Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+21 moreClaude CodeCursorCodex CLIMuseDots
Manus
Grok
Grok Bot+18 agentsAgency Ops Stack — Self-Hosted Agency Operating System
Organize self-hosted agency services into a secure, documented operating system with maintenance retainer models.
$38.99
Agency Ops Stack — Self-Hosted Agency Operating System
Example session with this skill installed
I have a VPS running Nginx, a Ghost blog for a client, a private Directus instance, and a Postgres DB. Help me organize this into a secure agency stack with a maintenance retainer plan.
- Read your context and instructions
- Compiled the agency ops stack
I have audited your current VPS setup. The primary risks identified are the co-location of the private Directus instance with the public blog and the potential exposure of the Postgres port.
Agency Operational Stack Detail
| Service | Internal Port | Public Domain | Exposure | Auth Type | Backup Policy |
|---|---|---|---|---|---|
| Nginx | 80/443 | - | Public | TLS/None | Config Only |
| Ghost Blog | 2368 | blog.client.com | Public | App Level | Daily DB + Content |
| Directus | 8055 | cms.agency.int | Internal/VPN | OIDC/Static | Daily DB |
| Postgres | 5432 | None | Private | Secret Key | Point-in-time |
Security & Environment Review
- Postgres Exposure: Port 5432 must be restricted to the Docker bridge network or localhost. No public IP binding.
Directus Access: Recommend moving the CMS behind a WireGuard VPN or Tailscale rather than public DNS to protect internal agency data.
3.
Isolation: Create separate system users for the Ghost process and the Postgres engine to prevent cross-service lateral movement.
Maintenance Retainer Tiers
Tier 1: Core Maintenance ($250/mo)
- Monthly security patching for Nginx and OS.
- Weekly automated backups (7-day retention).
- Email support (48-hour response).
- Exclusions: Feature updates, content migration, emergency recovery.
Tier 2: Managed Ops ($750/mo)
- Weekly patching and uptime monitoring.
- Daily backups (30-day retention) with monthly restore test.
- Priority support (12-hour response).
- Exclusions: Major version upgrades, custom development.
Implementation Roadmap
- Phase 1 (Immediate): Firewalled Postgres port and configured UFW rules.
- Phase 2 (Documentation): Finalize the client onboarding checklist and data handling policy.
- Phase 3 (Scaling): Set up automated health checks for the Ghost service endpoint.
Next steps
- Provide your backup storage destination (S3/Local) to define the restore procedures.
- Confirm if the Directus instance requires public access for external collaborators.
- Review the Tier 2 response windows to ensure they align with your team's availability.
Connects securely to your tools. The creator never sees your data.
About this skill
Managing a self-hosted agency infrastructure often leads to undocumented port conflicts, security leaks, and vague service agreements. This skill audits your service stack to organize domain mappings, security policies, and client environments into a professional operating system.
What it does
- Service Inventorying catalogs every tool by purpose, host, port, and exposure status to prevent configuration drift.
- Exposure Mapping identifies internal-only ports versus public endpoints to ensure reverse proxies and TLS are correctly applied.
- Client Isolation maps services to specific environments using least-privilege access and unique credentials.
- Maintenance Planning defines backup routines, health checks, and update cadences for every layer of the stack.
- Retainer Structuring builds tiered service models with explicit deliverables, response windows, and support exclusions.
How it works
- Stack Audit provides a full inventory of services, ports, and public domains.
- Security Review evaluates exposure risks and suggests hardening for admin dashboards and databases.
- Operational Documentation generates checklists for onboarding, backups, and disaster recovery.
- Business Alignment maps the technical stack to retainer tiers and client-facing service limits.
Frameworks & tools
Works with any self-hosted infrastructure including Docker, Kubernetes, Nginx, Traefik, and standard Linux environments. It focuses on the orchestration and documentation layer rather than specific provider APIs.
Why this beats prompting it yourself
Generic prompts often overlook critical security risks like exposed container sockets or database ports. This skill enforces a strict least-privilege framework and ensures that technical configurations directly support your business's retainer models and client SLAs.
Use cases
- Documenting a complex Docker-based agency stack for a new DevOps hire.
- Auditing public-facing endpoints to ensure no admin panels are exposed.
- Building a technical roadmap for migrating clients to isolated environments.
- Defining exactly what is included in "Basic" vs "Premium" maintenance retainers.
Known limitations
Does not execute live infrastructure changes or verify uptime. It provides documentation and configuration templates that must be manually validated and deployed by the user.
Does not perform live connectivity tests or automated deployments. Retainer pricing logic is for planning only and does not guarantee profitability.
How to use
- 1
Connect your agent to the Agensi MCP
Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup
- 2
Sign in to Agensi
Your agent shows a sign-in link. Sign in and click Allow.
- 3
Ask for what you need
Your agent loads this skill and uses it on your task. It always asks before any payment.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill goes through the trust checks below.
Security scanned
Checked by our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scan
Security scan passed 24 days ago