hostwarden

hostwarden-coordinator

The operational coordinator of an operations checkout — a background session, one per checkout, that keeps the picture of which session works on which host, relays an announced disruptive step to idle writers on its radius, holds planned sequences across sessions, and watches maintenance windows. It reaches no server and approves nothing. The session start starts it by itself; run in an interactive session, the skill stops it and keeps it off, or starts it again. Use when the user says "stop the coordinator", "turn the coordinator off", "start the coordinator again", "who works where right now?", "which session is on pve1?", "stopp den Koordinator", "schalte den Koordinator ab", "starte den Koordinator wieder", "wer arbeitet gerade wo?", "welche Session ist auf pve1?". Not for announcing a step, which every session does itself (rules/coordination.md → Announce, wait, go).

DevOps & Infrastructure Listed

hostwarden-deploy-user

Set up, audit or remove a dedicated account for automated deployments — a CI/CD deploy user with a restricted shell, its own SSH key, a deployment directory it owns, and narrowly scoped sudo if it needs any at all. Use when the user asks to "set up deployment for <app>", "add a deploy user", "connect GitHub Actions to this server", "GitLab CI should deploy here", "give the pipeline SSH access", "einen Deploy-User anlegen", or asks how a build server should reach a host. Also use when removing such an account. Never hand a pipeline root or a person's own account.

hostwarden-email

Send an email about a managed server — ad-hoc text and/or file attachments. Use when the user asks to "email me X", "send X by mail", "mail this to <address>", "attach /var/log/foo to an email", or "send a report by email". The first email per host asks where to send from (local workstation vs the server itself). On the remote path, prefers the existing MTA (postfix, sendmail, msmtp) and asks before installing one. Sends unprivileged — as the SSH user, or dropping from root via `runuser`/`su -` when the session is root. Attachments check sender readability, size, and offer a content preview before sending. **Never run automatically** — only on explicit user request.

hostwarden-fleet-audit

Compare key policies across all servers in memory/machines/ to surface silent drift. Makes no configuration changes; writes one audit-trail line to each host's journal. Probes unattended-upgrades, sshd effective config and SSH CA trust, firewall posture, MTA, network stack and resolver, time sync, auto-reboot behaviour, mesh VPNs and their SSH servers, accounts and sudo rules, Ubuntu Pro/ESM coverage and needrestart mode, and the records of DNS resolvers that should answer alike. Use when the user asks to "fleet audit", "vergleiche alle server", "policy drift check", "are my servers configured the same?", or after a fix on one host to find which others carry the same bug.

hostwarden-fleet-read

Set up an operations host that runs the fleet's housekeeping unattended, and fleet read — the least-privilege way it reads each host. Each host gets a forced-command wrapper that runs only a bundle of read-only checks the operator signed, and writes one read-only journal line; the bundle is built from the housekeeping references and signed by the operator, never by Hostwarden. Use when the user asks to "set up an operations host", "run the nightly housekeeping from <machine>", "set up fleet read on <host>", "let the operations host read <host>", "build the fleet-read bundle", "rebuild the bundle", "the bundle expires", "remove fleet read from <host>", "richte einen Ops-Host ein", "Fleet-Read auf <host> einrichten", "bau das Bündel neu", "das Bündel läuft ab", or "nimm <host> aus dem Fleet-Read".

hostwarden-heinzel-takeover

Take over an existing Heinzel installation — copy its memory, access lists, overrides and host keys into this clone, list what Heinzel left on each server, and onboard each host read-only. Can run host by host. Use when the user says "übernimm mein altes Heinzel", "migrate my Heinzel setup", "mein Heinzel liegt in <pfad>", "nimm erstmal nur server X mit", "take pve1 over from Heinzel", or points at a Heinzel directory to take over. Needs an explicit request — a mention of Heinzel is not one. Not for onboarding a host that never ran Heinzel (hostwarden-onboard).

hostwarden-housekeeping

Run a Hostwarden housekeeping (health) inspection on a server — disk, memory, load, pending updates, firewall, SSL certs, failed systemd units or OpenRC services, logs, kernel reboot status, and service-specific checks. Use when the user asks to "run housekeeping", "housekeeping report", "run a health check on <host>", or "do routine inspection". Do NOT auto-invoke for ambiguous requests like "check server <host>" — that's reserved for quick queries. Covers Linux (Debian, Ubuntu, RHEL, CentOS, Fedora, SUSE, Alpine), FreeBSD, macOS and Windows Server (read-only). Also use it for "schedule housekeeping", "run a nightly check", or "email me a weekly report automatically".

DevOps & Infrastructure Listed

hostwarden-new-guest

Create a new virtual machine or system container on a hypervisor Hostwarden manages — Proxmox VE, libvirt, Incus, LXD or classic LXC — from the distribution's official cloud image, container template or installer, with the Hostwarden server baseline applied at first boot in whatever form that guest reads (cloud-init, Ignition, kickstart, preseed, autoinstall, AutoYaST), then registered like every other guest. Also builds and rebuilds the baseline template for containers on Proxmox VE. Use when the user asks to "create a VM on pve1", "set up a new container", "spin up a Debian guest", "make me a new server on <host>", "build the container template", "neuen LXC anlegen", "setz mir eine VM auf", "leg einen neuen Container auf pve1 an", "ich brauche eine neue VM". Not for installing or replacing the OS on an existing machine, which is hostwarden-os-install.

hostwarden-onboard

Onboard a host into Hostwarden explicitly and read-only, as its first connection — the full OS and hardware probe, its memory with what housekeeping would record, the network profile where the host has one, on a hypervisor the guest inventory and registration, then what it lacks against the server baseline, and a report. A host Hostwarden already knows is probed in full again and its memory refreshed. Use when the user says "onboard web1", "add this server to Hostwarden", "take db1 into Hostwarden", "set up pve1 in Hostwarden", "nimm web1 in Hostwarden auf", "übernimm den Server xyz in die Verwaltung", "richte db1 in Hostwarden ein", or names hosts to be onboarded. Makes no change on a server beyond one read-only line in each host's journal. Not for taking over a Heinzel installation (hostwarden-heinzel-takeover), and not for a new guest (hostwarden-new-guest).

DevOps & Infrastructure Listed

hostwarden-os-install

Install, replace, or dual-boot an operating system on a managed machine, including the disk and EFI work that comes with it — wipe-and-reinstall, adding a second OS beside an existing one, deploying from a cloud image (qcow2, raw, VMDK), freeing a partition on a live system, and managing EFI boot entries and boot order. Use when the user asks to "replace the OS on <host>", "reinstall this server", "migrate from CentOS to Debian", "set up dual-boot", "install FreeBSD next to Linux", "deploy this cloud image", "repartition the disk", "der Server soll ein anderes Betriebssystem bekommen", or asks about boot entries, BootOrder, or a machine that no longer boots after an install. Destructive and irreversible in most of its paths — needs an explicit request, a confirmed backup, and the operator to relaunch with the taboo guard disabled. Not for creating a new VM or container on a hypervisor, which is hostwarden-new-guest.

hostwarden-runtimes

Install, upgrade, report on or remove a programming language runtime on a server — Node.js, Python, Ruby, Go, Java, Elixir, Rust and anything else mise carries. Use when the user asks to "install Node on <host>", "put the latest stable Ruby on this server", "upgrade Python", "which Node version is on web1", "what runtimes does this host have", "remove Ruby from web1", "install Rails", or names any language or framework that needs a runtime before it can run. Also covers the non-interactive shell setup that makes the runtime visible over SSH.

hostwarden-security

Run a Hostwarden security audit on a server — SSH hardening (password auth, weak algos, root login, host certificates, user CA trust), firewall, user account hygiene, where accounts and sudo rules come from and who holds them, listening services, kernel hardening (ASLR, IP forwarding), file permissions, SUID/SGID audit, fail2ban. Use when the user asks for a "security audit", "security review", "hardening check", "Sicherheitsaudit", "prüf die Härtung", or to "audit security on <host>". Do NOT auto-invoke on generic phrases like "check server <host>". Covers Linux (Debian, Ubuntu, RHEL, CentOS, Fedora, SUSE, Alpine), FreeBSD, macOS (SIP, FileVault, Gatekeeper) and Windows Server (read-only; SSH, firewall, accounts, SMBv1, Remote Desktop, Defender, BitLocker).

hostwarden-baseline

Bring an existing server up to the Hostwarden server baseline — firewall with default deny, automatic security updates, time sync, key-only SSH, persistent journal, storage maintenance (TRIM, RAID checks, scrubs, smartd), guest agent, backup, and the user's own additions such as admin keys, timezone, mail relay and monitoring agent. Lists what is missing, then applies it one asked step at a time. Use when the user asks to "bring web1 up to the baseline", "apply the baseline to <host>", "harden this server to our standard", "what is <host> missing from the baseline", "zieh web1 auf die Baseline", "bring den Server auf unseren Standard", "was fehlt <host> zur Baseline". Not for a new guest, which gets the baseline at creation (hostwarden-new-guest).

hostwarden-multi-host

Run one question, command or change on several managed servers at once and report the answers grouped, so hosts that agree print once and the outlier stands out. Each host runs the full pipeline in its own subagent; a change asks once, names every host and goes to a canary first. Use when the user names two or more servers, or all of them, for one task — "which kernel runs on web1, web2 and web3?", "check disk space on all servers", "is nginx running everywhere?", "roll this config out to the web servers", "run housekeeping on web1 and db1", "welcher Kernel läuft auf allen Servern?", "prüf auf allen Servern, ob nginx läuft", "spiel die Änderung auf allen Webservern aus", "mach Housekeeping auf web1 und db1". Not for one server, not for the fleet audit (hostwarden-fleet-audit), and not for copying files between hosts.