vps-docker-traefik-deploy
Plan and implement secure production deployments of Docker Compose applications on self-hosted VPS or cloud servers using Docker Engine, Docker Compose, Traefik, private registries, SSH tunnels, least-privilege users, persistent volumes, backups, DNS, and storage growth planning. Use when an AI agent needs to design, review, document, or execute a real deploy for websites, APIs, websockets, workers, databases, and object storage integrations on Ubuntu or Debian style Linux hosts.
What this skill does
# VPS Docker Traefik Deploy ## Overview Use this skill to turn an application stack into a real production deployment plan with secure host setup, reverse proxying, registry-based releases, private admin access, persistent storage, backups, and rollback. Prefer Ubuntu LTS or Debian stable. Prefer immutable image tags. Prefer Traefik for public ingress and SSH tunnels for admin-only access. ## Workflow 1. Establish facts before changing anything. 2. Minimize the public network surface. 3. Baseline the host with a non-root operator account. 4. Install Docker from the official stable channel. 5. Deploy Traefik separately from the app stack. 6. Keep state outside container writable layers. 7. Deploy app images by pull, not by rebuilding on the server. 8. Validate health, backup, restore, rollback, and pruning. ## Establish Facts Confirm these points first: - operating system and version - public domains and subdomains - TLS strategy: HTTP challenge or DNS challenge - public services: website, API, websocket, admin UI, registry - private services: database, Redis, dashboards - registry type: managed or self-hosted - persistent data locations - backup destination and retention - restore expectations - whether a single VPS is still acceptable If the project already has deployment docs, read them first and treat them as the application-specific contract. ## Public Exposure Rules Default public ports: - `22/tcp` for SSH - `80/tcp` for HTTP redirect and ACME when needed - `443/tcp` for HTTPS Keep these private unless there is a strong reason: - Traefik dashboard - MariaDB or PostgreSQL - Redis - private registry - app service ports that can sit behind Traefik - internal admin tools If a GUI tool is required, bind the service to `127.0.0.1` only and use an SSH tunnel from the operator workstation. ## Output Requirements When using this skill, produce a deployment answer that includes: - target topology - exact public ports - folder layout - user and permission model - Docker and Traefik install method - DNS record plan - Traefik routing plan - registry flow - persistent data plan - storage growth plan - backup and restore plan - rollout and rollback commands ## Mandatory Guardrails - Do not recommend public exposure of database, Redis, registry, or proxy dashboards by default. - Do not recommend deploying as the host root account. - Do not recommend mutable `latest` tags for production. - Do not keep important state only inside container writable layers. - Do not call a plan complete unless backup and rollback are addressed. ## Reference Files Read these files only when needed: - [references/server-baseline.md](references/server-baseline.md) Use for Ubuntu 24.04 host prep, non-root users, SSH hardening, swap, firewall, Docker install. - [references/traefik-dns.md](references/traefik-dns.md) Use for Traefik layout, dashboard tunneling, DNS, subdomains, Cloudflare, and routing patterns. - [references/registry-storage-backup.md](references/registry-storage-backup.md) Use for private registries, image retention, bind mounts versus volumes, S3-compatible storage, backup, restore, and cleanup. - [references/deploy-checklist.md](references/deploy-checklist.md) Use for rollout steps, post-deploy verification, rollback, and maintenance cadence.
Related in Ads & Marketing
ads
IncludedMulti-platform paid advertising audit and optimization skill. Analyzes Google, Meta, YouTube, LinkedIn, TikTok, Microsoft, and Apple Ads. 250+ checks with scoring, parallel agents, industry templates, and AI creative generation.
banana
IncludedAI image generation Creative Director powered by Google Gemini Nano Banana models. Use this skill for ANY request involving image creation, editing, visual asset production, or creative direction. Triggers on: generate an image, create a photo, edit this picture, design a logo, make a banner, visual for my anything, and all /banana commands. Handles text-to-image, image editing, multi-turn creative sessions, batch workflows, and brand presets.
rpg-migration-analyzer
IncludedAnalyzes legacy RPG (Report Program Generator) programs from AS/400 and IBM i systems for migration to modern Java applications. Extracts business logic from RPG III/IV/ILE source code, identifies data structures (D-specs), file operations (F-specs), program dependencies (CALLB/CALLP), and converts RPG constructs to Java equivalents. Generates migration reports, complexity estimates, and Java implementation strategies with POJO classes, JPA entities, and service methods. Use when modernizing AS/400 or IBM i legacy systems, analyzing RPG source files (.rpg, .rpgle, .RPGLE), converting RPG to Java, mapping data specifications to Java classes, planning legacy system migration, or when user mentions RPG analysis, Report Program Generator, RPG III/IV/ILE, AS/400 modernization, IBM i migration, packed decimal conversion, or mainframe application rewrite.
brand-library-architect
IncludedBuild a complete brand library for a product — visual asset render pipeline, brand documentation set (BRAND, COPY, MANIFESTO, BIOS, FAQ, GLOSSARY, TONE, PRICING), open-source convention files (README, CONTRIBUTING, SECURITY, CODE_OF_CONDUCT), and a self-contained press kit. This skill should be used when the user asks to "build a brand library / brand kit / press kit / brand assets" for a product, "set up a brand library workflow," "create a positioning manifesto plus visual identity," or any combination of brand documentation + visual asset pipeline. Apply phase-by-phase or run end-to-end. Templates are product-agnostic and use {{TOKEN}} placeholders the skill prompts the user to fill.
writing-tech-post
IncludedAuthors engineering blog posts end-to-end: launch deep-dives, incident postmortems, architecture migrations, performance case studies, tutorials, AI/agent system writeups, security disclosures, and research-to-product translations. Picks the correct archetype, plans the abstraction ladder, enforces an evidence cadence (diagrams, benchmarks, profiles, traces, code, ablations), tunes voice against publisher house styles (Datadog, Vercel, GitHub, AWS, Meta, Cloudflare, Jane Street), and runs a pre-publish gate for narrative momentum and disclosure ethics. Use when drafting a new engineering post, restructuring a draft that feels flat, deciding which evidence form belongs where, validating that depth and product context are balanced, or preparing a postmortem, migration, or performance narrative for external publication. Do not use for API reference documentation, README authoring, marketing copy, release notes, generic SEO content, ghost-written executive thought leadership, or non-engineering long-form essays.
blog-google
IncludedGoogle API integration for blog performance: PageSpeed Insights, CrUX Core Web Vitals with 25-week history, Search Console performance, URL Inspection, Indexing API, GA4 organic traffic, NLP entity analysis for E-E-A-T, YouTube video search for embedding, and Google Ads Keyword Planner. Progressive feature availability based on credential tier (API key, OAuth/service account, GA4, Ads). Shares config with claude-seo at ~/.config/claude-seo/google-api.json. Use when user says "google data", "page speed", "core web vitals", "search console", "indexation", "GA4", "keyword research", "nlp entities", "blog performance", "youtube search", "google api setup".