opencode-skills-collection 4.0.68 → 4.0.70

package/bundled-skills/vercel-deployments/SKILL.md

@@ -0,0 +1,296 @@
+---
+name: vercel-deployments
+description: Deploy frontend and full-stack apps on Vercel with previews, edge functions,
+  environment promotion, and production guardrails.
+category: devops
+risk: critical
+source: https://github.com/BagelHole/DevOps-Security-Agent-Skills
+source_repo: BagelHole/DevOps-Security-Agent-Skills
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/blob/main/LICENSE
+compatibility: Requires the relevant OS/platform tooling and privileged access where
+  noted. Docs-only; helper scripts and templates not bundled.
+metadata:
+  author: devops-skills
+  version: '1.0'
+---
+
+# Vercel Deployments
+
+Ship web apps quickly with preview environments and managed edge infrastructure.
+
+## When to Use This Skill
+
+Use this skill when:
+- Deploying Next.js, SvelteKit, Nuxt, or static sites
+- Setting up preview environments for every PR
+- Configuring edge functions and serverless APIs
+- Managing environment variables across preview/production
+- Setting up custom domains and redirects
+
+## Prerequisites
+
+- Node.js 18+
+- Vercel account (free tier works for personal projects)
+- Git repository (GitHub, GitLab, or Bitbucket)
+
+## Quick Start
+
+```bash
+# Install CLI
+npm i -g vercel
+
+# Login and link project
+vercel login
+vercel link
+
+# Deploy to preview
+vercel
+
+# Deploy to production
+vercel --prod
+
+# Pull environment variables locally
+vercel env pull .env.local
+```
+
+## Project Configuration
+
+```json
+// vercel.json
+{
+  "framework": "nextjs",
+  "buildCommand": "npm run build",
+  "outputDirectory": ".next",
+  "installCommand": "npm ci",
+  "regions": ["iad1", "sfo1", "cdg1"],
+  "headers": [
+    {
+      "source": "/api/(.*)",
+      "headers": [
+        { "key": "Cache-Control", "value": "no-store" },
+        { "key": "X-Content-Type-Options", "value": "nosniff" }
+      ]
+    },
+    {
+      "source": "/(.*)",
+      "headers": [
+        { "key": "X-Frame-Options", "value": "DENY" },
+        { "key": "Strict-Transport-Security", "value": "max-age=63072000; includeSubDomains" }
+      ]
+    }
+  ],
+  "redirects": [
+    { "source": "/blog/:slug", "destination": "/posts/:slug", "permanent": true }
+  ],
+  "rewrites": [
+    { "source": "/api/v1/:path*", "destination": "https://api.example.com/:path*" }
+  ]
+}
+```
+
+## Environment Variables
+
+```bash
+# Add environment variables
+vercel env add DATABASE_URL production
+vercel env add DATABASE_URL preview
+vercel env add NEXT_PUBLIC_API_URL production
+
+# List all env vars
+vercel env ls
+
+# Pull to local .env.local
+vercel env pull .env.local
+
+# Remove an env var
+vercel env rm SECRET_KEY production
+```
+
+### Environment Separation Pattern
+
+```bash
+# Production — real credentials
+vercel env add DATABASE_URL production <<< "postgresql://prod-host:5432/app"
+vercel env add STRIPE_SECRET_KEY production
+
+# Preview — staging/test credentials
+vercel env add DATABASE_URL preview <<< "postgresql://staging-host:5432/app"
+vercel env add STRIPE_SECRET_KEY preview   # Use test mode key
+
+# Development — local values
+vercel env add DATABASE_URL development <<< "postgresql://localhost:5432/app"
+```
+
+## Edge Functions
+
+```typescript
+// app/api/geo/route.ts — Edge API route (Next.js App Router)
+import { NextRequest } from 'next/server';
+
+export const runtime = 'edge';
+
+export function GET(request: NextRequest) {
+  const country = request.geo?.country || 'US';
+  const city = request.geo?.city || 'Unknown';
+
+  return Response.json({
+    country,
+    city,
+    region: request.geo?.region,
+    timestamp: new Date().toISOString(),
+  });
+}
+```
+
+```typescript
+// middleware.ts — Edge middleware for auth/redirects
+import { NextResponse } from 'next/server';
+import type { NextRequest } from 'next/server';
+
+export function middleware(request: NextRequest) {
+  // Block non-US traffic from admin
+  if (request.nextUrl.pathname.startsWith('/admin')) {
+    if (request.geo?.country !== 'US') {
+      return NextResponse.redirect(new URL('/blocked', request.url));
+    }
+  }
+
+  // Add security headers
+  const response = NextResponse.next();
+  response.headers.set('X-Request-Id', crypto.randomUUID());
+  return response;
+}
+
+export const config = {
+  matcher: ['/admin/:path*', '/api/:path*'],
+};
+```
+
+## GitHub Actions Integration
+
+```yaml
+# .github/workflows/preview.yml
+name: Vercel Preview
+on: pull_request
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - run: npm ci
+      - run: npm run lint
+      - run: npm run test
+
+      - name: Deploy to Vercel Preview
+        id: deploy
+        run: |
+          npm i -g vercel
+          URL=$(vercel --token ${{ secrets.VERCEL_TOKEN }} --yes)
+          echo "url=$URL" >> "$GITHUB_OUTPUT"
+
+      - name: Comment PR with preview URL
+        uses: actions/github-script@v7
+        with:
+          script: |
+            github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: `Preview deployed: ${{ steps.deploy.outputs.url }}`
+            });
+```
+
+## CLI Commands Reference
+
+```bash
+# Deployments
+vercel                          # Deploy to preview
+vercel --prod                   # Deploy to production
+vercel rollback                 # Rollback last production deploy
+vercel promote <url>            # Promote preview to production
+
+# Domains
+vercel domains add example.com
+vercel domains ls
+vercel certs ls
+
+# Logs
+vercel logs <deployment-url>
+vercel logs <deployment-url> --follow
+
+# Project management
+vercel project ls
+vercel project rm <name>
+
+# Inspect deployment
+vercel inspect <deployment-url>
+```
+
+## Production Guardrails
+
+- Require preview checks before merge (GitHub branch protection)
+- Separate preview and production environment variables — never share API keys
+- Use branch protection with required deployment status checks
+- Monitor function duration and cold start behavior in Vercel Analytics
+- Set spend limits in Vercel dashboard to prevent cost surprises
+- Enable Vercel Firewall for DDoS and bot protection
+- Use `vercel.json` headers for security (CSP, HSTS, X-Frame-Options)
+
+## Monitoring & Analytics
+
+```bash
+# Enable Speed Insights in Next.js
+npm install @vercel/speed-insights
+
+# Enable Web Analytics
+npm install @vercel/analytics
+```
+
+```typescript
+// app/layout.tsx
+import { Analytics } from '@vercel/analytics/react';
+import { SpeedInsights } from '@vercel/speed-insights/next';
+
+export default function RootLayout({ children }) {
+  return (
+    <html>
+      <body>
+        {children}
+        <Analytics />
+        <SpeedInsights />
+      </body>
+    </html>
+  );
+}
+```
+
+## Troubleshooting
+
+| Issue | Solution |
+|-------|---------|
+| Build fails | Check `vercel logs`, verify Node.js version in `engines` field |
+| Env vars missing | Run `vercel env pull`, check variable scope (preview vs production) |
+| Edge function timeout | Edge has 30s limit; move heavy work to serverless (no `runtime = 'edge'`) |
+| Cold starts slow | Use edge runtime where possible, reduce bundle size |
+| Domain not working | Check DNS propagation, verify `vercel domains` configuration |
+
+## Related Skills
+
+- github-actions (`github-actions`) — Automated deployment gates
+- cloudflare-pages (`cloudflare-pages`) — Alternative edge hosting
+- ssl-tls-management (`ssl-tls-management`) — Custom certificate setup
+
+## Limitations
+
+- Infrastructure commands can disrupt services: confirm target host/scope and have backups/snapshots before mutating state.
+- Docs-only import: upstream scripts and templates not bundled.
+

package/bundled-skills/vllm-server/SKILL.md

@@ -0,0 +1,236 @@
+---
+name: vllm-server
+description: Deploy and manage vLLM for high-throughput LLM inference. Configure continuous
+  batching, tensor parallelism, quantization, and OpenAI-compatible API endpoints
+  for production LLM serving.
+category: devops
+risk: critical
+source: https://github.com/BagelHole/DevOps-Security-Agent-Skills
+source_repo: BagelHole/DevOps-Security-Agent-Skills
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/blob/main/LICENSE
+compatibility: Requires the relevant OS/platform tooling and privileged access where
+  noted. Docs-only; helper scripts and templates not bundled.
+metadata:
+  author: devops-skills
+  version: '1.0'
+---
+
+# vLLM Server Management
+
+Deploy production-grade LLM inference servers with vLLM — the fastest open-source LLM serving engine with PagedAttention and continuous batching.
+
+## When to Use This Skill
+
+Use this skill when:
+- Serving open-source LLMs (Llama, Mistral, Qwen, Gemma) at scale
+- Building an OpenAI-compatible API endpoint for self-hosted models
+- Optimizing LLM throughput and latency for production traffic
+- Running multi-GPU inference with tensor or pipeline parallelism
+- Deploying quantized models to reduce GPU memory requirements
+
+## Prerequisites
+
+- NVIDIA GPU(s) with CUDA 12.1+ (A100/H100 recommended for production)
+- Docker or Python 3.9+ with pip
+- 40GB+ VRAM for 70B models; 8GB+ for 7B models
+- `nvidia-container-toolkit` for Docker GPU passthrough
+
+## Quick Start
+
+```bash
+# Install vLLM
+pip install vllm
+
+# Serve a model (OpenAI-compatible API)
+vllm serve meta-llama/Llama-3.1-8B-Instruct \
+  --host 0.0.0.0 \
+  --port 8000 \
+  --api-key your-secret-key
+
+# Test the endpoint
+curl http://localhost:8000/v1/chat/completions \
+  -H "Content-Type: application/json" \
+  -H "Authorization: Bearer your-secret-key" \
+  -d '{
+    "model": "meta-llama/Llama-3.1-8B-Instruct",
+    "messages": [{"role": "user", "content": "Hello!"}]
+  }'
+```
+
+## Docker Deployment
+
+```bash
+docker run --runtime nvidia --gpus all \
+  -v ~/.cache/huggingface:/root/.cache/huggingface \
+  -p 8000:8000 \
+  --ipc=host \
+  vllm/vllm-openai:latest \
+  --model meta-llama/Llama-3.1-8B-Instruct \
+  --api-key your-secret-key
+```
+
+## Docker Compose (Production)
+
+```yaml
+services:
+  vllm:
+    image: vllm/vllm-openai:latest
+    runtime: nvidia
+    environment:
+      - NVIDIA_VISIBLE_DEVICES=all
+      - HUGGING_FACE_HUB_TOKEN=${HF_TOKEN}
+    volumes:
+      - model-cache:/root/.cache/huggingface
+    ports:
+      - "8000:8000"
+    ipc: host
+    command: >
+      --model meta-llama/Llama-3.1-70B-Instruct
+      --tensor-parallel-size 2
+      --max-model-len 32768
+      --gpu-memory-utilization 0.90
+      --api-key ${VLLM_API_KEY}
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8000/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+
+volumes:
+  model-cache:
+```
+
+## Key Configuration Options
+
+### Multi-GPU Tensor Parallelism
+
+```bash
+# Split one model across 4 GPUs
+vllm serve meta-llama/Llama-3.1-70B-Instruct \
+  --tensor-parallel-size 4 \
+  --gpu-memory-utilization 0.90
+```
+
+### Quantization (Lower VRAM)
+
+```bash
+# AWQ quantization (70B on 2x A100 40GB)
+vllm serve casperhansen/llama-3-70b-instruct-awq \
+  --quantization awq \
+  --tensor-parallel-size 2
+
+# GPTQ quantization
+vllm serve TheBloke/Llama-2-70B-Chat-GPTQ \
+  --quantization gptq
+
+# FP8 (H100 NVL native)
+vllm serve meta-llama/Llama-3.1-405B-Instruct \
+  --quantization fp8 \
+  --tensor-parallel-size 8
+```
+
+### Structured Output & Tools
+
+```bash
+vllm serve meta-llama/Llama-3.1-8B-Instruct \
+  --enable-auto-tool-choice \
+  --tool-call-parser llama3_json \
+  --guided-decoding-backend outlines
+```
+
+### LoRA Adapters
+
+```bash
+vllm serve meta-llama/Llama-3.1-8B-Instruct \
+  --enable-lora \
+  --lora-modules sql-lora=/path/to/sql-lora \
+                 code-lora=/path/to/code-lora \
+  --max-lora-rank 64
+```
+
+## Performance Tuning
+
+```bash
+# Maximize throughput for batch workloads
+vllm serve <model> \
+  --max-num-seqs 256 \          # max concurrent sequences
+  --max-num-batched-tokens 8192 \ # tokens per batch
+  --gpu-memory-utilization 0.95 \ # use 95% VRAM
+  --swap-space 4                  # CPU swap (GiB)
+
+# Minimize latency for interactive use
+vllm serve <model> \
+  --max-num-seqs 32 \
+  --enforce-eager              # disable CUDA graph capture
+```
+
+## Benchmarking
+
+```bash
+# Install benchmark tool
+pip install vllm
+
+# Run throughput benchmark
+python -m vllm.entrypoints.openai.run_batch \
+  --model meta-llama/Llama-3.1-8B-Instruct \
+  --input-file prompts.jsonl \
+  --output-file results.jsonl
+
+# Benchmark with vllm bench
+vllm bench throughput \
+  --model meta-llama/Llama-3.1-8B-Instruct \
+  --num-prompts 1000 \
+  --input-len 512 \
+  --output-len 128
+```
+
+## Monitoring
+
+```bash
+# Check running server stats
+curl http://localhost:8000/metrics  # Prometheus metrics
+
+# Key metrics to watch:
+# vllm:num_requests_running       - active requests
+# vllm:gpu_cache_usage_perc       - KV cache utilization
+# vllm:generation_tokens_per_s    - throughput
+# vllm:time_to_first_token_ms     - TTFT latency
+# vllm:e2e_request_latency_seconds - end-to-end latency
+```
+
+## Common Issues
+
+| Issue | Cause | Fix |
+|-------|-------|-----|
+| `CUDA out of memory` | Model too large for VRAM | Add `--quantization awq` or reduce `--gpu-memory-utilization` |
+| Slow cold start | Model not cached | Pre-pull with `huggingface-cli download <model>` |
+| Low throughput | Too few concurrent requests | Increase `--max-num-seqs` |
+| KV cache full errors | Context length too long | Set `--max-model-len` lower |
+| `tokenizer error` | Tokenizer mismatch | Use `--tokenizer` to specify correct tokenizer |
+
+## Best Practices
+
+- Use `--gpu-memory-utilization 0.90` to leave headroom for CUDA kernels.
+- Pin model versions with `--revision` for reproducible deployments.
+- Set `HF_HUB_OFFLINE=1` in production to prevent unexpected downloads.
+- Use AWQ or GPTQ quantization before tensor parallelism — lower VRAM first.
+- Enable `--enable-chunked-prefill` for long-context workloads.
+- Monitor `gpu_cache_usage_perc` — above 95% causes queuing.
+
+## Related Skills
+
+- llm-inference-scaling (`llm-inference-scaling`) - Auto-scaling vLLM deployments
+- gpu-server-management (`gpu-server-management`) - GPU driver setup
+- llm-gateway (`llm-gateway`) - Load balancing across vLLM instances
+- llm-cost-optimization (`llm-cost-optimization`) - Cost management
+- model-serving-kubernetes (`model-serving-kubernetes`) - K8s deployment
+
+## Limitations
+
+- Infrastructure commands can disrupt services: confirm target host/scope and have backups/snapshots before mutating state.
+- Docs-only import: upstream scripts and templates not bundled.
+