Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add hxy91819/mason-skills --skill single-host-deploygit clone --depth 1 https://github.com/hxy91819/mason-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/hxy91819/mason-skills/single-host-deploy)<a href="https://agentmods.dev/skills/hxy91819/mason-skills/single-host-deploy"><img src="https://agentmods.dev/badge/skills/hxy91819/mason-skills/single-host-deploy/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/hxy91819/mason-skills/single-host-deploy"><img src="https://agentmods.dev/badge/skills/hxy91819/mason-skills/single-host-deploy.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00052 | $0.04730 |
| Opus 5.5 | $0.00021 | $0.01892 |
| Sonnet 5.5 | $0.00010 | $0.00946 |
| Haiku 4.5 | $0.00005 | $0.00473 |
Grade B, and why
single-host-deploy scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
| `sudo: a password is required` | 部署账号必须免密 sudo；不要把 sudo 密码写进清单 | How it starts
The opening of the file, as written. The whole thing — 226 lines — stays where its author put it; the contents beside it link to each section on GitHub.
单机部署即代码
适用范围
一台 Linux 主机（Ubuntu 24.04 或 Debian 12+，x86_64/arm64），一个 Docker Compose 栈，控制器是开发机或运维机，经 SSH 管理目标主机。目标主机不装 Ansible 代理，不在主机上编译镜像。
不覆盖：Kubernetes、多主机编排、云主机创建、DNS/云安全组、镜像仓库、密钥托管服务、跨机房容灾。这些需要另一个工具或人工流程。
不变量
- 两样本机输入：一份环境清单、一份密钥文件，都以
.local.结尾并被.gitignore忽略。仓库只跟踪example.yml和example.secrets.env。 - 密钥只在本地：清单只写键名和模式，真实值只放在未跟踪的
<env>.secrets.local.env，权限 0600。发布日志、release 记录、文档和命令示例都不含值。 - 控制器构建：用
docker buildx构建目标平台镜像，docker save | ssh docker load传输，不依赖镜像仓库。 - 不在目标机编译：目标机只需要 SSH、sudo、Docker/Compose 和
python3。 - 发布只从干净提交：
git status --short为空才允许release；镜像标签用当前提交的 short sha。 - current 最后切换：所有服务健康、冒烟通过后，才把
deploy_root/current指向本次 release 记录。任何一步失败都中止，保留旧current。 .ok标记成功：只有冒烟通过的 release 记录才写.ok；默认回滚按.ok历史找上一份。- 清单与密钥分离：清单描述“要什么”，密钥描述“凭什么”；不要把密码写进清单、release 记录或 Compose 文件。
- 共用网关只读：
gateway.mode: external只把站点块渲染到部署目录并打印接入提示，不修改主机上的共用网关配置。
快速开始
cp infra/deploy/environments/example.yml infra/deploy/environments/prod.local.yml
cp infra/deploy/environments/example.secrets.env infra/deploy/environments/prod.secrets.local.env
chmod 600 infra/deploy/environments/prod.secrets.local.env
$EDITOR infra/deploy/environments/prod.local.yml
$EDITOR infra/deploy/environments/prod.secrets.local.env
infra/deploy/deploy.sh prod bootstrap
infra/deploy/deploy.sh prod release
infra/deploy/deploy.sh prod status
首次使用前，控制器安装固定版本的 ansible-core、collection、Docker Engine 与 Buildx。版本和安装命令见 assets/infra/deploy/README.md。
动作清单
| 动作 | 作用 | 关键边界 |
|---|---|---|
bootstrap |
写入 Docker 官方源、安装 Docker/Compose、创建部署账号与目录、安装备份 timer、按清单增补 UFW | 可重复执行；第二次应为 changed=0；check 只读 |
release |
校验密钥、构建并传输镜像、渲染配置、启动、等健康、冒烟、切换 current、写 release 记录 |
只从干净提交；冒烟不过不切 current |
rollback [记录] |
用历史 release 记录的镜像重新启动，冒烟后把 current 切回目标，并写 rollback-*.json |
不重建镜像、不改数据库、不改应用密钥；不适用不可逆迁移 |
status |
只读展示当前 release、镜像、容器状态、备份 timer 和最近备份 | 不写任何文件 |
backup-now |
立即执行一次数据库备份，走 systemd oneshot service | 失败给 journalctl 入口 |
db-init |
仅 external 数据库：幂等创建角色、库、schema、连接上限和 search_path |
默认不执行，不会被 bootstrap/release 自动调用 |
check |
对 bootstrap 执行 --check --diff |
只读；Docker/Compose 尚未安装时跳过版本校验 |
syntax-check |
对所有 playbook 执行 ansible-playbook --syntax-check |
用 example 清单，不连主机 |
lint |
执行 ansible-lint |
可选；提交前跑 |
What ships with it
30 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- agents/openai.yaml 448 B
- assets/infra/deploy/.ansible-lint 298 B
- assets/infra/deploy/ansible.cfg 229 B
- assets/infra/deploy/deploy_config.py 16 KB runs code
- assets/infra/deploy/deploy.sh 10 KB runs code
- assets/infra/deploy/environments/.gitignore 74 B
- assets/infra/deploy/environments/example.secrets.env 548 B
- assets/infra/deploy/environments/example.yml 3.2 KB
- assets/infra/deploy/files/backup-db.sh 2.0 KB runs code
- assets/infra/deploy/files/postgres-init.sh 2.0 KB runs code
- assets/infra/deploy/playbooks/backup-now.yml 1.2 KB
- assets/infra/deploy/playbooks/bootstrap.yml 541 B
- assets/infra/deploy/playbooks/db-init.yml 253 B
- assets/infra/deploy/playbooks/release.yml 224 B
- assets/infra/deploy/playbooks/status.yml 3.3 KB
- assets/infra/deploy/README.md 6.8 KB
- assets/infra/deploy/requirements.yml 212 B
- assets/infra/deploy/roles/app_release/defaults/main.yml 2.1 KB
- assets/infra/deploy/roles/app_release/tasks/main.yml 7.9 KB
- assets/infra/deploy/roles/app_release/templates/Caddyfile.site.j2 1.5 KB
- assets/infra/deploy/roles/db_init/defaults/main.yml 159 B
- assets/infra/deploy/roles/db_init/tasks/main.yml 3.6 KB
- assets/infra/deploy/roles/host_baseline/tasks/main.yml 9.2 KB
- assets/infra/deploy/roles/host_baseline/templates/backup.env.j2 566 B
- assets/infra/deploy/roles/host_baseline/templates/backup.service.j2 383 B
- assets/infra/deploy/roles/host_baseline/templates/backup.timer.j2 231 B
- references/cutover.md 7.0 KB
- references/design.md 8.0 KB
- references/migration-inventory.md 6.3 KB
- references/troubleshooting.md 5.8 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 226 lines · 52 tokens per session scan B 9d01b181c587
single-host-deploy is a skill published in the GitHub repository hxy91819/mason-skills (3 stars, last pushed today), licensed MIT. It adds 52 tokens to every session and 4,730 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-11-07.
single-host-deploy compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| single-host-deployhxy91819/mason-skills | Skill | 3 | today | MIT | B | 52 | Claude Code, Codex |
| deploy-akashickachofugetsu09/akashic-agent | Skill | 519 | yesterday | MIT | A | 38 | Claude Code, Codex |
| releasememgraph/ai-toolkit | Skill | 119 | yesterday | MIT | A | 35 | Claude Code, Codex |
| finding-latest-versionsSmirnov-Labs/claude-skills | Skill | 6 | yesterday | MIT | A | 87 | Claude Code, Codex |
| deployment-operationszhpeng24/devkit | Skill | 3 | 3mo ago | MIT | A | 57 | Claude Code, Codex |
| ferrogate-releaselianluo-esign/ferrogate | Skill | 31 | 1mo ago | none | A | 88 | Claude Code, Codex |
| release-and-publishcyanheads/orcid-mcp-server | Skill | 6 | 11d ago | Apache-2.0 | A | 155 | Claude Code |