ginskill-init 2.7.0

package/skills/traefik/docs/cicd-devops.md

@@ -0,0 +1,396 @@
+# CI/CD, Deployments & DevOps
+
+## Blue-Green Deployments
+
+Maintain two environments (blue=current, green=new). Switch traffic instantly.
+
+### Docker Compose
+```yaml
+services:
+  app-blue:
+    image: myapp:1.0.0
+    networks: [proxy]
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.app.rule=Host(`app.example.com`)"
+      - "traefik.http.services.app.loadbalancer.server.port=8080"
+
+  app-green:
+    image: myapp:1.1.0
+    networks: [proxy]
+    labels:
+      - "traefik.enable=false"  # Toggle to switch
+```
+
+Switch: change `traefik.enable` labels and restart/recreate containers.
+
+### Kubernetes (TraefikService)
+```yaml
+apiVersion: traefik.io/v1alpha1
+kind: TraefikService
+metadata:
+  name: app-weighted
+spec:
+  weighted:
+    services:
+      - name: app-blue
+        port: 80
+        weight: 100   # All traffic to blue
+      - name: app-green
+        port: 80
+        weight: 0     # Change to 100 for cutover
+```
+
+## Canary Releases
+
+Gradually shift traffic percentage to new version.
+
+```yaml
+apiVersion: traefik.io/v1alpha1
+kind: TraefikService
+metadata:
+  name: app-canary
+spec:
+  weighted:
+    services:
+      - name: app-stable
+        port: 80
+        weight: 95
+      - name: app-canary
+        port: 80
+        weight: 5    # Start small, increase gradually
+```
+
+### Automated with Flagger
+
+```yaml
+apiVersion: flagger.app/v1beta1
+kind: Canary
+metadata:
+  name: app
+spec:
+  provider: traefik
+  targetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: app
+  service:
+    port: 80
+  analysis:
+    interval: 30s
+    threshold: 5         # Max failed checks
+    maxWeight: 50         # Max canary traffic %
+    stepWeight: 10        # Increment per interval
+    metrics:
+      - name: request-success-rate
+        thresholdRange:
+          min: 99
+        interval: 30s
+      - name: request-duration
+        thresholdRange:
+          max: 500
+        interval: 30s
+```
+
+## A/B Testing
+
+Route based on headers, cookies, or query params:
+
+```yaml
+http:
+  routers:
+    variant-b:
+      rule: "Host(`app.example.com`) && Headers(`X-Variant`, `B`)"
+      service: app-variant-b
+      priority: 200
+
+    variant-a:
+      rule: "Host(`app.example.com`)"
+      service: app-variant-a
+      priority: 100
+```
+
+## Traffic Mirroring (Shadow Testing)
+
+Send copy of production traffic to test environment:
+
+```yaml
+apiVersion: traefik.io/v1alpha1
+kind: TraefikService
+metadata:
+  name: app-mirror
+spec:
+  mirroring:
+    name: app-production
+    port: 80
+    mirrors:
+      - name: app-staging
+        port: 80
+        percent: 20  # Mirror 20% of traffic
+```
+
+## GitOps with FluxCD
+
+```yaml
+# flux/traefik-helmrelease.yaml
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: traefik
+  namespace: traefik
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: traefik
+      version: ">=34.0.0"
+      sourceRef:
+        kind: HelmRepository
+        name: traefik
+  values:
+    deployment:
+      replicas: 3
+    providers:
+      kubernetesCRD:
+        enabled: true
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: traefik
+  namespace: traefik
+spec:
+  interval: 1h
+  url: https://traefik.github.io/charts
+```
+
+## GitOps with ArgoCD
+
+```yaml
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: traefik
+  namespace: argocd
+spec:
+  project: infrastructure
+  source:
+    repoURL: https://traefik.github.io/charts
+    chart: traefik
+    targetRevision: "34.0.0"
+    helm:
+      values: |
+        deployment:
+          replicas: 3
+        providers:
+          kubernetesCRD:
+            enabled: true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: traefik
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+```
+
+## Zero-Downtime Deployment Checklist
+
+1. Configure health checks on all services
+2. Set `readinessProbe` and `livenessProbe` on pods
+3. Add `lifecycle.preStop` hook for graceful drain:
+   ```yaml
+   lifecycle:
+     preStop:
+       exec:
+         command: ["sh", "-c", "sleep 15"]
+   ```
+4. Set `terminationGracePeriodSeconds: 30`
+5. Use rolling update strategy with `maxSurge: 1, maxUnavailable: 0`
+6. Enable sticky sessions if stateful
+7. Monitor error rates during rollout
+
+## CI/CD Pipeline Example (GitHub Actions)
+
+```yaml
+name: Deploy
+on:
+  push:
+    branches: [main]
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build and push image
+        run: |
+          docker build -t registry.example.com/app:${{ github.sha }} .
+          docker push registry.example.com/app:${{ github.sha }}
+
+      - name: Update deployment
+        run: |
+          kubectl set image deployment/app app=registry.example.com/app:${{ github.sha }}
+          kubectl rollout status deployment/app --timeout=300s
+
+      - name: Verify health
+        run: |
+          curl -sf https://app.example.com/health || exit 1
+```
+
+## Multi-Environment Patterns (dev/staging/prod)
+
+### Namespace-Based Isolation (Kubernetes)
+```yaml
+# Each environment gets its own namespace + IngressRoute
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: app
+  namespace: staging
+spec:
+  entryPoints: [websecure]
+  routes:
+    - match: Host(`staging.example.com`)
+      kind: Rule
+      services:
+        - name: app
+          port: 80
+  tls:
+    certResolver: letsencrypt
+```
+
+### Docker Compose Overrides
+```bash
+# Base + environment overlay
+docker compose -f docker-compose.yml -f docker-compose.staging.yml up -d
+```
+
+```yaml
+# docker-compose.staging.yml
+services:
+  app:
+    labels:
+      - "traefik.http.routers.app.rule=Host(`staging.example.com`)"
+```
+
+### Environment-Specific Traefik Instances
+- **Dev**: Single instance, self-signed certs, debug logging
+- **Staging**: Mirrors prod config, staging Let's Encrypt
+- **Prod**: HA (3+ replicas), production ACME, strict TLS, WAF
+
+## Rollback Strategies
+
+### Kubernetes
+```bash
+# Instant rollback to previous revision
+kubectl rollout undo deployment/app
+
+# Rollback to specific revision
+kubectl rollout undo deployment/app --to-revision=3
+
+# Check history
+kubectl rollout history deployment/app
+```
+
+### Docker Compose
+```bash
+# Pin to previous image tag
+docker compose up -d --no-deps app
+```
+
+### GitOps Rollback
+```bash
+# Revert the deployment commit
+git revert HEAD
+git push  # ArgoCD/Flux auto-syncs
+```
+
+### Traefik-Level Rollback (instant)
+Switch weighted services back to stable:
+```yaml
+# Change weights: canary 0, stable 100
+kubectl patch traefikservice app-canary --type merge -p '
+spec:
+  weighted:
+    services:
+    - name: app-stable
+      port: 80
+      weight: 100
+    - name: app-canary
+      port: 80
+      weight: 0'
+```
+
+## Infrastructure as Code
+
+### Terraform + Traefik on Kubernetes
+```hcl
+resource "helm_release" "traefik" {
+  name       = "traefik"
+  repository = "https://traefik.github.io/charts"
+  chart      = "traefik"
+  version    = "34.0.0"
+  namespace  = "traefik"
+
+  set {
+    name  = "deployment.replicas"
+    value = "3"
+  }
+
+  set {
+    name  = "providers.kubernetesCRD.enabled"
+    value = "true"
+  }
+
+  set {
+    name  = "ports.websecure.tls.enabled"
+    value = "true"
+  }
+}
+```
+
+### Pulumi
+```typescript
+const traefik = new k8s.helm.v3.Chart("traefik", {
+  chart: "traefik",
+  fetchOpts: { repo: "https://traefik.github.io/charts" },
+  version: "34.0.0",
+  namespace: "traefik",
+  values: {
+    deployment: { replicas: 3 },
+    providers: { kubernetesCRD: { enabled: true } },
+  },
+});
+```
+
+## Automated Smoke Tests Post-Deploy
+
+```yaml
+# GitHub Actions step
+- name: Smoke test
+  run: |
+    # Wait for rollout
+    kubectl rollout status deployment/app --timeout=300s
+
+    # Test endpoints
+    for endpoint in /health /api/v1/status /; do
+      status=$(curl -s -o /dev/null -w "%{http_code}" "https://app.example.com${endpoint}")
+      if [ "$status" != "200" ]; then
+        echo "FAIL: ${endpoint} returned ${status}"
+        kubectl rollout undo deployment/app
+        exit 1
+      fi
+    done
+    echo "All smoke tests passed"
+```
+
+## Disaster Recovery
+
+- **Config**: All in Git (GitOps). Rollback = `git revert`
+- **Certificates**: Back up `acme.json` / cert secrets regularly
+- **Multi-cluster**: DNS-based failover (Route53, Cloud DNS)
+- **Test**: Regularly validate restore procedures
+- **RTO/RPO**: Config recovery is instant (Git); cert re-issuance takes minutes (ACME rate limits apply)
+- **Runbook**: Document manual failover steps for when automation fails

package/skills/traefik/docs/core-config.md

@@ -0,0 +1,171 @@
+# Traefik Core Configuration
+
+## Static Configuration (traefik.yml)
+
+Loaded once at startup. Three ways to set: file, CLI flags, environment variables.
+
+```yaml
+# traefik.yml
+global:
+  checkNewVersion: false
+  sendAnonymousUsage: false
+
+api:
+  dashboard: true
+  insecure: false  # NEVER true in production
+
+log:
+  level: WARN
+  filePath: /var/log/traefik/traefik.log
+
+accessLog:
+  filePath: /var/log/traefik/access.log
+  bufferingSize: 100
+  format: json
+  filters:
+    statusCodes: ["400-499", "500-599"]
+
+# EntryPoints
+entryPoints:
+  web:
+    address: ":80"
+    http:
+      redirections:
+        entryPoint:
+          to: websecure
+          scheme: https
+          permanent: true
+    forwardedHeaders:
+      trustedIPs: ["127.0.0.1/32", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
+
+  websecure:
+    address: ":443"
+    http:
+      tls:
+        certResolver: letsencrypt
+      middlewares:
+        - security-headers@file
+    http3: {}  # Enable HTTP/3
+    forwardedHeaders:
+      trustedIPs: ["127.0.0.1/32", "10.0.0.0/8"]
+
+  metrics:
+    address: ":8082"
+
+# Providers
+providers:
+  docker:
+    endpoint: "unix:///var/run/docker.sock"
+    exposedByDefault: false
+    network: proxy
+    watch: true
+  file:
+    directory: /etc/traefik/dynamic
+    watch: true
+
+# Certificate Resolvers
+certificatesResolvers:
+  letsencrypt:
+    acme:
+      email: admin@example.com
+      storage: /acme.json
+      caServer: https://acme-v02.api.letsencrypt.org/directory
+      dnsChallenge:
+        provider: cloudflare
+        resolvers: ["1.1.1.1:53", "8.8.8.8:53"]
+        delayBeforeCheck: 10s
+
+# Health check endpoint
+ping:
+  entryPoint: web
+```
+
+## Dynamic Configuration
+
+Hot-reloaded. Defines routers, services, middlewares, TLS options.
+
+### Routers
+
+Match incoming requests and route to services:
+
+```yaml
+http:
+  routers:
+    my-router:
+      entryPoints: [websecure]
+      rule: "Host(`app.example.com`) && PathPrefix(`/api`)"
+      middlewares: [rate-limit, security-headers]
+      service: my-service
+      tls:
+        certResolver: letsencrypt
+      priority: 100  # Higher = matched first
+```
+
+**Rule matchers**: `Host()`, `HostRegexp()`, `Path()`, `PathPrefix()`, `PathRegexp()`, `Headers()`, `HeadersRegexp()`, `Method()`, `Query()`, `ClientIP()`.
+
+Combine with `&&` (AND), `||` (OR), `!` (NOT).
+
+### Services
+
+Define backend targets with load balancing:
+
+```yaml
+http:
+  services:
+    my-service:
+      loadBalancer:
+        servers:
+          - url: "http://10.0.0.10:8080"
+          - url: "http://10.0.0.11:8080"
+        healthCheck:
+          path: /health
+          interval: 10s
+          timeout: 3s
+        sticky:
+          cookie:
+            name: server_id
+            secure: true
+            httpOnly: true
+        passHostHeader: true
+```
+
+### Load Balancing Strategies (v3.6+)
+
+| Strategy | Description |
+|----------|-------------|
+| **WRR** (default) | Weighted Round Robin via EDF scheduling |
+| **P2C** | Power of Two Choices — picks 2 random, routes to least busy |
+| **HRW** | Highest Random Weight — consistent hashing by client IP |
+| **LeastTime** | Lowest response time + fewest connections |
+
+### Multi-Layer Routing (v3.6+)
+
+Advanced routing with prioritized evaluation for blue-green, A/B, canary:
+
+```yaml
+http:
+  routers:
+    canary:
+      rule: "Host(`app.example.com`) && Headers(`X-Canary`, `true`)"
+      service: app-canary
+      priority: 200
+    default:
+      rule: "Host(`app.example.com`)"
+      service: app-stable
+      priority: 100
+```
+
+## Providers Reference
+
+| Provider | Config Key | Use Case |
+|----------|-----------|----------|
+| Docker | `providers.docker` | Container-based routing via labels |
+| Kubernetes CRD | `providers.kubernetesCRD` | Native K8s with IngressRoute |
+| Kubernetes Ingress | `providers.kubernetesIngress` | Standard K8s Ingress resources |
+| File | `providers.file` | Static file-based routing |
+| Consul Catalog | `providers.consulCatalog` | HashiCorp Consul service discovery |
+| Consul | `providers.consul` | Consul KV store |
+| etcd | `providers.etcd` | etcd KV store |
+| Redis | `providers.redis` | Redis KV store |
+| Amazon ECS | `providers.ecs` | AWS ECS task discovery |
+| Nomad | `providers.nomad` | HashiCorp Nomad |

package/skills/traefik/docs/distributed-config.md

@@ -0,0 +1,96 @@
+# Distributed Configuration (Redis, Consul, etcd)
+
+## Redis Provider
+
+```yaml
+# traefik.yml
+providers:
+  redis:
+    endpoints: ["redis:6379"]
+    rootKey: "traefik"
+    password: "secretpassword"
+    tls:
+      ca: /certs/ca.pem
+      cert: /certs/cert.pem
+      key: /certs/key.pem
+```
+
+Store config:
+```bash
+redis-cli SET "traefik/http/routers/my-router/rule" "Host(\`app.example.com\`)"
+redis-cli SET "traefik/http/routers/my-router/service" "my-service"
+redis-cli SET "traefik/http/routers/my-router/entryPoints/0" "websecure"
+redis-cli SET "traefik/http/services/my-service/loadBalancer/servers/0/url" "http://10.0.0.10:8080"
+redis-cli SET "traefik/http/services/my-service/loadBalancer/servers/1/url" "http://10.0.0.11:8080"
+redis-cli SET "traefik/http/middlewares/my-headers/headers/browserXssFilter" "true"
+```
+
+## Consul Provider
+
+```yaml
+providers:
+  consul:
+    endpoints: ["consul:8500"]
+    rootKey: "traefik"
+    token: "consul-acl-token"
+    tls:
+      ca: /certs/ca.pem
+```
+
+## etcd Provider
+
+```yaml
+providers:
+  etcd:
+    endpoints: ["etcd1:2379", "etcd2:2379", "etcd3:2379"]
+    rootKey: "traefik"
+    username: "traefik"
+    password: "secretpassword"
+    tls:
+      ca: /certs/ca.pem
+      cert: /certs/cert.pem
+      key: /certs/key.pem
+```
+
+Store config:
+```bash
+etcdctl put "traefik/http/routers/my-router/rule" "Host(\`app.example.com\`)"
+etcdctl put "traefik/http/routers/my-router/service" "my-service"
+etcdctl put "traefik/http/services/my-service/loadBalancer/servers/0/url" "http://10.0.0.10:8080"
+```
+
+## Key Path Structure
+
+All KV providers use the same path structure under `rootKey`:
+
+```
+traefik/
+  http/
+    routers/<name>/
+      rule                    → "Host(`...`)"
+      service                 → "service-name"
+      entryPoints/0           → "websecure"
+      middlewares/0           → "middleware-name"
+      tls/certResolver        → "letsencrypt"
+    services/<name>/
+      loadBalancer/servers/0/url → "http://..."
+      loadBalancer/healthCheck/path → "/health"
+    middlewares/<name>/
+      headers/browserXssFilter → "true"
+      rateLimit/average        → "100"
+  tcp/
+    routers/...
+    services/...
+  tls/
+    options/...
+    certificates/...
+```
+
+All KV providers support dynamic watching — Traefik auto-detects changes without restart.
+
+## Use Cases
+
+- **Multi-instance sync**: All Traefik instances read from same KV store
+- **Dynamic backend registration**: Services register themselves in KV store
+- **API-driven config**: Update routing via KV store API
+- **Service discovery**: Combine with Consul Catalog for automatic service registration