opencode-skills-collection 4.0.68 → 4.0.70

package/bundled-skills/gcp-cloud-functions/SKILL.md

@@ -0,0 +1,284 @@
+---
+name: gcp-cloud-functions
+description: Deploy serverless functions on Google Cloud Functions. Configure triggers
+  and manage deployments. Use when implementing serverless workloads on GCP.
+category: devops
+risk: critical
+source: https://github.com/BagelHole/DevOps-Security-Agent-Skills
+source_repo: BagelHole/DevOps-Security-Agent-Skills
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/blob/main/LICENSE
+compatibility: Requires the relevant OS/platform tooling and privileged access where
+  noted. Docs-only; helper scripts and templates not bundled.
+metadata:
+  author: devops-skills
+  version: '1.0'
+---
+
+# GCP Cloud Functions
+
+Build and deploy event-driven serverless applications with Google Cloud Functions (Gen1 and Gen2).
+
+## When to Use
+
+- Processing webhooks, API endpoints, or lightweight HTTP backends
+- Reacting to events from Pub/Sub, Cloud Storage, Firestore, or Eventarc
+- Running scheduled tasks (cron) without maintaining a server
+- Building data-processing pipelines triggered by file uploads
+- Prototyping microservices before committing to Cloud Run or GKE
+
+## Prerequisites
+
+- Google Cloud SDK (`gcloud`) installed and authenticated
+- APIs enabled: Cloud Functions, Cloud Build, Artifact Registry, Cloud Run (Gen2)
+- IAM role `roles/cloudfunctions.developer` (or `roles/run.developer` for Gen2)
+
+```bash
+gcloud services enable cloudfunctions.googleapis.com cloudbuild.googleapis.com \
+  artifactregistry.googleapis.com run.googleapis.com eventarc.googleapis.com
+```
+
+## Gen1 vs Gen2 Comparison
+
+| Feature | Gen1 | Gen2 (recommended) |
+|---------|------|---------------------|
+| Runtime | Cloud Functions infra | Built on Cloud Run |
+| Max timeout | 9 minutes | 60 minutes |
+| Max memory | 8 GB | 32 GB |
+| Concurrency | 1 request/instance | Up to 1000/instance |
+| Traffic splitting | No | Yes |
+| Eventarc triggers | No | Yes |
+
+## Deploy an HTTP Function (Gen2)
+
+```bash
+# Python HTTP function
+gcloud functions deploy hello-http \
+  --gen2 --region=us-central1 --runtime=python312 \
+  --trigger-http --allow-unauthenticated \
+  --entry-point=hello_http \
+  --memory=256Mi --timeout=60s \
+  --min-instances=0 --max-instances=100 \
+  --set-env-vars=APP_ENV=production --source=.
+
+# Node.js HTTP function
+gcloud functions deploy hello-node \
+  --gen2 --region=us-central1 --runtime=nodejs20 \
+  --trigger-http --allow-unauthenticated \
+  --entry-point=helloNode --memory=256Mi --source=.
+```
+
+## Deploy a Pub/Sub Triggered Function
+
+```bash
+gcloud pubsub topics create order-events
+
+gcloud functions deploy process-order \
+  --gen2 --region=us-central1 --runtime=python312 \
+  --trigger-topic=order-events \
+  --entry-point=process_order \
+  --memory=512Mi --timeout=120s --retry \
+  --service-account=order-processor@${PROJECT_ID}.iam.gserviceaccount.com \
+  --source=.
+```
+
+## Deploy a Cloud Storage Triggered Function
+
+```bash
+gcloud functions deploy process-upload \
+  --gen2 --region=us-central1 --runtime=python312 \
+  --trigger-event-filters="type=google.cloud.storage.object.v1.finalized" \
+  --trigger-event-filters="bucket=my-upload-bucket" \
+  --entry-point=process_upload \
+  --memory=1Gi --timeout=300s --source=.
+```
+
+## Deploy a Scheduled Function
+
+```bash
+gcloud functions deploy daily-cleanup \
+  --gen2 --region=us-central1 --runtime=python312 \
+  --trigger-http --no-allow-unauthenticated \
+  --entry-point=daily_cleanup --source=.
+
+gcloud scheduler jobs create http daily-cleanup-job \
+  --schedule="0 2 * * *" \
+  --uri="https://us-central1-${PROJECT_ID}.cloudfunctions.net/daily-cleanup" \
+  --http-method=POST \
+  --oidc-service-account-email=scheduler-sa@${PROJECT_ID}.iam.gserviceaccount.com \
+  --location=us-central1
+```
+
+## Python Function Examples
+
+```python
+# main.py
+import functions_framework
+import base64, json
+from flask import jsonify
+from google.cloud import firestore
+
+@functions_framework.http
+def hello_http(request):
+    """HTTP Cloud Function."""
+    name = request.args.get("name", "World")
+    return jsonify({"message": f"Hello, {name}!", "status": "ok"}), 200
+
+@functions_framework.cloud_event
+def process_order(cloud_event):
+    """Triggered by a Pub/Sub message."""
+    data = base64.b64decode(cloud_event.data["message"]["data"]).decode("utf-8")
+    order = json.loads(data)
+    db = firestore.Client()
+    db.collection("orders").document(order["id"]).set({
+        "status": "processing", "items": order["items"], "total": order["total"],
+    })
+
+@functions_framework.cloud_event
+def process_upload(cloud_event):
+    """Triggered when a file is uploaded to Cloud Storage."""
+    data = cloud_event.data
+    bucket_name, file_name = data["bucket"], data["name"]
+    if not file_name.lower().endswith((".png", ".jpg", ".jpeg")):
+        return
+    from google.cloud import vision
+    client = vision.ImageAnnotatorClient()
+    image = vision.Image(source=vision.ImageSource(
+        gcs_image_uri=f"gs://{bucket_name}/{file_name}"))
+    labels = [l.description for l in client.label_detection(image=image).label_annotations]
+    print(f"Labels for {file_name}: {labels}")
+```
+
+```
+# requirements.txt
+functions-framework==3.*
+google-cloud-firestore==2.*
+google-cloud-storage==2.*
+google-cloud-vision==3.*
+flask>=2.0
+```
+
+## Node.js Function Examples
+
+```javascript
+// index.js
+const functions = require("@google-cloud/functions-framework");
+
+functions.http("helloNode", (req, res) => {
+  const name = req.query.name || "World";
+  res.json({ message: `Hello, ${name}!`, status: "ok" });
+});
+
+functions.cloudEvent("processMessage", (cloudEvent) => {
+  const data = Buffer.from(cloudEvent.data.message.data, "base64").toString();
+  console.log(`Processing: ${JSON.parse(data)}`);
+});
+```
+
+## Managing Deployed Functions
+
+```bash
+gcloud functions list --gen2 --region=us-central1
+gcloud functions describe hello-http --gen2 --region=us-central1
+gcloud functions logs read hello-http --gen2 --region=us-central1 --limit=50
+gcloud functions delete hello-http --gen2 --region=us-central1 --quiet
+
+# Update env vars without redeploying code
+gcloud functions deploy hello-http --gen2 --region=us-central1 \
+  --update-env-vars=APP_ENV=staging
+
+# Test locally before deploying
+functions-framework --target=hello_http --port=8080
+```
+
+## Terraform Configuration
+
+```hcl
+resource "google_cloudfunctions2_function" "api" {
+  name     = "hello-http"
+  location = "us-central1"
+
+  build_config {
+    runtime     = "python312"
+    entry_point = "hello_http"
+    source {
+      storage_source {
+        bucket = google_storage_bucket.source.name
+        object = google_storage_bucket_object.source.name
+      }
+    }
+  }
+
+  service_config {
+    min_instance_count    = 0
+    max_instance_count    = 100
+    available_memory      = "256Mi"
+    timeout_seconds       = 60
+    service_account_email = google_service_account.fn.email
+    environment_variables = { APP_ENV = "production" }
+  }
+}
+
+resource "google_cloud_run_service_iam_member" "invoker" {
+  location = google_cloudfunctions2_function.api.location
+  service  = google_cloudfunctions2_function.api.name
+  role     = "roles/run.invoker"
+  member   = "allUsers"
+}
+
+resource "google_cloudfunctions2_function" "processor" {
+  name     = "process-order"
+  location = "us-central1"
+
+  build_config {
+    runtime     = "python312"
+    entry_point = "process_order"
+    source {
+      storage_source {
+        bucket = google_storage_bucket.source.name
+        object = google_storage_bucket_object.source.name
+      }
+    }
+  }
+
+  service_config {
+    max_instance_count    = 50
+    available_memory      = "512Mi"
+    timeout_seconds       = 120
+    service_account_email = google_service_account.fn.email
+  }
+
+  event_trigger {
+    trigger_region = "us-central1"
+    event_type     = "google.cloud.pubsub.topic.v1.messagePublished"
+    pubsub_topic   = google_pubsub_topic.orders.id
+    retry_policy   = "RETRY_POLICY_RETRY"
+  }
+}
+```
+
+## Troubleshooting
+
+| Symptom | Cause | Fix |
+|---------|-------|-----|
+| `PERMISSION_DENIED` on deploy | Missing Cloud Build or Artifact Registry perms | Grant `roles/cloudbuild.builds.builder` to Cloud Build SA |
+| Function deploys but returns 403 | Missing `roles/run.invoker` for Gen2 | Add `--allow-unauthenticated` or grant invoker role |
+| Cold start latency > 5s | Large dependencies or no min instances | Set `--min-instances=1`; reduce deps; use lazy imports |
+| Pub/Sub messages redelivered | Function errors or times out | Increase `--timeout`; fix error handling; add dead-letter topic |
+| `Build failed` during deploy | Syntax error or missing dependency | Check `gcloud builds log`; verify requirements.txt |
+| Cannot connect to VPC resource | Function not on VPC connector | Add `--vpc-connector=my-connector` to deploy |
+
+## Related Skills
+
+- **gcp-networking** - VPC connectors for accessing private resources from functions
+- **gcp-cloud-sql** - Connecting Cloud Functions to managed databases
+- **terraform-gcp** - Deploy Cloud Functions with Infrastructure as Code
+- **gcp-gke** - When workloads outgrow serverless and need Kubernetes
+
+## Limitations
+
+- Infrastructure commands can disrupt services: confirm target host/scope and have backups/snapshots before mutating state.
+- Docs-only import: upstream scripts and templates not bundled.
+

package/bundled-skills/gcp-cloud-sql/SKILL.md

@@ -0,0 +1,277 @@
+---
+name: gcp-cloud-sql
+description: Provision Cloud SQL and Spanner databases. Configure high availability,
+  backups, and security. Use when deploying managed databases on GCP.
+category: devops
+risk: critical
+source: https://github.com/BagelHole/DevOps-Security-Agent-Skills
+source_repo: BagelHole/DevOps-Security-Agent-Skills
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/blob/main/LICENSE
+compatibility: Requires the relevant OS/platform tooling and privileged access where
+  noted. Docs-only; helper scripts and templates not bundled.
+metadata:
+  author: devops-skills
+  version: '1.0'
+---
+
+# GCP Cloud SQL
+
+Deploy and manage fully managed relational databases (PostgreSQL, MySQL, SQL Server) on Google Cloud.
+
+## When to Use
+
+- Running production relational databases without managing replication, patching, or backups
+- Migrating on-premises PostgreSQL or MySQL workloads to a managed service
+- Applications requiring ACID transactions, relational schemas, and SQL query support
+- Workloads that need automated high availability with regional failover
+
+## Prerequisites
+
+- Google Cloud SDK (`gcloud`) installed and authenticated
+- Cloud SQL Admin API and Service Networking API enabled
+- IAM role `roles/cloudsql.admin` for full management
+
+```bash
+gcloud services enable sqladmin.googleapis.com servicenetworking.googleapis.com
+```
+
+## Instance Tiers Reference
+
+| Tier | vCPUs | Memory | Use Case |
+|------|-------|--------|----------|
+| db-f1-micro | Shared | 0.6 GB | Dev/test only |
+| db-g1-small | Shared | 1.7 GB | Low-traffic staging |
+| db-custom-2-8192 | 2 | 8 GB | Small production |
+| db-custom-4-16384 | 4 | 16 GB | Medium production |
+| db-custom-8-32768 | 8 | 32 GB | High-traffic production |
+
+## Create a PostgreSQL Instance
+
+```bash
+gcloud sql instances create prod-db \
+  --database-version=POSTGRES_16 \
+  --tier=db-custom-4-16384 \
+  --region=us-central1 \
+  --availability-type=REGIONAL \
+  --storage-type=SSD --storage-size=100GB --storage-auto-increase \
+  --backup-start-time=02:00 --enable-point-in-time-recovery \
+  --retained-backups-count=14 \
+  --maintenance-window-day=SUN --maintenance-window-hour=4 \
+  --database-flags=max_connections=200,log_min_duration_statement=1000 \
+  --root-password=$(openssl rand -base64 24) \
+  --labels=env=production,team=backend
+
+gcloud sql databases create myapp --instance=prod-db --charset=UTF8
+gcloud sql users create appuser --instance=prod-db \
+  --password=$(openssl rand -base64 24)
+```
+
+## Create a MySQL Instance
+
+```bash
+gcloud sql instances create mysql-prod \
+  --database-version=MYSQL_8_0 \
+  --tier=db-custom-4-16384 --region=us-central1 \
+  --availability-type=REGIONAL \
+  --storage-type=SSD --storage-size=100GB --storage-auto-increase \
+  --backup-start-time=02:00 --enable-bin-log --retained-backups-count=14 \
+  --database-flags=slow_query_log=on,long_query_time=2,max_connections=500 \
+  --root-password=$(openssl rand -base64 24)
+```
+
+## Private IP Configuration
+
+```bash
+# Allocate IP range and create private connection
+gcloud compute addresses create google-managed-services \
+  --global --purpose=VPC_PEERING --prefix-length=16 --network=my-vpc
+
+gcloud services vpc-peerings connect \
+  --service=servicenetworking.googleapis.com \
+  --ranges=google-managed-services --network=my-vpc
+
+# Create instance with private IP only
+gcloud sql instances create private-db \
+  --database-version=POSTGRES_16 --tier=db-custom-2-8192 \
+  --region=us-central1 \
+  --network=projects/${PROJECT_ID}/global/networks/my-vpc \
+  --no-assign-ip --availability-type=REGIONAL \
+  --storage-type=SSD --storage-size=50GB --storage-auto-increase
+```
+
+## Read Replicas
+
+```bash
+# Same-region replica
+gcloud sql instances create prod-db-replica-1 \
+  --master-instance-name=prod-db --tier=db-custom-4-16384 \
+  --region=us-central1 --availability-type=ZONAL
+
+# Cross-region replica for DR
+gcloud sql instances create prod-db-replica-eu \
+  --master-instance-name=prod-db --tier=db-custom-4-16384 \
+  --region=europe-west1 --availability-type=ZONAL
+
+# Promote a replica to standalone (disaster recovery)
+gcloud sql instances promote-replica prod-db-replica-eu
+```
+
+## Backups and Restore
+
+```bash
+gcloud sql backups create --instance=prod-db --description="pre-migration"
+gcloud sql backups list --instance=prod-db
+
+# Point-in-time recovery
+gcloud sql instances clone prod-db prod-db-pitr \
+  --point-in-time="2026-03-23T10:00:00Z"
+
+# Export / import
+gcloud sql export sql prod-db gs://my-bucket/export.sql.gz --database=myapp
+gcloud sql import sql prod-db gs://my-bucket/export.sql.gz --database=myapp
+```
+
+## Cloud SQL Auth Proxy
+
+```bash
+curl -o cloud-sql-proxy \
+  https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.11.0/cloud-sql-proxy.linux.amd64
+chmod +x cloud-sql-proxy
+
+./cloud-sql-proxy ${PROJECT_ID}:us-central1:prod-db --port=5432 --auto-iam-authn
+
+# Unix socket (for Kubernetes sidecar pattern)
+./cloud-sql-proxy ${PROJECT_ID}:us-central1:prod-db --unix-socket=/tmp/cloudsql
+psql "host=/tmp/cloudsql/${PROJECT_ID}:us-central1:prod-db user=appuser dbname=myapp"
+```
+
+## Connection Methods Summary
+
+| Method | Use Case | Requirement |
+|--------|----------|-------------|
+| Public IP + SSL | Dev/test access | Authorized networks configured |
+| Cloud SQL Auth Proxy | Production on GCE/GKE | SA with `roles/cloudsql.client` |
+| Private IP | VPC-native apps | VPC peering configured |
+| Cloud SQL Connector lib | App-level integration | SA credentials |
+
+## Terraform Configuration
+
+```hcl
+resource "google_sql_database_instance" "main" {
+  name             = "prod-db"
+  database_version = "POSTGRES_16"
+  region           = "us-central1"
+
+  settings {
+    tier              = "db-custom-4-16384"
+    availability_type = "REGIONAL"
+    disk_type         = "PD_SSD"
+    disk_size         = 100
+    disk_autoresize   = true
+
+    backup_configuration {
+      enabled                        = true
+      start_time                     = "02:00"
+      point_in_time_recovery_enabled = true
+      backup_retention_settings { retained_backups = 14 }
+    }
+
+    ip_configuration {
+      ipv4_enabled    = false
+      private_network = google_compute_network.vpc.id
+      require_ssl     = true
+    }
+
+    maintenance_window { day = 7; hour = 4 }
+    database_flags { name = "max_connections"; value = "200" }
+
+    user_labels = { env = "production" }
+  }
+
+  deletion_protection = true
+  depends_on          = [google_service_networking_connection.private_vpc]
+}
+
+resource "google_sql_database" "app" {
+  name     = "myapp"
+  instance = google_sql_database_instance.main.name
+}
+
+resource "google_sql_user" "app" {
+  name     = "appuser"
+  instance = google_sql_database_instance.main.name
+  password = random_password.db_password.result
+}
+
+resource "google_sql_database_instance" "replica" {
+  name                 = "prod-db-replica-1"
+  master_instance_name = google_sql_database_instance.main.name
+  region               = "us-central1"
+  database_version     = "POSTGRES_16"
+
+  replica_configuration { failover_target = false }
+
+  settings {
+    tier            = "db-custom-4-16384"
+    disk_type       = "PD_SSD"
+    disk_autoresize = true
+    ip_configuration {
+      ipv4_enabled    = false
+      private_network = google_compute_network.vpc.id
+    }
+  }
+}
+
+resource "google_compute_global_address" "private_ip" {
+  name          = "google-managed-services"
+  purpose       = "VPC_PEERING"
+  address_type  = "INTERNAL"
+  prefix_length = 16
+  network       = google_compute_network.vpc.id
+}
+
+resource "google_service_networking_connection" "private_vpc" {
+  network                 = google_compute_network.vpc.id
+  service                 = "servicenetworking.googleapis.com"
+  reserved_peering_ranges = [google_compute_global_address.private_ip.name]
+}
+```
+
+## Common Operations
+
+```bash
+gcloud sql instances list
+gcloud sql instances describe prod-db \
+  --format="yaml(state,settings.tier,settings.availabilityType,ipAddresses)"
+gcloud sql instances patch prod-db --storage-size=200GB
+gcloud sql instances patch prod-db --database-flags=max_connections=300
+gcloud sql instances restart prod-db
+```
+
+## Troubleshooting
+
+| Symptom | Cause | Fix |
+|---------|-------|-----|
+| `Connection refused` via public IP | IP not in authorized networks | Add IP with `gcloud sql instances patch --authorized-networks` |
+| `SSL required` error | `require_ssl=true` but client not using SSL | Use Cloud SQL Proxy or pass `sslmode=require` |
+| High replication lag | Replica tier too small or write-heavy primary | Increase replica tier; reduce write load |
+| Instance slow despite RUNNABLE | Under-provisioned CPU/memory | Scale tier with `gcloud sql instances patch --tier` |
+| Proxy returns `ECONNREFUSED` | Wrong connection name or missing IAM role | Verify `project:region:instance` format; grant `roles/cloudsql.client` |
+| Cannot create private IP instance | VPC peering not established | Run `gcloud services vpc-peerings connect` first |
+| Backup restore fails | Incompatible version | Ensure same major database version between source and target |
+
+## Related Skills
+
+- **gcp-networking** - VPC and private service connect for Cloud SQL private IP
+- **terraform-gcp** - Provision Cloud SQL with Infrastructure as Code
+- **gcp-gke** - Connecting Kubernetes workloads to Cloud SQL via sidecar proxy
+- **gcp-compute** - Running applications on Compute Engine that connect to Cloud SQL
+
+## Limitations
+
+- Infrastructure commands can disrupt services: confirm target host/scope and have backups/snapshots before mutating state.
+- Docs-only import: upstream scripts and templates not bundled.
+