vps-deploylisted

# VPS deploy skill Takes a service that runs locally and puts it on a VPS at `https://<domain>`, then leaves the project with one command that redeploys it. The end state: - The app runs under **systemd** as a dedicated non-login user, restarted on failure and started on boot. - **Caddy** terminates TLS and reverse-proxies to it on loopback. Certificates are issued and renewed automatically. - Releases live in `/opt/<app>/releases/<rev>` with a `current` symlink. Deploy is a symlink swap plus a restart; **rollback is the same swap backwards**. - A failed health check **rolls back automatically** — a bad build costs a restart, not an outage. - `./scripts/deploy.sh` provisions a host that has never been deployed to, and deploys to one that has. Same command either way. ## The one rule that matters **Never build on the VPS.** A small box has under a gigabyte of free memory and usually shares it with things already serving traffic. Build on the workstation or in CI, ship the artifact. Every step below assumes this. ## Phase 1 — collect what cannot be guessed Ask for these together, in one message, and do not proceed without them. Never invent a value here. 1. **SSH target** — `user@host`. The account needs `sudo`. Confirm it works: `ssh <target> 'echo ok; sudo -n true 2>&1 | head -1'` 2. **Domain** — the public hostname, e.g. `api.example.com`. 3. **DNS control** — who runs the zone, and whether they can give you an API token. See `reference/dns.md`. **Thi