linux

Plugin linux from marketplace chwezi in peterbamuhigire/chwezi-engine-agents. Commands read from the repo's manifest — yesterday.

Skills (48)

• linux-cloud-init

  Use when authoring, validating, or debugging cloud-init user-data, Ubuntu autoinstall, or RHEL-family Kickstart for first-boot provisioning. Use linux-server-provisioning for interactive post-boot setup and linux-config-management for ongoing desired state.

• linux-config-management

  Use when managing repeatable server state with Ansible, etckeeper, check mode, or drift remediation across Debian/Ubuntu and RHEL families. Use linux-server-provisioning for one-time bootstrap and linux-cloud-init for first boot.

• linux-package-management

  Use when installing, upgrading, pinning, removing, or diagnosing packages and repositories with apt, dnf, snap, Flatpak, or automatic updates. Use linux-server-provisioning for a complete new-server sequence and linux-config-management for fleet-wide desired state.

• linux-server-provisioning

  Use when interactively provisioning a fresh Debian/Ubuntu or RHEL-family server after first boot, including identity, admin access, updates, firewall, services, and verification. Use linux-cloud-init for unattended first boot and linux-config-management for repeatable fleet state.

• linux-access-control

  Use when creating, revoking, or auditing Linux users, groups, SSH keys, sudo/wheel access, PAM settings, SELinux user mappings, or file permissions. Use linux-secrets for credential material and linux-server-hardening for broader host policy.

• linux-secrets

  Use when scanning for leaked credentials, encrypting configuration with age, sops, or GPG, rotating secrets, or checking credential-file handling. Use linux-access-control for user and permission administration and linux-server-hardening for wider host controls.

• linux-dns-server

  Use when operating BIND or Unbound as an authoritative or recursive DNS server, including zone authoring, validation, reloads, reverse zones, transfers, and SELinux contexts. Use linux-network-admin for client-side resolution or interface configuration.

• linux-network-admin

  Use when diagnosing or configuring Linux interfaces, addresses, routes, client DNS, reachability, VLANs, or time synchronisation with Netplan or NetworkManager. Use linux-dns-server for hosted DNS zones and linux-firewall-ssl for packet filtering.

• linux-mail-server

  Use when operating or diagnosing Postfix, Exim, Dovecot, SMTP submission, mail queues, TLS, or SPF/DKIM/DMARC on a Linux mail host. Use linux-network-admin for general reachability and linux-dns-server when the task is authoritative zone operation.

• linux-site-deployment

  Use when releasing one named website from a pinned repository revision to an existing Linux host, including versioned candidate, vhost cutover, rollback, external verification, and update registration. Use linux-webstack for stack setup.

• linux-webstack

  Use when installing, configuring, tuning, or diagnosing the shared Nginx, Apache/httpd, PHP-FPM, or Node.js service stack on Linux. Use linux-site-deployment for one site's release and linux-service-management for generic systemd operations.

• linux-service-management

  Use when operating or diagnosing systemd units, timers, targets, journal logs, restart policy, dependencies, or cgroup limits. Use a service-specific skill for application configuration and linux-virtualization for VM or system-container lifecycle.

• linux-virtualization

  Use when operating KVM/libvirt virtual machines or LXD system containers, including lifecycle, snapshots, backups, storage, networking, and host inspection. Use linux-container-engine and linux-container-deployment for Docker or Podman application containers.

• linux-disk-storage

  Use when diagnosing disk or inode pressure, performing measured cleanup, managing local storage or swap, or mounting NFS and CIFS shares; use linux-filesystem-snapshots for point-in-time snapshots.

• linux-firewall-ssl

  Use when inspecting or changing UFW/firewalld policy, issuing or renewing Certbot certificates, or validating host TLS exposure; use linux-webstack for application-server faults.

• linux-intrusion-detection

  Use when operating fail2ban, investigating its bans, or running qualified rkhunter/chkrootkit checks; use linux-auditd-rules or linux-file-integrity for compliance-grade auditing.

• linux-ngo-cyber-resilience

  Use when designing or reviewing practical Linux security and incident resilience for NGOs, civil-society organisations, or small mission-led teams; use linux-server-hardening for host controls and linux-disaster-recovery for backup restoration.

• linux-security-analysis

  Use when performing a read-only, evidence-backed Linux security assessment across kernel, identity, network, services, storage, backups, and packages; use linux-server-hardening to remediate.

• linux-server-hardening

  Use when an authorised operator wants to remediate verified Linux security findings interactively across SSH, firewall, MAC, services, permissions, and updates; use linux-security-analysis first.

• linux-log-management

  Use when inspecting time-bounded journald or service logs, correlating web/database/security events, or managing logrotate retention; use linux-observability for forwarding and linux-troubleshooting for multi-subsystem incidents.

• linux-observability

  Use when adding or diagnosing Prometheus/node_exporter metrics, central log shipping, or lightweight health endpoints; use linux-system-monitoring for an ad hoc host snapshot and linux-log-management for local log analysis.

• linux-system-monitoring

  Use when taking a read-only host-health snapshot or investigating CPU, memory, I/O, network, process, and backup pressure; use linux-observability for persistent telemetry and linux-troubleshooting for incident branching.

• linux-disaster-recovery

  Use when recovering MySQL data, application files, configuration, boot state, or filesystems from a verified backup after loss or corruption; use linux-troubleshooting first when the fault may be recoverable without restore.

• linux-troubleshooting

  Use when triaging a production Linux incident across CPU, memory, disk, services, web, database, TLS, backups, or deployments; route resource findings to linux-system-monitoring and recovery to linux-disaster-recovery.

• linux-bash-scripting

  Use when writing or reviewing portable sk-* Bash scripts for this engine, including common.sh primitives, flags, preview mode, and safety gates; use linux-repo-sync for Git-update behaviour and not for one-off commands.

• linux-repo-sync

  Use when writing, reviewing, or running unattended or menu-driven Git repository updates that must preserve tracked and untracked local work; use linux-bash-scripting first for sk-* script structure.

• linux-inmemory-stores

  Use when installing, securing, sizing, or diagnosing Redis or Memcached on Debian/Ubuntu or RHEL-family hosts; covers bind/auth, eviction, and Redis persistence. Use linux-mysql-mariadb for relational databases and linux-firewall-ssl for host policy.

• linux-mysql-mariadb

  Use when installing, securing, tuning, backing up, restoring, or diagnosing MySQL or MariaDB on Debian/Ubuntu or RHEL-family hosts. Covers InnoDB, logical dumps, binlogs, and PITR; use linux-postgresql for PostgreSQL.

• linux-postgresql

  Use when installing, authenticating, tuning, backing up, restoring, or diagnosing PostgreSQL on Debian/Ubuntu or RHEL-family hosts. Covers pg_hba.conf, logical backups, WAL, and PITR; use linux-mysql-mariadb for MySQL/MariaDB.

• linux-container-deployment

  Use when running, updating, debugging, or supervising containers and Compose/Quadlet stacks on Debian/Ubuntu or RHEL-family hosts. Covers lifecycle, health, volumes, and systemd; use linux-container-engine for setup and linux-image-hygiene for pruning.

• linux-container-engine

  Use when installing, configuring, hardening, or diagnosing Docker or Podman engines on Debian/Ubuntu or RHEL-family hosts. Covers daemon/rootless mode, registries, storage, and sockets; use linux-container-deployment to run workloads.

• linux-image-hygiene

  Use when measuring or reclaiming Docker/Podman storage and scheduling safe cleanup on Debian/Ubuntu or RHEL-family hosts. Covers images, cache, networks, and authorised volume pruning; use linux-container-engine for engine setup.

• linux-archive-integrity

  Use when creating, signing, encrypting, listing, comparing, or restoring metadata-preserving tar archives on Debian/Ubuntu or RHEL-family hosts. Covers ACLs, xattrs, incrementals, and verification; use linux-rsync-sync for file-tree mirrors.

• linux-filesystem-snapshots

  Use when creating, monitoring, replicating, mounting, or rolling back LVM, Btrfs, or ZFS snapshots on Debian/Ubuntu or RHEL-family hosts. Covers consistency, COW, and rollback; use linux-rsync-sync or linux-archive-integrity for independent backups.

• linux-rsync-sync

  Use when designing, previewing, running, or verifying rsync copies, mirrors, offsite transfers, or hard-linked backups on Debian/Ubuntu or RHEL-family hosts. Covers SSH, filters, deletion, checksums, and resume; use linux-archive-integrity for tar archives.

• linux-kernel-modules

  Use when inspecting, loading, unloading, parameterising, persisting, or blacklisting Linux kernel modules on Debian/Ubuntu or RHEL-family hosts. Covers dependencies and initramfs; use linux-sysctl-tuning for measured runtime kernel parameters.

• linux-perf-profiling

  Use when diagnosing a Linux performance regression or bottleneck with load, vmstat, iostat, mpstat, pidstat, sar, and perf on Debian/Ubuntu or RHEL-family hosts. Produces read-only evidence before any tuning; hand changes to linux-sysctl-tuning.

• linux-sysctl-tuning

  Use when measured Linux performance evidence justifies persistent network, queue, writeback, swap, or congestion-control sysctl changes on Debian/Ubuntu or RHEL-family hosts. Profile first; use linux-server-hardening for security sysctls.

• linux-auditd-rules

  Use when inspecting, designing, testing, persisting, or querying auditd rules for forensic attribution on Debian/Ubuntu or RHEL-family hosts. Covers watches, syscalls, loss, and immutable mode; use linux-file-integrity for drift and linux-benchmark-scanning for scoring.

• linux-benchmark-scanning

  Use when running read-only OpenSCAP or Lynis scans, selecting distro-matched profiles, interpreting failures, or drafting remediation on Debian/Ubuntu or RHEL-family hosts. Use linux-auditd-rules for attribution and linux-file-integrity for AIDE drift.

• linux-file-integrity

  Use when establishing, checking, tuning, or safely updating an AIDE baseline on Debian/Ubuntu or RHEL-family hosts. Covers drift triage, scheduling, and off-box trust; use linux-auditd-rules for attribution and linux-benchmark-scanning for scoring.

• cisco-ios-patterns

  Use when reading or reviewing Cisco IOS/IOS-XE configuration, selecting read-only show commands, or planning and verifying bounded router or switch configuration work. Not for Linux host networking, bulk SSH automation, or config preflight parsing; route those to linux-network-admin, netmiko-ssh-aut

• netmiko-ssh-automation

  Use when building or reviewing bounded Python/Netmiko SSH collection for a named network-device inventory, parsing command output, or planning a gated configuration push. Keep the default read-only; not for Linux host automation—use linux-config-management for host tasks.

• network-config-validation

  Use when statically preflighting router or switch configuration for dangerous commands, duplicate addresses, overlaps, stale references, or management-plane exposure. Not a full parser or push workflow; use linux-server-hardening for host configuration and cisco-ios-patterns for manual device review

• linux-sysadmin

  Use when a Debian/Ubuntu or RHEL-family server request needs routing across provisioning, security, services, networking, recovery, databases, containers, storage, performance, or compliance; use linux-troubleshooting when an unexplained symptom spans components.

• kaizen-improvement-system

  Use when auditing or improving the Linux operations engine, linux-sysadmin skills, or any server, network, security, observability, automation, backup, database, or recovery product it produces.

• skill-safety-audit

  Use when reviewing a new or changed skill package for unsafe installers, credential collection, hidden execution, unjustified privilege, or policy bypass; this read-only gate does not replace domain code review or `skill-writing` conformance work.

• skill-writing

  Use when creating or upgrading a portable Linux operations skill in this engine under the canonical chwezi-dev-engine skill-writing standard; distinguishes authoring contracts from executing `linux-sysadmin` workflows and from the read-only `skill-safety-audit` review gate.

Slash commands (2)

• /linux:rclone

  Use as a guarded reference for rclone setup and transfers. Confirm the exact remote, source, destination, deletion scope, approval, and restore path before any write.

• /linux:redis

  Use as a guarded Redis reference. Confirm the exact host, port, database, version, owner, and recovery plan before commands that read broadly or mutate data.

Hooks (1)

• PreToolUse

  node "${CLAUDE_PLUGIN_ROOT}/hooks/destructive-bash-gate.js"

Similar plugins