Updated Feb 26, 2026
One-click install
npx skills add https://github.com/Alexey-Lukin/silken_net --skill deploy-alexey-lukin
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: deploy
Source: https://github.com/Alexey-Lukin/silken_net/tree/main/.claude/skills/deploy
Command: npx skills add https://github.com/Alexey-Lukin/silken_net --skill deploy-alexey-lukin

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Operating the silken_net production and canopy infrastructure requires knowing dozens of non-obvious invariants and verified gotchas about Kamal deploys, Terraform GCP resources, secrets chains, and Grafana alerting; this Skill routes every infra task to the correct canonical doc and surfaces the load-bearing rules before changes are made. ## Core Features & Use Cases - Canonical routing: Maps each infrastructure concern (Kamal/Terraform deploy, observability, secrets, Puma, disaster recovery, CI/CD, resilience) to its authoritative 06_xx documentation file instead of duplicating facts. - Invariant and gotcha indexes: Provides one-line indexes of 28 load-bearing invariants and 28 verified gotchas, with full mechanisms in companion files invariants.md and gotchas.md that load on demand. - Use Case: Before rotating a secret or running a deploy, consult the Skill to learn that secrets live in config/deploy.yml env.secret, that BOOT_CRITICAL is the only place an empty secret becomes loud, and that gh run watch exit codes cannot be trusted. ## Quick Start Ask the deploy skill what must be checked before changing a Terraform resource, a Kamal secret, or a Grafana alert on the silken_net infrastructure.

Frequently Asked Questions about deploy

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I deploy a Rails app with Kamal on GCP?

Kamal deploys run inside the GCP VPC against a private-IP app host, with Cloud SQL private-only and no Auth Proxy at runtime. The canonical procedure lives in the 06_01 DEPLOY-DAY doc; this Skill routes you there and lists the invariants to check first.

Where should secrets live in a Kamal deployment?

The canonical home is config/deploy.yml env.secret, with each variable also declared in .kamal/secrets-common and the env block of both deploy workflows. Missing any of the five surfaces delivers an empty variable to the container despite a green secrets check.

Why does gh run watch report wrong exit codes?

gh run watch --exit-status returns exit 0 on failure and 1 on empty runs, so it cannot verify a deploy. Use gh run view --json conclusion instead, and check whether failed jobs actually started, since infrastructure failures mask code failures.

How does Grafana Cloud alerting work with Alloy?

Grafana Alloy scrapes one target per process and slot and forwards metrics to Grafana Cloud SaaS; no self-hosted Prometheus is needed. One Alloy container serves both slots, so accessory boot commands must never pass a destination flag.

What are the limitations of terraform fmt with tfvars files?

terraform fmt -diff renders terraform.tfvars content, printing secrets like db_password into logs and transcripts. Scope the command explicitly with terraform fmt *.tf, and rotate any value that leaked before it becomes a live credential.