name: canary-deploy description: Safe system changes with automatic baseline capture, canary testing, and rollback for critical infrastructure modifications. Use when making changes to SSH config, firewall rules, network settings, systemd services, kernel parameters, or any system change that could break remote access. Prevents lockouts by validating connectivity before and after changes. Born from a real incident where AllowTcpForwarding=no killed VPN tunnel access.

Canary Deploy

Safe system changes with pre-flight checks, validation, and automatic rollback.

The Problem

System changes can lock you out: - SSH hardening breaks remote access - Firewall rules block needed ports - Kernel parameters cause instability - Service restarts break dependencies

Recovery without physical access is painful or impossible.

Quick Start

Before any critical change

# Capture baseline (connectivity, services, ports)
bash scripts/canary-test.sh baseline

# Make your change
sudo nano /etc/ssh/sshd_config

# Validate change didn't break anything
bash scripts/canary-test.sh validate

# If validation fails:
bash scripts/canary-test.sh rollback

For automated changes

# Full pipeline: baseline → apply → validate → rollback-if-failed
bash scripts/critical-update.sh \
  --name "SSH hardening" \
  --backup "/etc/ssh/sshd_config" \
  --command "sudo sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config && sudo systemctl reload sshd" \
  --validate "ssh -o ConnectTimeout=5 localhost echo ok"

Protocol A+B (Manual Workflow)

For interactive sessions where you want human-in-the-loop:

Protocol A: Test interactively

1. Tell the human: "Open a second SSH session as backup"
2. Apply change in the first session
3. Ask: "Test connectivity from the second session"
4. If it works → confirm
5. If it fails → rollback from the backup session

Protocol B: Backup first

1. Run bash scripts/canary-test.sh baseline
2. Verify backup is valid
3. Apply change
4. Run bash scripts/canary-test.sh validate
5. If validation fails → bash scripts/canary-test.sh rollback

Always use both A + B together for maximum safety.

What Gets Checked

Baseline capture

• SSH connectivity (local + remote)
• Open ports (ss -tlnp)
• Running services (systemctl)
• Firewall rules (ufw/iptables)
• Network routes
• DNS resolution

  7w4.net收錄了海量優質技能外掛。

• Config file checksums

Validation

• All baseline checks re-run
• Diff against baseline
• Any regression = FAIL

Critical Change Categories

References

See references/incident-report.md for the real incident that inspired this skill.

這是一款質量可靠的系統安全變更工具，文件清晰易讀，操作流程直觀好記。它能有效防止 SSH 配置、防火牆規則等關鍵變更導致的系統鎖定問題，自動化回滾機制在變更失敗時能快速恢復。主要優點是實用性強、流程完整；不足之處是對特定系統環境的適配性有限，某些邊界情況的處理還可以更細緻。總體來說值得信賴，適合在生產環境中使用。