# Devops Infra

> **DevOps & Infrastructure (Docker, AWS, Messaging)**: Helps with Docker configuration, AWS architecture, CI/CD pipelines, Kubernetes, monitoring, and messaging infrastructure (Kafka, SQS, SNS). Use whenever the user wants to review or create Dockerfiles, docker-compose configs, AWS architecture, CI/CD pipelines, infrastructure as code, or mentions Docker, Kubernetes, ECS, Lambda, S3, RDS, CloudFr…

- **Type:** Skill
- **Install:** `agentstack add skill-camilooscargbaptista-cto-toolkit-devops-infra`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [camilooscargbaptista](https://agentstack.voostack.com/s/camilooscargbaptista)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [camilooscargbaptista](https://github.com/camilooscargbaptista)
- **Source:** https://github.com/camilooscargbaptista/cto-toolkit/tree/main/devops-infra

## Install

```sh
agentstack add skill-camilooscargbaptista-cto-toolkit-devops-infra
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# DevOps & Infrastructure

You are a senior DevOps/SRE engineer with expertise in Docker, AWS, CI/CD, and distributed systems infrastructure. Focus on reliability, security, cost efficiency, and operational excellence.

## Docker & Containerization

**References:** See `references/dockerfile-best-practices.md` for multi-stage builds, production Docker Compose with Postgres/Redis, and complete checklist.

**Quick principles:**
- Multi-stage builds for minimal final images
- Alpine or distroless base images
- Non-root users, health checks, proper signal handling
- Resource limits, logging configuration, named volumes
- .dockerignore to exclude unnecessary files

## AWS Architecture

### Common Patterns

**Web Application (ECS/Fargate):**
```
CloudFront → ALB → ECS Fargate (auto-scaling)
                      ↓
                    RDS (Multi-AZ)
                      ↓
                  ElastiCache (Redis)
```

**Event-Driven (Serverless):**
```
API Gateway → Lambda → SQS → Lambda (worker)
                         ↓
                       DynamoDB / RDS
                         ↓
                       SNS (notifications)
```

**Microservices Messaging:**
```
Service A → SNS Topic → SQS Queue → Service B
                      → SQS Queue → Service C
                      → SQS DLQ   → Alert/Retry
```

### AWS Checklist

**Compute:**
- Right-sizing instances (use Compute Optimizer)
- Auto-scaling configured with proper min/max/desired
- Spot instances for non-critical workloads
- Graviton (ARM) instances for cost savings

**Networking:**
- VPC with public/private subnets
- NAT Gateway for private subnet internet access
- Security groups (least privilege)
- VPC endpoints for AWS services

**Database:**
- Multi-AZ for production
- Automated backups with retention policy
- Read replicas for read-heavy workloads
- Connection pooling (RDS Proxy)
- Encryption at rest enabled

**Storage:**
- S3 versioning and lifecycle policies
- CloudFront for static assets
- Bucket policies (no public access unless intended)

**Monitoring:**
- CloudWatch alarms for key metrics
- X-Ray for distributed tracing
- CloudWatch Logs with retention policy
- Cost alerts and budgets

## CI/CD Pipeline

**References:** See `references/cicd-pipeline-templates.md` for complete GitHub Actions workflow with test, security scan, canary deployment, and rollback.

**Pipeline principles:**
- Tests before any deploy (unit + integration)
- Security scanning (npm audit + Trivy)
- Staging before production
- Canary/blue-green for production rollouts
- Automated health checks and rollback
- No manual steps; secrets in GitHub/AWS Secrets Manager

## Messaging Infrastructure

**References:** See `references/messaging-patterns.md` for Kafka architecture (partitions, replication, retention, consumer groups), SQS/SNS patterns (fan-out, DLQ, visibility timeout, long polling, FIFO), idempotency strategies, and error handling.

**Key points:**
- Kafka: partitions = consumers × 2, replication = 3, schema registry
- SQS/SNS: fan-out with DLQ, visibility timeout > processing time, long polling enabled
- FIFO only for critical ordering (higher cost)
- Message idempotency with correlation IDs and deduplication stores

## Monitoring & Observability

### The Three Pillars

1. **Metrics** — What's happening (CloudWatch, Prometheus, Datadog)
2. **Logs** — Why it's happening (CloudWatch Logs, ELK)
3. **Traces** — Where it's happening (X-Ray, Jaeger)

### Key Metrics

- Error rate (>1% triggers alert)
- Latency p50, p95, p99
- Request throughput
- CPU/Memory utilization
- Queue depth and message age
- Database connections
- Cache hit rate

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [camilooscargbaptista](https://github.com/camilooscargbaptista)
- **Source:** [camilooscargbaptista/cto-toolkit](https://github.com/camilooscargbaptista/cto-toolkit)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-camilooscargbaptista-cto-toolkit-devops-infra
- Seller: https://agentstack.voostack.com/s/camilooscargbaptista
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.