GREEN PACKAGE SKILL · DIGITALOCEAN · TRANSMISSION

alice

One temporary DigitalOcean Droplet running Transmission, with a managed local SSH alias, a loopback-only web UI, and a guarded workflow that copies completed downloads home before destruction.

Private by construction. Transmission RPC binds to 127.0.0.1. Reach it through an SSH local forward; never publish the RPC port.

Quick start

npx skills add getcolors/alice
cp .agents/skills/package-alice-green/green ./green
chmod +x green
./green validate
./green build
./green create --dry-run

validate reports desired-state, local tool, credential-presence, and DigitalOcean authentication failures together. Build and dry-run require no credentials and perform no provider side effects. A real create, sync, or delete requires explicit authorization.

Architecture

Infrastructure

OpenTofu creates one Ubuntu 24.04 Droplet on the configured existing DigitalOcean VPC. The cloud firewall permits SSH and Transmission peer traffic; RPC remains private.

Private UI

Transmission listens on loopback. RPC password authentication is intentionally disabled because the SSH key and local tunnel form the access boundary.

Local integration

A managed SSH config block gives the Droplet a stable local alias. Create opens a short-lived forward and curls the web UI before reporting success.

Data path

Desired public magnets download to the Droplet, then rsync copies their content directly into the configured local destination over SSH.

Ubuntu 24.04’s packaged Transmission AppArmor profile cannot use systemd’s disconnected notification socket. The package disables that broken profile and verifies it is unloaded so systemd can supervise Transmission reliably.

Workflows

create   encrypted SSH → [registration + compute | scoped agent] → local SSH → Transmission → acceptance
sync     create → tunnel → magnets → incremental rsync → final checksum → delete
delete   start → remove local SSH alias → authorized infrastructure → cleanup
validate state + tools + credential presence + DigitalOcean authentication
describe local alias + SSH reachability + Transmission service status

Create is convergent: rerun it to repair the existing Droplet. describe is the safe first diagnostic, and tunnel 19091 keeps a foreground local forward open. While it runs, open http://127.0.0.1:19091/transmission/web/.

Desired state

DigitalOcean

Name, region, size, image, an existing VPC UUID, firewall sources, and a separately owned public-key registration.

Transmission

Desired public magnet links, RPC port, tunnel port, remote download location, and the direct local destination.

State

A local, S3, or R2 OpenTofu backend stores package-specific stage keys under the selected profile.

Credentials

COLORS_PAR_DO_TOKEN and optional backend credentials stay in the process environment and never render.

See the configuration reference for every supported key.

Safe synchronization

./green sync provisions or resumes the deployment, keeps the tunnel URL available, adds every desired magnet, and incrementally copies completed data. Once every torrent is complete, it stops Transmission and performs a final checksummed copy. Only a successful final copy authorizes automatic destruction.

If a download, tunnel, checksum, or copy fails, Alice retains the Droplet and state so the operation can resume. It does not interpret partial progress as permission to destroy the remote copy.

Deletion has an unusual boundary. Alice deliberately ignores COLORS_PAR_COMPUTE_PREVENT_DESTROY. An explicit delete, or a successful sync after its final checksummed transfer, is the authorization to destroy compute.

Safety and recovery

Never export COLORS_PAR_PROFILE.
Keep compute-prevent-destroy: true in committed desired state.
Never edit, read as source, or commit generated .colors/.
Keep the local state until deletion completes; recover or import lost state before destroying anything.
Do not run real create, sync, or delete without explicit authorization.

If Transmission is unhealthy, run ./green describe, then inspect systemctl status transmission-daemon and its journal over the managed SSH alias. Preserve both local and remote copies while diagnosing an incomplete sync.

Development and source

bb test
bb golden
./scripts/launcher.sh

Tests do not provision resources. Inspect generated and golden diffs before accepting them. The deployment launcher and installed Package Skill launcher are copies and must be re-synchronized after updates.

Source on GitHub · MIT licensed.