Agent skill · software engineering · daymade
terraform-skill
Diagnoses and designs safe Terraform releases, provisioners (remote-exec/local-exec/file, cloud-init, Compose, Caddy), multi-environment isolation, and fresh-host bootstrap. Use when writing or reviewing plan/apply wrappers or provisioners; when staging/production config may differ; when a rollout can mutate a shared gateway; or debugging drift, TLS, container restarts, DNS duplication, or snapshot contamination.
Why this skill is useful
Adds multiple executable scripts and specific Terraform patterns for debugging and deployment that aren't widely documented.
What it needs
Requires docker, terraform installed locally. About 11k tokens when loaded. Last updated 2026-08-07. 1,320 stars on the source repository.
What this skill does
Terraform Release and Provisioner Safety Prevent a valid-looking Terraform workflow from publishing unvalidated bytes or widening a change's blast radius. Keep the user's business outcome and the actual mutation surface ahead of plan counts, green wrappers, or process completeness. Route the task Release, restoration, shared gateway, saved plan, staging receipt, or production promotion: read release-safety-and-environment-parity.md and pre-deploy-validation.md before approval or mutation. Environment isolation, including cached initialization, environment retirement, shared data backend, DNS ownership, state, or snapshots: read multi-env-isolation.md. Pre-deploy checks or a validator: read pre-deploy-validation.md. Fresh instance or empty data disk: read zero-to-deploy-checklist.md. One known provisioner symptom: use the matching pattern below. Operating contract 1. Use the repository's canonical release entry. When shared-gateway publication requires standard CI, agents may initiate that CI within existing authorization; normal release, restoration, rollback, and static-content transfer all use its controlled executor and existing wrappers. Do not substitute a local Terraform apply, root SSH/SCP, helper, or console write. Verify the implemented workflow and supported inputs before dispatch; lint or image-build CI alone is not a deployment lane. A missing lane blocks the live write, not preparation or read-only diagnosis. 2. Prefer provider resources, image baking, cloud-init, or configuration management. HashiCorp recommends exhausting purpose-built alternatives because Terraform cannot model provisioner side effects predictably. When a provisioner remains necessary, make its artifact, target, lock, validation, and readback explicit. 3. Inventory every resource or recovery tool that can write the target runtime. A validator attached to only one writer does not protect another writer of the same shared service. 4. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills daymade/terraform-skill