opencode-skills-collection 4.0.67 → 4.0.69

package/bundled-skills/gpu-server-management/SKILL.md

@@ -0,0 +1,236 @@
+---
+name: gpu-server-management
+description: Set up and manage NVIDIA GPU servers for AI workloads
+category: devops
+risk: critical
+source: https://github.com/BagelHole/DevOps-Security-Agent-Skills
+source_repo: BagelHole/DevOps-Security-Agent-Skills
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/blob/main/LICENSE
+compatibility: Requires the relevant OS/platform tooling and privileged access where
+  noted. Docs-only; helper scripts and templates not bundled.
+metadata:
+  author: devops-skills
+  version: '1.0'
+---
+
+# GPU Server Management
+
+Provision, configure, and monitor NVIDIA GPU servers for AI inference and training workloads.
+
+## When to Use This Skill
+
+Use this skill when:
+- Setting up a new GPU server for LLM inference or model training
+- Installing or upgrading NVIDIA drivers and CUDA toolkit
+- Configuring Docker with NVIDIA Container Toolkit for GPU workloads
+- Partitioning A100/H100 GPUs with MIG for multi-tenant workloads
+- Troubleshooting GPU errors, driver issues, or thermal throttling
+
+## Prerequisites
+
+- Ubuntu 22.04 LTS (recommended) or RHEL 8/9
+- NVIDIA GPU (A10G, A100, H100, RTX 4090, or L40S recommended)
+- Root or sudo access
+- Internet access for package downloads
+
+## Driver Installation (Ubuntu)
+
+```bash
+# Remove old drivers
+sudo apt purge -y 'nvidia*' 'cuda*' 'libcuda*'
+sudo apt autoremove -y
+
+# Add NVIDIA package repository
+distribution=$(. /etc/os-release; echo $ID$VERSION_ID)
+curl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey | \
+  sudo gpg --dearmor -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg
+
+curl -s -L https://nvidia.github.io/libnvidia-container/$distribution/libnvidia-container.list | \
+  sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' | \
+  sudo tee /etc/apt/sources.list.d/nvidia-container-toolkit.list
+
+sudo apt update
+
+# Install latest driver (560.x as of 2025)
+sudo apt install -y nvidia-driver-560 cuda-toolkit-12-6
+
+# Install NVIDIA Container Toolkit (Docker GPU support)
+sudo apt install -y nvidia-container-toolkit
+sudo nvidia-ctk runtime configure --runtime=docker
+sudo systemctl restart docker
+
+# Verify
+nvidia-smi
+nvcc --version
+docker run --rm --gpus all nvidia/cuda:12.6.0-base-ubuntu22.04 nvidia-smi
+```
+
+## Post-Install Configuration
+
+```bash
+# Enable persistence mode (reduces driver initialization latency)
+sudo nvidia-smi -pm 1
+
+# Set power limit (reduce heat/noise on inference servers)
+sudo nvidia-smi -pl 350          # watts; check TDP for your GPU model
+
+# Disable ECC on inference servers (frees ~6% VRAM, less safe)
+sudo nvidia-smi --ecc-config=0   # requires reboot
+
+# Enable P2P for multi-GPU NVLink training
+sudo nvidia-smi topo -m          # check NVLink topology
+```
+
+## GPU Health Monitoring
+
+```bash
+# Real-time monitoring (like htop for GPUs)
+watch -n 1 nvidia-smi
+
+# Detailed stats
+nvidia-smi --query-gpu=index,name,temperature.gpu,utilization.gpu,\
+utilization.memory,memory.used,memory.free,power.draw,clocks.current.graphics \
+--format=csv --loop=1
+
+# DCGM — production monitoring daemon (for clusters)
+sudo apt install -y datacenter-gpu-manager
+sudo systemctl start dcgm
+dcgmi discovery -l                # list GPUs
+dcgmi diag -r 1                  # quick health check
+dcgmi diag -r 3                  # full diagnostic (takes ~20 min)
+
+# Check GPU errors (XID errors — important for stability)
+sudo dmesg | grep -i "NVRM\|nvidia\|XID"
+nvidia-smi --query-gpu=ecc.errors.corrected.volatile.total \
+  --format=csv,noheader
+```
+
+## Prometheus GPU Metrics (DCGM Exporter)
+
+```bash
+# Deploy DCGM Exporter for Prometheus scraping
+docker run -d \
+  --name dcgm-exporter \
+  --gpus all \
+  --cap-add SYS_ADMIN \
+  -p 9400:9400 \
+  --restart unless-stopped \
+  nvcr.io/nvidia/k8s/dcgm-exporter:latest
+
+# Key metrics exposed:
+# DCGM_FI_DEV_GPU_UTIL          - GPU utilization %
+# DCGM_FI_DEV_MEM_COPY_UTIL     - Memory bandwidth utilization
+# DCGM_FI_DEV_FB_USED           - Framebuffer memory used (MB)
+# DCGM_FI_DEV_SM_CLOCK          - SM clock speed (MHz)
+# DCGM_FI_DEV_GPU_TEMP          - Temperature (°C)
+# DCGM_FI_DEV_POWER_USAGE       - Power draw (W)
+# DCGM_FI_DEV_XID_ERRORS        - XID error count (0 = healthy)
+```
+
+## MIG Partitioning (A100/H100)
+
+MIG (Multi-Instance GPU) allows slicing one GPU into isolated smaller GPUs.
+
+```bash
+# Enable MIG mode (requires reboot or restart of all processes)
+sudo nvidia-smi -mig 1
+sudo systemctl restart nvidia-persistenced
+
+# List available MIG profiles (A100 80GB example)
+nvidia-smi mig -lgip
+# 1g.10gb   — 1 slice,  10GB (max 7 instances)
+# 2g.20gb   — 2 slices, 20GB (max 3 instances)
+# 3g.40gb   — 3 slices, 40GB (max 2 instances)
+# 7g.80gb   — full GPU, 80GB (max 1 instance)
+
+# Create MIG instances (e.g., 3× 2g.20gb + 1× 2g.20gb = multi-tenant)
+sudo nvidia-smi mig -cgi 2g.20gb,2g.20gb,2g.20gb,2g.20gb -C
+
+# List created instances
+nvidia-smi mig -lgi
+nvidia-smi mig -lcgi
+
+# Use in Docker
+docker run --gpus '"device=MIG-GPU-xxx/0/0"' ...
+
+# Disable MIG
+sudo nvidia-smi mig -i 0 -dci
+sudo nvidia-smi mig -i 0 -dgi
+sudo nvidia-smi -mig 0
+```
+
+## Kernel & OS Tuning for GPU Servers
+
+```bash
+# Increase file descriptor limits
+echo '* soft nofile 1048576' | sudo tee -a /etc/security/limits.conf
+echo '* hard nofile 1048576' | sudo tee -a /etc/security/limits.conf
+
+# Disable transparent huge pages (reduces latency jitter)
+echo never | sudo tee /sys/kernel/mm/transparent_hugepage/enabled
+echo never | sudo tee /sys/kernel/mm/transparent_hugepage/defrag
+
+# Persist via rc.local or systemd unit:
+cat <<'EOF' | sudo tee /etc/rc.local
+#!/bin/bash
+echo never > /sys/kernel/mm/transparent_hugepage/enabled
+echo never > /sys/kernel/mm/transparent_hugepage/defrag
+nvidia-smi -pm 1
+exit 0
+EOF
+sudo chmod +x /etc/rc.local
+
+# PCIe performance mode
+sudo nvidia-smi --auto-boost-default=0
+sudo nvidia-smi --auto-boost-permission=0
+```
+
+## Multi-GPU Topology Check
+
+```bash
+# Check NVLink and PCIe topology
+nvidia-smi topo -m
+# Output shows interconnect type:
+# NV4 = NVLink 4.0 (H100 SXM)
+# NV2 = NVLink 2.0 (A100 SXM)
+# PHB = PCIe bus (slower; avoid for tensor parallel training)
+# PIX = same PCIe switch (fast)
+
+# Bandwidth test between GPUs
+/usr/local/cuda/samples/bin/x86_64/linux/release/p2pBandwidthLatencyTest
+```
+
+## Common Issues
+
+| Issue | Cause | Fix |
+|-------|-------|-----|
+| `nvidia-smi: command not found` | Driver not installed | Follow driver installation steps above |
+| Driver version mismatch | CUDA/driver incompatibility | Check compatibility matrix at developer.nvidia.com |
+| GPU temperature >85°C | Poor airflow or fan failure | Check `nvidia-smi -q -d TEMPERATURE`; reseat cooler |
+| XID 79 errors | GPU hardware error | Run `dcgmi diag -r 3`; may need GPU replacement |
+| `failed to open device` in container | Container toolkit not configured | Run `nvidia-ctk runtime configure --runtime=docker` |
+| Low PCIe bandwidth | Wrong slot or power limit | Check `nvidia-smi -q | grep PCIe`; use x16 slot |
+
+## Best Practices
+
+- Always enable persistence mode (`nvidia-smi -pm 1`) — reduces first-request latency.
+- Monitor XID errors; persistent XID 79/94 indicates hardware failure.
+- For training: use NVLink-connected GPUs; for inference: PCIe is usually fine.
+- Set up DCGM alerts on temperature >80°C and power draw near TDP.
+- Use MIG for multi-tenant inference to provide GPU isolation between models.
+
+## Related Skills
+
+- vllm-server (`vllm-server`) - LLM inference on GPUs
+- llm-fine-tuning (`llm-fine-tuning`) - GPU training setup
+- linux-hardening (`linux-hardening`) - Secure the host OS
+- prometheus-grafana (`prometheus-grafana`) - Metrics dashboards
+
+## Limitations
+
+- Infrastructure commands can disrupt services: confirm target host/scope and have backups/snapshots before mutating state.
+- Docs-only import: upstream scripts and templates not bundled.
+

package/bundled-skills/hashicorp-vault/SKILL.md

@@ -0,0 +1,408 @@
+---
+name: hashicorp-vault
+description: Manage secrets and PKI with HashiCorp Vault.
+category: security
+risk: critical
+source: https://github.com/BagelHole/DevOps-Security-Agent-Skills
+source_repo: BagelHole/DevOps-Security-Agent-Skills
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/blob/main/LICENSE
+compatibility: Requires the relevant security tooling (scanners, vault CLIs) and an
+  authorized scope for any active assessment. Docs-only; helper scripts and templates
+  not bundled.
+metadata:
+  author: devops-skills
+  version: '1.0'
+---
+
+# HashiCorp Vault
+
+Centrally manage secrets, encryption, and access with HashiCorp Vault.
+
+## When to Use This Skill
+
+Use this skill when:
+- Centralizing secrets management
+- Implementing dynamic credentials
+- Managing PKI and certificates
+- Encrypting sensitive data
+- Meeting compliance requirements
+
+## Prerequisites
+
+- Vault server (dev or production)
+- Vault CLI installed
+- Network access to Vault
+
+## Quick Start
+
+### Development Server
+
+```bash
+# Start dev server
+vault server -dev
+
+# Set environment
+export VAULT_ADDR='http://127.0.0.1:8200'
+export VAULT_TOKEN='root'
+
+# Verify connection
+vault status
+```
+
+### Production Deployment
+
+```hcl
+# config.hcl
+storage "raft" {
+  path = "/opt/vault/data"
+  node_id = "vault-1"
+}
+
+listener "tcp" {
+  address = "0.0.0.0:8200"
+  tls_cert_file = "/opt/vault/tls/vault.crt"
+  tls_key_file = "/opt/vault/tls/vault.key"
+}
+
+api_addr = "https://vault.example.com:8200"
+cluster_addr = "https://vault.example.com:8201"
+
+ui = true
+```
+
+```bash
+# Initialize Vault
+vault operator init -key-shares=5 -key-threshold=3
+
+# Unseal (run 3 times with different keys)
+vault operator unseal <key-1>
+vault operator unseal <key-2>
+vault operator unseal <key-3>
+
+# Login
+vault login <root-token>
+```
+
+## Secret Engines
+
+### KV Secrets
+
+```bash
+# Enable KV v2
+vault secrets enable -path=secret kv-v2
+
+# Write secret
+vault kv put secret/myapp/config \
+  username="admin" \
+  password="..." # example value; use a vault-generated secret
+
+# Read secret
+vault kv get secret/myapp/config
+vault kv get -field=password secret/myapp/config
+
+# Update secret
+vault kv put secret/myapp/config \
+  username="admin" \
+  password="..." # rotated value from your vault
+
+# List secrets
+vault kv list secret/
+
+# Delete secret
+vault kv delete secret/myapp/config
+
+# Version history
+vault kv metadata get secret/myapp/config
+```
+
+### Database Secrets
+
+```bash
+# Enable database engine
+vault secrets enable database
+
+# Configure PostgreSQL connection
+vault write database/config/postgresql \
+  plugin_name=postgresql-database-plugin \
+  connection_url="postgresql://{{username}}:{{password}}@localhost:5432/mydb" \
+  allowed_roles="readonly,readwrite" \
+  username="vault" \
+  password="..." # service credential from your vault
+
+# Create role
+vault write database/roles/readonly \
+  db_name=postgresql \
+  creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; \
+    GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
+  default_ttl="1h" \
+  max_ttl="24h"
+
+# Get credentials
+vault read database/creds/readonly
+```
+
+### AWS Secrets
+
+```bash
+# Enable AWS engine
+vault secrets enable aws
+
+# Configure root credentials
+vault write aws/config/root \
+  access_key=AKIA... \
+  secret_key=secret... \
+  region=us-east-1
+
+# Create role
+vault write aws/roles/deploy \
+  credential_type=iam_user \
+  policy_document=-<<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": ["s3:*"],
+      "Resource": ["arn:aws:s3:::my-bucket/*"]
+    }
+  ]
+}
+EOF
+
+# Get credentials
+vault read aws/creds/deploy
+```
+
+### PKI Secrets
+
+```bash
+# Enable PKI engine
+vault secrets enable pki
+vault secrets tune -max-lease-ttl=87600h pki
+
+# Generate root CA
+vault write -field=certificate pki/root/generate/internal \
+  common_name="example.com" \
+  ttl=87600h > ca_cert.crt
+
+# Configure URLs
+vault write pki/config/urls \
+  issuing_certificates="https://vault.example.com:8200/v1/pki/ca" \
+  crl_distribution_points="https://vault.example.com:8200/v1/pki/crl"
+
+# Create role
+vault write pki/roles/web-server \
+  allowed_domains="example.com" \
+  allow_subdomains=true \
+  max_ttl="720h"
+
+# Issue certificate
+vault write pki/issue/web-server \
+  common_name="web.example.com" \
+  ttl="24h"
+```
+
+## Authentication Methods
+
+### AppRole
+
+```bash
+# Enable AppRole
+vault auth enable approle
+
+# Create role
+vault write auth/approle/role/myapp \
+  token_policies="myapp-policy" \
+  token_ttl=1h \
+  token_max_ttl=4h \
+  secret_id_ttl=10m
+
+# Get role ID
+vault read auth/approle/role/myapp/role-id
+
+# Generate secret ID
+vault write -f auth/approle/role/myapp/secret-id
+
+# Login
+vault write auth/approle/login \
+  role_id=<role-id> \
+  secret_id=<secret-id>
+```
+
+### Kubernetes
+
+```bash
+# Enable Kubernetes auth
+vault auth enable kubernetes
+
+# Configure
+vault write auth/kubernetes/config \
+  kubernetes_host="https://kubernetes.default.svc" \
+  kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
+
+# Create role
+vault write auth/kubernetes/role/myapp \
+  bound_service_account_names=myapp \
+  bound_service_account_namespaces=default \
+  policies=myapp-policy \
+  ttl=1h
+```
+
+### OIDC
+
+```bash
+# Enable OIDC auth
+vault auth enable oidc
+
+# Configure
+vault write auth/oidc/config \
+  oidc_discovery_url="https://accounts.google.com" \
+  oidc_client_id="your-client-id" \
+  oidc_client_secret=<your-vault-oidc-client-secret> \
+  default_role="default"
+
+# Create role
+vault write auth/oidc/role/default \
+  bound_audiences="your-client-id" \
+  allowed_redirect_uris="http://localhost:8250/oidc/callback" \
+  user_claim="sub" \
+  policies="default"
+```
+
+## Policies
+
+### Policy Definition
+
+```hcl
+# myapp-policy.hcl
+# Read secrets
+path "secret/data/myapp/*" {
+  capabilities = ["read", "list"]
+}
+
+# Database credentials
+path "database/creds/myapp-db" {
+  capabilities = ["read"]
+}
+
+# PKI certificates
+path "pki/issue/web-server" {
+  capabilities = ["create", "update"]
+}
+
+# Deny access to other secrets
+path "secret/data/other/*" {
+  capabilities = ["deny"]
+}
+```
+
+```bash
+# Create policy
+vault policy write myapp myapp-policy.hcl
+
+# List policies
+vault policy list
+
+# Read policy
+vault policy read myapp
+```
+
+## Application Integration
+
+### Python
+
+```python
+import hvac
+
+# Initialize client
+client = hvac.Client(url='http://localhost:8200')
+
+# AppRole authentication
+client.auth.approle.login(
+    role_id='role-id',
+    secret_id='secret-id'
+)
+
+# Read secret
+secret = client.secrets.kv.v2.read_secret_version(
+    path='myapp/config',
+    mount_point='secret'
+)
+password = secret['data']['data']['password']
+
+# Get database credentials
+db_creds = client.secrets.database.generate_credentials(
+    name='myapp-db'
+)
+```
+
+### Kubernetes Sidecar
+
+```yaml
+apiVersion: v1
+kind: Pod
+metadata:
+  name: myapp
+  annotations:
+    vault.hashicorp.com/agent-inject: "true"
+    vault.hashicorp.com/role: "myapp"
+    vault.hashicorp.com/agent-inject-secret-config: "secret/data/myapp/config"
+    vault.hashicorp.com/agent-inject-template-config: |
+      {{- with secret "secret/data/myapp/config" -}}
+      export DB_PASSWORD  # populated from the referenced Vault/K8s Secret at deploy time
+      {{- end }}
+spec:
+  serviceAccountName: myapp
+  containers:
+    - name: myapp
+      image: myapp:latest
+      command: ["/bin/sh", "-c", "source /vault/secrets/config && ./start.sh"]
+```
+
+## Common Issues
+
+### Issue: Sealed Vault
+**Problem**: Vault is sealed after restart
+**Solution**: Implement auto-unseal with cloud KMS or HSM
+
+### Issue: Token Expired
+**Problem**: Application token has expired
+**Solution**: Implement token renewal, use shorter-lived tokens
+
+### Issue: Permission Denied
+**Problem**: Cannot access secrets
+**Solution**: Review policies, check token capabilities
+
+## Best Practices
+
+- Use short-lived tokens
+- Implement auto-unseal
+- Enable audit logging
+- Use namespaces for isolation
+- Rotate root tokens regularly
+- Implement least-privilege policies
+- Use dynamic secrets where possible
+- Regular backup and DR testing
+
+## Related Skills
+
+- aws-secrets-manager (`aws-secrets-manager`) - AWS native secrets
+- sops-encryption (`sops-encryption`) - File encryption
+- kubernetes-hardening (`kubernetes-hardening`) - K8s security
+
+## Limitations
+
+- Apply guidance only within authorized scope; test destructive steps in non-production first.
+- Docs-only import: upstream scripts and templates not bundled.
+
+### Example
+
+```bash
+# Read-only first: inventory before any active step.
+which <tool> && <tool> --help | head -n 20
+```
+
+> Adapted from [BagelHole/DevOps-Security-Agent-Skills](https://github.com/BagelHole/DevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.