Spatie Ops

Spatie ops

Start here for hosting, servers, DNS and migrations. A request such as "move this site to Cloud", "delete this DO droplet", "what runs on this Forge server?" or "check Cloud performance" should reach this skill without the user naming it.

Choose the workflow

Use spatie-guidelines when changing PHP/Laravel code and gh for GitHub operations.

Authenticate and inspect

The public helper is ~/.dotfiles/bin/spatie-ops. The private mapping is ~/.dotfiles-custom/spatie-ops/credentials.json; it contains credential references, not token values. Read authentication if setup is missing, access fails, or credentials are needed inside another program.

shCopy code
OPS="$HOME/.dotfiles/bin/spatie-ops"
"$OPS" status
"$OPS" request do GET '/droplets?per_page=100'
"$OPS" request forge GET /servers
"$OPS" request cloud GET '/applications?per_page=100'
"$OPS" request openprovider GET '/dns/zones/example.com?with_records=true'

Paths are relative to each provider's API prefix. The private Forge configuration supplies the organization. Responses have status and response fields; secrets are redacted before display. The helper performs authenticated HTTPS requests itself, so bearer tokens are not placed in shell arguments.

For a JSON mutation, supply a file or stdin with --input; use values from 1Password in memory when constructing sensitive payloads. For example, once the user has authorized the instance change:

shCopy code
printf '%s' '{"hibernation_timeout":1}' | "$OPS" request cloud PATCH /instances/INSTANCE_ID --input -

Use the cloud CLI for deployments, command execution and other purpose-built Cloud commands. Use this helper for REST operations and metrics. Do not depend on migration-workspace helpers such as secret.sh, cloudapi.sh or openprovider-token.sh.

Scope and verification

• Credential access establishes access, not permission to change infrastructure. Follow the user's current and standing authorization; resolve routine reads independently.
• Before a destructive operation, establish the exact named resource, ownership and dependencies. Verify its absence at the provider after deletion.
• Read back changes and verify the resulting behavior. An accepted API request alone is insufficient.
• Keep actual item IDs, vault names, credentials and account-specific mappings outside public dotfiles. API responses can contain newly issued secrets, including responses from apparently unrelated operations such as a cache purge.
• For secret-bearing data needed by automation, use --private-output outside Git and inspect it programmatically. See authentication. Do not print the raw file into a chat.