@sylix/coworker 2.0.10 → 2.0.12

package/dist/skills/defaults/devops/gitlab-ci-patterns.md

@@ -0,0 +1,266 @@
+---
+name: gitlab-ci-patterns
+description: Build GitLab CI/CD pipelines with multi-stage workflows, caching, and distributed runners for scalable automation. Use when implementing GitLab CI/CD, optimizing pipeline performance, or setting up automated testing and deployment.
+---
+
+# GitLab CI Patterns
+
+Comprehensive GitLab CI/CD pipeline patterns for automated testing, building, and deployment.
+
+## Purpose
+
+Create efficient GitLab CI pipelines with proper stage organization, caching, and deployment strategies.
+
+## When to Use
+
+- Automate GitLab-based CI/CD
+- Implement multi-stage pipelines
+- Configure GitLab Runners
+- Deploy to Kubernetes from GitLab
+- Implement GitOps workflows
+
+## Basic Pipeline Structure
+
+```yaml
+stages:
+  - build
+  - test
+  - deploy
+
+variables:
+  DOCKER_DRIVER: overlay2
+  DOCKER_TLS_CERTDIR: "/certs"
+
+build:
+  stage: build
+  image: node:20
+  script:
+    - npm ci
+    - npm run build
+  artifacts:
+    paths:
+      - dist/
+    expire_in: 1 hour
+  cache:
+    key: ${CI_COMMIT_REF_SLUG}
+    paths:
+      - node_modules/
+
+test:
+  stage: test
+  image: node:20
+  script:
+    - npm ci
+    - npm run lint
+    - npm test
+  coverage: '/Lines\s*:\s*(\d+\.\d+)%/'
+  artifacts:
+    reports:
+      coverage_report:
+        coverage_format: cobertura
+        path: coverage/cobertura-coverage.xml
+
+deploy:
+  stage: deploy
+  image: bitnami/kubectl:latest
+  script:
+    - kubectl apply -f k8s/
+    - kubectl rollout status deployment/my-app
+  only:
+    - main
+  environment:
+    name: production
+    url: https://app.example.com
+```
+
+## Docker Build and Push
+
+```yaml
+build-docker:
+  stage: build
+  image: docker:24
+  services:
+    - docker:24-dind
+  before_script:
+    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
+  script:
+    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .
+    - docker build -t $CI_REGISTRY_IMAGE:latest .
+    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
+    - docker push $CI_REGISTRY_IMAGE:latest
+  only:
+    - main
+    - tags
+```
+
+## Multi-Environment Deployment
+
+```yaml
+.deploy_template: &deploy_template
+  image: bitnami/kubectl:latest
+  before_script:
+    - kubectl config set-cluster k8s --server="$KUBE_URL" --insecure-skip-tls-verify=true
+    - kubectl config set-credentials admin --token="$KUBE_TOKEN"
+    - kubectl config set-context default --cluster=k8s --user=admin
+    - kubectl config use-context default
+
+deploy:staging:
+  <<: *deploy_template
+  stage: deploy
+  script:
+    - kubectl apply -f k8s/ -n staging
+    - kubectl rollout status deployment/my-app -n staging
+  environment:
+    name: staging
+    url: https://staging.example.com
+  only:
+    - develop
+
+deploy:production:
+  <<: *deploy_template
+  stage: deploy
+  script:
+    - kubectl apply -f k8s/ -n production
+    - kubectl rollout status deployment/my-app -n production
+  environment:
+    name: production
+    url: https://app.example.com
+  when: manual
+  only:
+    - main
+```
+
+## Terraform Pipeline
+
+```yaml
+stages:
+  - validate
+  - plan
+  - apply
+
+variables:
+  TF_ROOT: ${CI_PROJECT_DIR}/terraform
+  TF_VERSION: "1.6.0"
+
+before_script:
+  - cd ${TF_ROOT}
+  - terraform --version
+
+validate:
+  stage: validate
+  image: hashicorp/terraform:${TF_VERSION}
+  script:
+    - terraform init -backend=false
+    - terraform validate
+    - terraform fmt -check
+
+plan:
+  stage: plan
+  image: hashicorp/terraform:${TF_VERSION}
+  script:
+    - terraform init
+    - terraform plan -out=tfplan
+  artifacts:
+    paths:
+      - ${TF_ROOT}/tfplan
+    expire_in: 1 day
+
+apply:
+  stage: apply
+  image: hashicorp/terraform:${TF_VERSION}
+  script:
+    - terraform init
+    - terraform apply -auto-approve tfplan
+  dependencies:
+    - plan
+  when: manual
+  only:
+    - main
+```
+
+## Security Scanning
+
+```yaml
+include:
+  - template: Security/SAST.gitlab-ci.yml
+  - template: Security/Dependency-Scanning.gitlab-ci.yml
+  - template: Security/Container-Scanning.gitlab-ci.yml
+
+trivy-scan:
+  stage: test
+  image: aquasec/trivy:latest
+  script:
+    - trivy image --exit-code 1 --severity HIGH,CRITICAL $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
+  allow_failure: true
+```
+
+## Caching Strategies
+
+```yaml
+# Cache node_modules
+build:
+  cache:
+    key: ${CI_COMMIT_REF_SLUG}
+    paths:
+      - node_modules/
+    policy: pull-push
+
+# Global cache
+cache:
+  key: ${CI_COMMIT_REF_SLUG}
+  paths:
+    - .cache/
+    - vendor/
+
+# Separate cache per job
+job1:
+  cache:
+    key: job1-cache
+    paths:
+      - build/
+
+job2:
+  cache:
+    key: job2-cache
+    paths:
+      - dist/
+```
+
+## Dynamic Child Pipelines
+
+```yaml
+generate-pipeline:
+  stage: build
+  script:
+    - python generate_pipeline.py > child-pipeline.yml
+  artifacts:
+    paths:
+      - child-pipeline.yml
+
+trigger-child:
+  stage: deploy
+  trigger:
+    include:
+      - artifact: child-pipeline.yml
+        job: generate-pipeline
+    strategy: depend
+```
+
+## Best Practices
+
+1. **Use specific image tags** (node:20, not node:latest)
+2. **Cache dependencies** appropriately
+3. **Use artifacts** for build outputs
+4. **Implement manual gates** for production
+5. **Use environments** for deployment tracking
+6. **Enable merge request pipelines**
+7. **Use pipeline schedules** for recurring jobs
+8. **Implement security scanning**
+9. **Use CI/CD variables** for secrets
+10. **Monitor pipeline performance**
+
+## Related Skills
+
+- `github-actions-templates` - For GitHub Actions
+- `deployment-pipeline-design` - For architecture
+- `secrets-management` - For secrets handling

package/dist/skills/defaults/devops/hybrid-cloud-networking.md

@@ -0,0 +1,241 @@
+---
+name: hybrid-cloud-networking
+description: Configure secure, high-performance connectivity between on-premises infrastructure and cloud platforms using VPN and dedicated connections. Use when building hybrid cloud architectures, connecting data centers to cloud, or implementing secure cross-premises networking.
+---
+
+# Hybrid Cloud Networking
+
+Configure secure, high-performance connectivity between on-premises and cloud environments using VPN, Direct Connect, and ExpressRoute.
+
+## Purpose
+
+Establish secure, reliable network connectivity between on-premises data centers and cloud providers (AWS, Azure, GCP).
+
+## When to Use
+
+- Connect on-premises to cloud
+- Extend datacenter to cloud
+- Implement hybrid active-active setups
+- Meet compliance requirements
+- Migrate to cloud gradually
+
+## Connection Options
+
+### AWS Connectivity
+
+#### 1. Site-to-Site VPN
+
+- IPSec VPN over internet
+- Up to 1.25 Gbps per tunnel
+- Cost-effective for moderate bandwidth
+- Higher latency, internet-dependent
+
+```hcl
+resource "aws_vpn_gateway" "main" {
+  vpc_id = aws_vpc.main.id
+  tags = {
+    Name = "main-vpn-gateway"
+  }
+}
+
+resource "aws_customer_gateway" "main" {
+  bgp_asn    = 65000
+  ip_address = "203.0.113.1"
+  type       = "ipsec.1"
+}
+
+resource "aws_vpn_connection" "main" {
+  vpn_gateway_id      = aws_vpn_gateway.main.id
+  customer_gateway_id = aws_customer_gateway.main.id
+  type                = "ipsec.1"
+  static_routes_only  = false
+}
+```
+
+#### 2. AWS Direct Connect
+
+- Dedicated network connection
+- 1 Gbps to 100 Gbps
+- Lower latency, consistent bandwidth
+- More expensive, setup time required
+
+**Reference:** See `references/direct-connect.md`
+
+### Azure Connectivity
+
+#### 1. Site-to-Site VPN
+
+```hcl
+resource "azurerm_virtual_network_gateway" "vpn" {
+  name                = "vpn-gateway"
+  location            = azurerm_resource_group.main.location
+  resource_group_name = azurerm_resource_group.main.name
+
+  type     = "Vpn"
+  vpn_type = "RouteBased"
+  sku      = "VpnGw1"
+
+  ip_configuration {
+    name                          = "vnetGatewayConfig"
+    public_ip_address_id          = azurerm_public_ip.vpn.id
+    private_ip_address_allocation = "Dynamic"
+    subnet_id                     = azurerm_subnet.gateway.id
+  }
+}
+```
+
+#### 2. Azure ExpressRoute
+
+- Private connection via connectivity provider
+- Up to 100 Gbps
+- Low latency, high reliability
+- Premium for global connectivity
+
+### GCP Connectivity
+
+#### 1. Cloud VPN
+
+- IPSec VPN (Classic or HA VPN)
+- HA VPN: 99.99% SLA
+- Up to 3 Gbps per tunnel
+
+#### 2. Cloud Interconnect
+
+- Dedicated (10 Gbps, 100 Gbps)
+- Partner (50 Mbps to 50 Gbps)
+- Lower latency than VPN
+
+## Hybrid Network Patterns
+
+### Pattern 1: Hub-and-Spoke
+
+```
+On-Premises Datacenter
+         ↓
+    VPN/Direct Connect
+         ↓
+    Transit Gateway (AWS) / vWAN (Azure)
+         ↓
+    ├─ Production VPC/VNet
+    ├─ Staging VPC/VNet
+    └─ Development VPC/VNet
+```
+
+### Pattern 2: Multi-Region Hybrid
+
+```
+On-Premises
+    ├─ Direct Connect → us-east-1
+    └─ Direct Connect → us-west-2
+            ↓
+        Cross-Region Peering
+```
+
+### Pattern 3: Multi-Cloud Hybrid
+
+```
+On-Premises Datacenter
+    ├─ Direct Connect → AWS
+    ├─ ExpressRoute → Azure
+    └─ Interconnect → GCP
+```
+
+## Routing Configuration
+
+### BGP Configuration
+
+```
+On-Premises Router:
+- AS Number: 65000
+- Advertise: 10.0.0.0/8
+
+Cloud Router:
+- AS Number: 64512 (AWS), 65515 (Azure)
+- Advertise: Cloud VPC/VNet CIDRs
+```
+
+### Route Propagation
+
+- Enable route propagation on route tables
+- Use BGP for dynamic routing
+- Implement route filtering
+- Monitor route advertisements
+
+## Security Best Practices
+
+1. **Use private connectivity** (Direct Connect/ExpressRoute)
+2. **Implement encryption** for VPN tunnels
+3. **Use VPC endpoints** to avoid internet routing
+4. **Configure network ACLs** and security groups
+5. **Enable VPC Flow Logs** for monitoring
+6. **Implement DDoS protection**
+7. **Use PrivateLink/Private Endpoints**
+8. **Monitor connections** with CloudWatch/Monitor
+9. **Implement redundancy** (dual tunnels)
+10. **Regular security audits**
+
+## High Availability
+
+### Dual VPN Tunnels
+
+```hcl
+resource "aws_vpn_connection" "primary" {
+  vpn_gateway_id      = aws_vpn_gateway.main.id
+  customer_gateway_id = aws_customer_gateway.primary.id
+  type                = "ipsec.1"
+}
+
+resource "aws_vpn_connection" "secondary" {
+  vpn_gateway_id      = aws_vpn_gateway.main.id
+  customer_gateway_id = aws_customer_gateway.secondary.id
+  type                = "ipsec.1"
+}
+```
+
+### Active-Active Configuration
+
+- Multiple connections from different locations
+- BGP for automatic failover
+- Equal-cost multi-path (ECMP) routing
+- Monitor health of all connections
+
+## Monitoring and Troubleshooting
+
+### Key Metrics
+
+- Tunnel status (up/down)
+- Bytes in/out
+- Packet loss
+- Latency
+- BGP session status
+
+### Troubleshooting
+
+```bash
+# AWS VPN
+aws ec2 describe-vpn-connections
+aws ec2 get-vpn-connection-telemetry
+
+# Azure VPN
+az network vpn-connection show
+az network vpn-connection show-device-config-script
+```
+
+## Cost Optimization
+
+1. **Right-size connections** based on traffic
+2. **Use VPN for low-bandwidth** workloads
+3. **Consolidate traffic** through fewer connections
+4. **Minimize data transfer** costs
+5. **Use Direct Connect** for high bandwidth
+6. **Implement caching** to reduce traffic
+
+## Reference Files
+
+- `references/vpn-setup.md` - VPN configuration guide
+- `references/direct-connect.md` - Direct Connect setup
+
+## Related Skills
+
+- `multi-cloud-architecture` - For architecture decisions
+- `terraform-module-library` - For IaC implementation