deploy

# Deploy Skill Six modes. Match the request to a section. | Signal | Section | |--------|---------| | Deploy site, HTTPS, nginx, go live, public site | A. Public Web Deploy | | Dev branch, Concourse dev lane, hermes/maia | B. Dev-Branch Deploy | | Cron job, scheduled task, audit cron script | C. Cron Automation | | Headless agent, wrapper script, recurring Claude task | D. Headless Cron Creator | | Install toolkit, verify setup, health check | E. Toolkit Install | | Fish shell, Zsh, shell config, migration | F. Shell Configuration | | Background process, nohup, trap, PID, signals | G. Process Management | When the request spans modes, compose the relevant sections. --- ## A. Public Web Deploy Serve public sites through nginx/Caddy/Apache -- never a raw dev server. Local preview binds `127.0.0.1`; public sites require HTTPS + hardened nginx. **5-phase workflow**: DNS -> Web Server -> HTTPS -> Hardening -> Verify. 1. **DNS**: Create A/AAAA record. Verify: `dig +short A <fqdn>`. Gate: resolves to intended IP. 2. **Web Server**: nginx server block with explicit docroot. Backend proxied to `127.0.0.1`. Test: `nginx -t && systemctl reload nginx`. 3. **HTTPS**: `certbot --nginx -d <fqdn>`. Verify renewal: `certbot renew --dry-run`. Verify redirect: `curl -sI http://<fqdn> | grep -iE '301|308'`. 4. **Hardening**: Firewall (ufw allow 80/443/SSH only), nginx deny rules (`location ~ /\. { deny all; }`), security headers (HSTS, X-Content-Type-Options, CSP in Report-Only), rate li...