前端设计

Name: 前端设计
Author: wcygan

AI 智能社区

作者仓库星标 2
作者更新于实时读取
作者仓库 anton

流狐档案事实层信息：领域、Agent、信任分、运行环境、权限与网络

领域: AI 智能
兼容 Agent: Claude Code
Cursor
Cline
Codex
Windsurf
Gemini CLI

+20
信任分: 88 / 100 · 社区维护
作者 / 版本 / 许可: @wcygan · 未声明 license
Token 消耗评级: 低消耗
接入复杂程度: 即装即用
是否需要外部 API Key: 不需要
兼容的系统: macOS
底层运行要求: 无特殊要求
文件与系统权限: 只读
允许写入 / 修改
网络行为: 仅限本地
安装命令数: 26 条

档案由构建时根据 SKILL.md 与安装命令自动衍生，可能与作者实际意图存在差异。

需要注意： 未限定 allowed-tools，默认拥有全部工具权限。

输出预览 expose-service.preview

---
name: expose-service
description: Expose a workload for access. Four paths: envoy-internal (LAN via split-horizon DNS), Tailscale…
category: AI 智能
runtime: 无特殊运行时
---

# expose-service 输出预览

## PART A: 任务判断
- 适用问题：提示词、Agent 工作流、模型评估或自动化推理。
- 输入要求：目标材料、限制条件、期望输出和验收方式。
- 证据边界：围绕“Exposure policy (ADR 0012, amended 2026-04-17) / Gateway-choice matrix / Workflow”读取原文规则，不把推断写成作者承诺。

## PART B: 执行结果
- **01** 任务判断：确认你的需求是否属于提示词、Agent 工作流、模型评估或自动化推理，并标出输入、限制和预期结果。
- **02** 执行计划：优先按“Exposure policy (ADR 0012, amended 2026-04-17) / Gateway-choice matrix / Workflow”拆成步骤，说明每一步会读取什么、修改什么、产出什么。
- **03** 交付结果：给出可复制的命令、文件改动、检查清单或内容草稿，并说明如何继续迭代。
- **04** 风险边界：结合 读取文件、写入/修改文件、主要在本地完成、通常不需要额外 API Key 给出执行前确认项。

## Running Rules
- 读取文件、写入/修改文件；主要在本地完成；通常不需要额外 API Key。
- 先小样例验证，再放大到真实任务。
- 交付时同时给结果、检查口径和下一步迭代建议。

SKILL.md SKILL.md

---
name: expose-service
description: Expose a workload for access. Four paths: envoy-internal (LAN via split-horizon DNS), Tailscale…
category: AI 智能
source: wcygan/anton
---

# expose-service

## 什么时候使用
- 把 AI / Agent方向的常用动作沉淀成 Agent 可调用的技能 适合处理AI Agent、提示词、模型评估与自动化推理，核心价值是把输入、判断、执行、验证和交付边界固定下来，避免 Agent 泛泛回答。 把任务拆成可执行、可检查…
- 面向提示词、Agent 工作流、模型评估或自动化推理，优先处理能明确输入、步骤和验收标准的工作。

## 需要提供什么
- 目标材料、目录范围、期望结果和不可改动内容。
- 是否允许联网、执行命令、读写文件或调用外部服务。

## 执行规则
- 围绕「Exposure policy (ADR 0012, amended 2026-04-17) / Gateway-choice matrix / Workflow」组织步骤，不把推断写成作者事实。
- 读取文件、写入/修改文件；主要在本地完成；通常不需要额外 API Key。
- 先跑小样例，确认结果可检查后再扩大任务范围。

## 输出要求
- 给出最终产物、关键证据、验证方式和下一步动作。
- 信息不足时标记 unknown，不编造命令、平台或依赖。

证据边界与执行链路

作者原文负责流程事实；仓库文件负责来源和命令；流狐只补充适用场景、限制和质量判断。

skill "expose-service" {
  输入层     -> 用户目标 + 目标文件 + 禁止范围 + 验收标准
  上下文层   -> Exposure policy (ADR 0012, amended 2026-04-17) / Gateway-choice matrix / Workflow
  规则层     -> SKILL.md 触发条件 / 执行顺序 / 输出格式
  运行层     -> 无特殊运行时 | 读取文件、写入/修改文件 | 主要在本地完成
  安全层     -> 通常不需要额外 API Key + 小任务验证 + diff / 日志复核
  输出层     -> 可复制结果 + 检查清单 + 下一步迭代
}

解读按原文结构重写，命令、链接、术语均保留；右侧可核对作者原始 SKILL.md

先判断是否适合

核心用途：把 AI / Agent方向的常用动作沉淀成 Agent 可调用的技能适合处理AI Agent、提示词、模型评估与自动化推理，核心价值是把输入、判断、执行、验证和交付边界固定下来，避免 Agent 泛泛回答。把任务拆成可执行、可检查、可继续迭代的步骤…
适用任务：更适合 AI Agent、提示词、模型评估与自动化推理，尤其是输入、步骤、验收口径可以反复复用的场景。
不宜硬套：如果任务只有一次性问答、来源材料很少，或需要作者没有说明的命令和外部服务，应先降级为普通对话。

作者设计意图

触发依据：使用时机、上下文收集、输出格式和失败处理共同决定它是否适合当前任务。
来源边界：作者原文负责事实，仓库文件负责命令和文件证据；Fluxly 只补充用途、限制和使用判断。

作者的方法与取舍

执行主线：任务围绕「Exposure policy (ADR 0012, amended 2026-04-17) / Gateway-choice matrix / Workflow」组织，把触发条件、必要上下文、执行规则和交付标准连成一条可复核的链路。
设计重点：重点不在重复教程，而在解释作者为什么规定这些步骤、哪些条件不可省略，以及结果偏离时应回到哪一层检查。
使用判断：先确认任务与原文边界一致，再决定是否启用；来源没有说明的命令、平台和依赖保持未知，不由 Fluxly 补写。

边界和复核

依赖条件：通常不需要额外 API Key，适合先用小任务验证触发是否稳定。
权限提醒：会涉及 read / write 权限，执行前要说明可读写范围、命令边界和回退方式。
质量标准：结果应包含明确产物、必要证据和下一步动作；如果只是泛泛解释，需要补充输入和验收条件后重跑。

Expose a service

Task skill for routing traffic to a workload. Anton has three supported access paths; architecture deep-dive lives in kubernetes/apps/network/AGENTS.md.

Exposure policy (ADR 0012, amended 2026-04-17)

Pick by who needs to reach the workload, not by what feels easiest:

LAN clients only → envoy-internal HTTPRoute. Split-horizon DNS via k8s-gateway returns the internal LB to LAN clients.
Off-LAN HTTP admin UI (browser) → Tailscale Ingress (ingressClassName: tailscale + tls.hosts: [<slug>]). The operator provisions a Let's Encrypt cert on <slug>.<tailnet>.ts.net; browsers trust it natively. Recipe A in references/tailscale.md.
Off-LAN raw TCP or non-HTTP → Tailscale Service annotation (tailscale.com/expose: "true"). No TLS termination on the proxy — clients reach whatever the backend serves on its target port. Recipe B in references/tailscale.md.
LAN clients AND off-LAN HTTP access → envoy-internal HTTPRoute plus a Tailscale Ingress for the same workload. LAN users keep the <app>.${SECRET_DOMAIN} URL; remote ops use <slug>.<tailnet>.ts.net.
Genuinely public (audience that cannot be required to join the tailnet) → envoy-external HTTPRoute + Cloudflare tunnel. Requires explicit user approval before authoring.

Do not pick envoy-external to solve "I want to reach this from my laptop off-LAN" — that is what Tailscale is for now (ADR 0012). Shipping something public and pulling it back is irreversible (cached DNS, search engines, external referrers); Tailscale is reversible.

⚠️ Throughput caveat (ADR 0012 amendment). Tailscale proxies default to userspace netstack and on v1.84+ hit upstream bug tailscale/tailscale#16198; SPA payloads over the tailnet run ~12 KB/s from a macOS peer. LAN clients are unaffected. Use Tailscale for off-LAN admin access, not for heavy data paths, until the operator ships 1.98.x. Full context in references/tailscale.md.

Gateway-choice matrix

Use case	Path	Hostname	TLS in browser?	Reaches
LAN only (default)	`envoy-internal` HTTPRoute	`<app>.${SECRET_DOMAIN}`	Yes (cert-manager)	LAN → `k8s-gateway` DNS → cluster
Off-LAN HTTP admin UI	Tailscale `Ingress` (`ingressClassName: tailscale`)	`<slug>.<tailnet>.ts.net`	Yes (Let's Encrypt via MagicDNS)	Tailnet device → operator proxy → Service
Off-LAN raw TCP / non-HTTP	Tailscale Service annotation	`<slug>.<tailnet>.ts.net`	No (TCP pass-through)	Tailnet device → operator proxy → Service
LAN + off-LAN HTTP	HTTPRoute and Tailscale `Ingress`	both above	Yes on both	either path resolves independently
Public (requires approval)	`envoy-external` HTTPRoute	`<app>.${SECRET_DOMAIN}`	Yes (Cloudflare)	Internet → Cloudflare tunnel → cluster
App on a second domain (`${SECRET_DOMAIN_TWO}`)	`envoy-external` HTTPRoute	`<app>.${SECRET_DOMAIN_TWO}`	Yes	also needs an explicit `DNSEndpoint` — see `references/secondary-domain.md`

Both envoy gateways live in namespace network. HTTPRoutes must set parentRefs[].namespace: network (cross-namespace) and sectionName: https (attach to the TLS listener, not port 80). Tailscale exposure does not use a Gateway-API HTTPRoute — it uses either a networking.k8s.io/v1 Ingress (Recipe A) or a Service annotation (Recipe B).

No bundling. Tailscale exposure changes ship on their own PR, never mixed with Cilium / gateway / CNI changes (ADR 0012).

Workflow

Confirm the path against the exposure policy above. If envoy-external is on the table, verify the user has approved public exposure before writing anything. "I want to reach it off-LAN" is a Tailscale reason, not an envoy-external reason.
Author the resource(s):
- HTTPRoute path (envoy-internal or envoy-external) — write kubernetes/apps/<ns>/<app>/app/httproute.yaml using the template in references/authoring-httproute.md, or use the chart-values variant (Workflow B) if the chart supports it (bjw-s app-template).
- Tailscale Ingress (Recipe A, HTTP admin UIs) — write an Ingress with ingressClassName: tailscale and tls.hosts: [<slug>]. Prefer the chart's own ingress.* values knob when available. Recipe: references/tailscale.md.
- Tailscale Service annotation (Recipe B, raw TCP / non-HTTP) — add tailscale.com/expose: "true" and tailscale.com/hostname: <short-slug> to the Service's annotations. Prefer the chart's service.annotations knob over a Kustomize patch. Recipe: references/tailscale.md.
- Combined (HTTPRoute + Tailscale Ingress) — do both; they are independent and don't conflict. Same-PR bundling of Tailscale work with Cilium / gateway / CNI changes is forbidden (ADR 0012).
Wire any new manifest file into kubernetes/apps/<ns>/<app>/app/kustomization.yaml. Annotation-only changes via chart values need no kustomization edit.
If the hostname is on a secondary domain (not ${SECRET_DOMAIN}), also add a DNSEndpoint resource and verify the gateway's cert listener covers the domain — see references/secondary-domain.md. Skipping this is the single most common footgun in this skill. (Does not apply to Tailscale — MagicDNS handles its own.)
Ship it. If any *.sops.* files are new, run sops -e -i <file> to encrypt. Then commit + push, and task reconcile (or wait for the Flux interval).
Verify. Run the checks in references/verify.md; for the Tailscale path, also verify as documented in references/tailscale.md.

Pre-commit checklist

Common:

Path choice matches policy (LAN-only → internal; off-LAN HTTP → Tailscale Ingress; off-LAN raw TCP → Tailscale annotation; external only when explicitly approved)
Diff contains Tailscale changes only — no Cilium / gateway / CNI edits in the same commit (ADR 0012)
No plaintext secrets: any *.sops.* files show encrypted via sops filestatus

HTTPRoute path:

parentRefs[0].name is envoy-external or envoy-internal (never a Service name)
parentRefs[0].namespace: network set (cross-namespace attach is required)
parentRefs[0].sectionName: https set (attach to TLS listener, not port 80)
backendRefs[].name matches an actual Service in the app's namespace
HTTPRoute (and DNSEndpoint, if any) listed in app/kustomization.yaml
If hostname is on ${SECRET_DOMAIN_TWO} → DNSEndpoint resource present
If a new second-domain cert was added → gateway listener's tls.certificateRefs updated

Tailscale Ingress path (Recipe A):

ingressClassName: tailscale set; no spec.rules[].host (operator reads tls.hosts)
tls.hosts[0] is a short slug (no dots, no tailnet name embedded)
defaultBackend.service points at an actual Service in the app's namespace
Ingress listed in app/kustomization.yaml (or delivered via chart ingress.* values)
No real tailnet name committed anywhere (use <tailnet-name>.ts.net placeholder in docs)

Tailscale Service annotation path (Recipe B, non-HTTP / raw TCP only):

Annotation is on the Service the chart produces, not on a wrapping resource
tailscale.com/hostname is a short slug (no dots, no tailnet name embedded)
Workload is genuinely non-HTTP — if it's a browser UI, use Recipe A instead
No real tailnet name committed anywhere

Canonical in-tree examples

Read the live manifest rather than a frozen copy:

Public, app-template inline route: values (Workflow B) → kubernetes/apps/default/echo/app/helmrelease.yaml
Internal, standalone HTTPRoute (Workflow A) → kubernetes/apps/observability/kube-prometheus-stack/app/httproute.yaml
DNSEndpoint shape (CNAME to tunnel on a secondary domain) → kubernetes/apps/network/cloudflare-tunnel/app/dnsendpoint.yaml

安装命令

一键复制安装选择包管理器,点击右侧复制,粘贴到终端回车即可

npx skills add wcygan/anton/.agents/skills/expose-service -y

查看通用安装教程

查看 Skill 原文

兼容工具

Claude Code
Cursor
Cline
Codex
Windsurf
Gemini
OpenCode
Roo Code
AAide
+Augment
GitHub Copilot
OpenClaw
KKiro
Junie
WWarp
Goose
Trae
Kilo Code
OpenHands
Amp
Zencoder
CContinue
AIAider
CodeBuddy
CodeGeeX
Replit Agent

安全审计

88 / 100

社区

未声明 license/许可。
未声明 version。
未限定 allowed-tools，默认拥有全部工具权限。

元信息

来源: github
wcygan/anton
English

@wcygan 的其他技能

分类与标签

分类 AI 智能

Reference	When to read
`references/authoring-httproute.md`	Writing the HTTPRoute YAML (Workflow A standalone, Workflow B route-in-values)
`references/secondary-domain.md`	Hostname on `${SECRET_DOMAIN_TWO}` or any non-primary domain
`references/verify.md`	After deploy, or when an HTTPRoute exists but the app is unreachable
`references/envoy-gateway.md`	Background on the in-cluster gateway controller (Gateway specs, LB IPs, policies)
`references/cloudflare-tunnel.md`	Background on the public ingress path (`cloudflared`, http2 transport, origin config)
`references/tailscale.md`	What Tailscale does — and does not — do in this cluster

前端设计

先判断是否适合

作者设计意图

作者的方法与取舍

边界和复核

Expose a service

Exposure policy (ADR 0012, amended 2026-04-17)

Gateway-choice matrix

Workflow

Pre-commit checklist

Canonical in-tree examples

Further reading

讨论

先判断是否适合

作者设计意图

作者的方法与取舍

边界和复核

Expose a service

Exposure policy (ADR 0012, amended 2026-04-17)

Gateway-choice matrix

Workflow

Pre-commit checklist

Canonical in-tree examples

Further reading

Related skills

讨论