proof-of-prodlisted

Harden a small production web app behind Cloudflare and prove every layer actually works. Use when deploying, securing, or reviewing an app on a single server/VPS behind Cloudflare: locking the origin so it only accepts Cloudflare (closing the direct-IP bypass), edge-caching public read endpoints, enabling free-tier WAF / Bot Fight / rate limits / HSTS / Always Online, adding a dependency-aware health check, and wiring external uptime monitoring. Every step ships with a curl command that proves it. Triggers: "harden my server", "lock down the origin", "Cloudflare security", "protect my VPS", "production hardening", "is my site actually secure", "add a health check and monitoring". Framework-agnostic, with app recipes for Laravel, Node/Express, Django, Go, and Next.js.
arcubalino/proof-of-prod · ★ 0 · DevOps & Infrastructure · score 72

Install: claude install-skill arcubalino/proof-of-prod

# proof-of-prod Apply a **verification-driven** hardening pass to a small app behind Cloudflare. The rule of this skill: **nothing is "done" until its verify command passes.** Bundled reference files live beside this file — read them as you go. ## 1. Gather context first Ask for / detect: - the **domain** and the **origin server IP**, - the **reverse proxy** (nginx / Caddy / Traefik / Apache / cloud firewall), - the **app framework** (Laravel / Node / Django / Go / Next.js / other), - which endpoints are **anonymous public reads** (cacheable) vs interactive/authenticated, - the **login path** and any sensitive admin paths. ## 2. Work the four layers in order Follow `CHECKLIST.md` top to bottom. For each item: make (or guide) the change, then run its **verify** command and confirm it passes before moving on. - **Edge (Cloudflare)** — `edge/cloudflare.md`. These are dashboard actions the user performs; give exact click-paths, then verify with curl. Never tell the user to buy paid features: the Managed WAF Rulesets are Pro+ and unnecessary; the free Custom Rules + one Rate-Limit rule + Bot Fight Mode are enough. Say so. - **Origin** — `origin/nginx.conf.example` (or the matching proxy in `origin/README.md`). This is the **highest-value fix**: the origin must reject any request whose real peer isn't a Cloudflare edge IP, and restore the real client IP from `CF-Connecting-IP`. Mind the gotcha: match the allowlist on `$realip_remote_addr`, not `$remote_addr`. -