d4eafeb38e
No server-side credential may cross the server boundary to the client. The only credentials that cross are the client's own identity (MFA, OIDC, etc.). Covers: proxy + identity mapping pattern, defense in depth layers, anti-patterns (browser tokens, shared service accounts, embedded keys), presigned URL exception for direct uploads, CMS real-world example. Extracted from hugo-accelerator M4 where this principle drove the CMS proxy architecture (Authelia + per-user Gitea tokens server-side). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
30 lines
3.0 KiB
Markdown
30 lines
3.0 KiB
Markdown
> **Note:** Best practices are now maintained in [skynet/best-practices](https://gitea.oreillyit.nz/skynet/best-practices).
|
|
> AI agents with /best-practices mounted should read /best-practices/INDEX.md instead.
|
|
> The content below is kept as a local copy for context-load compatibility.
|
|
|
|
# Best Practices Index
|
|
|
|
Generalised best practices extracted from real project work. Each topic file is self-contained — read only the files relevant to the current project.
|
|
|
|
## Topics
|
|
|
|
- [Validation & Deployment](best-practices/validation.md) — Validate locally, deploy once; full-chain testing; pre-flight checks
|
|
- [Security Architecture](best-practices/security-architecture.md) — Server boundary rule: no credential crosses to the client; proxy + identity mapping pattern; defense in depth; anti-patterns
|
|
- [Secrets Management](best-practices/secrets-management.md) — SOPS + age, credential handling, file naming, encryption gotchas
|
|
- [Git & Source Control](best-practices/git-source-control.md) — Commit practices, GitOps workflows, remote conventions
|
|
- [Kubernetes Patterns](best-practices/kubernetes.md) — Volume mounts, deployment strategies, naming, bootstrap ordering
|
|
- [Helm Charts](best-practices/helm.md) — Schema validation, version verification, values structure
|
|
- [Ansible](best-practices/ansible.md) — Inventory, templates, idempotency, credential safety
|
|
- [Scripting](best-practices/scripting.md) — Shell conventions, verification scripts, idempotency, colour output
|
|
- [Documentation Standards](best-practices/documentation.md) — CLAUDE.md, MEMORY.md, FUTURE.md, README.md structure and tiered memory
|
|
- [Milestones & Reflections](best-practices/milestones.md) — Milestone workflow, verification, reflection process
|
|
- [Debugging Methodology](best-practices/debugging.md) — Systematic diagnosis, full-chain testing, common pitfalls
|
|
- [Claude Code Skills](best-practices/skills-development.md) — Skill authoring, context injection, tool restrictions
|
|
- [Linting & Formatting](best-practices/linting.md) — Tool choices per language, PostToolUse hook, pre-commit integration, formatter contract
|
|
- [Spec-Driven Development](best-practices/spec-driven-development.md) — Spec structure, requirement numbering, test-first workflow, context tiers, anti-patterns
|
|
- [Test-Driven Development](best-practices/test-driven-development.md) — Edge case discovery, property-based testing, mutation testing, AI agent testing patterns, test architecture
|
|
- [Networking & Infrastructure](best-practices/networking.md) — nftables safety, systemd socket activation, Docker forwarding, TLS SNI vs Host header, wildcard certs
|
|
- [Docker UID Matching](best-practices/docker-uid-matching.md) — UID wrapper entrypoint for mounted volumes, gosu pattern, when to use vs K8s securityContext
|
|
- [Octopus Process Templates](best-practices/octopus-process-templates.md) — OCL syntax, step template references, channel scoping, parameters, versioning, Platform Hub patterns
|
|
- [Platform Hub Knowledge Base](PLATFORMHUB.md) — Comprehensive guide: architecture, OCL syntax, template patterns, gotchas, API reference
|