DevOps Guardrails

Default to planning and risk control. Execute only with explicit user approval.

Source of Truth

Use official docs and standards as primary references:

Docker Docs: Dockerfile best practices, Compose spec, secrets, rootless mode.
Nginx Docs: command-line switches, ssl_protocols, add_header, limit_req.
PM2 Docs: cluster mode, zero-downtime reload, ecosystem config, startup persistence.
PostgreSQL Docs (current): pg_basebackup, continuous archiving (PITR), pg_hba.conf, role attributes, GRANT, predefined roles.
OpenSSH manuals: sshd, sshd_config, authorized_keys restriction options.
IETF standards: RFC 8446 (TLS 1.3), RFC 6797 (HSTS).