[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF508X8XR5JAS799REFQKW":3,"skill-same:01M6AF508X8XR5JAS799REFQKW":77},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":48,"linkOnly":49,"markdownContent":50,"markdownBody":51,"frontMatter":52,"refName":53,"commitSha":54,"skillDirectory":55,"forksCount":56,"repositoryHtmlUrl":57,"repositoryHomepageUrl":58,"ownerHtmlUrl":59,"ownerBlogUrl":60,"ownerDescription":61,"updatedAt":62,"install":63,"resources":76},"01M6AF508X8XR5JAS799REFQKW","pb-deploy",null,"Production deployment for PocketBase. Use when deploying PocketBase to a server, setting up Docker, configuring systemd, reverse proxy (nginx\u002FCaddy), TLS, SMTP, backups, S3 storage, rate limiting, or hardening for production. Provides ready-to-use configs.","davila7\u002Fclaude-code-templates","davila7","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6216945?v=4","01M6ADEWWFPS191NFM0Y1EX1JH","Daniel Avila","01M6ADJHGM78PHQRD3XZTFDVKK",33332,"MIT","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fpocketbase\u002Fpb-deploy\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47],"deploy","pb deploy","when","docker","rate","for","reverse","smtp","caddy","s3 storage","pocketbase","up","ready","use","tls","Production","hardening","systemd","nginx","s3","server","proxy","deployment","storage","2026-11-10 10:12:30",false,"---\nname: pb-deploy\ndescription: \"Production deployment for PocketBase. Use when deploying PocketBase to a server, setting up Docker, configuring systemd, reverse proxy (nginx\u002FCaddy), TLS, SMTP, backups, S3 storage, rate limiting, or hardening for production. Provides ready-to-use configs.\"\n---\n\n# PocketBase Production Deployment\n\n## Single Binary Deployment\n\nPocketBase is a single binary. No runtime dependencies.\n\n```bash\n# Download\nwget https:\u002F\u002Fgithub.com\u002Fpocketbase\u002Fpocketbase\u002Freleases\u002Fdownload\u002Fv0.X.X\u002Fpocketbase_0.X.X_linux_amd64.zip\nunzip pocketbase_*.zip\nchmod +x pocketbase\n\n# Run\n.\u002Fpocketbase serve --http=\"0.0.0.0:8090\"\n```\n\nData stored in `pb_data\u002F` (SQLite DB, uploaded files, logs).\n\n## systemd Service\n\n```ini\n# \u002Fetc\u002Fsystemd\u002Fsystem\u002Fpocketbase.service\n[Unit]\nDescription=PocketBase\nAfter=network.target\n\n[Service]\nType=simple\nUser=pocketbase\nGroup=pocketbase\nLimitNOFILE=4096\nRestart=always\nRestartSec=5s\nWorkingDirectory=\u002Fopt\u002Fpocketbase\nExecStart=\u002Fopt\u002Fpocketbase\u002Fpocketbase serve --http=\"127.0.0.1:8090\"\n\n# Security hardening\nNoNewPrivileges=true\nProtectSystem=strict\nProtectHome=true\nReadWritePaths=\u002Fopt\u002Fpocketbase\u002Fpb_data \u002Fopt\u002Fpocketbase\u002Fpb_hooks \u002Fopt\u002Fpocketbase\u002Fpb_migrations\nPrivateTmp=true\n\n# Memory limit (adjust to your server)\n# MemoryMax=512M\n\n[Install]\nWantedBy=multi-user.target\n```\n\n```bash\n# Setup\nsudo useradd --system --no-create-home pocketbase\nsudo mkdir -p \u002Fopt\u002Fpocketbase\nsudo cp pocketbase \u002Fopt\u002Fpocketbase\u002F\nsudo chown -R pocketbase:pocketbase \u002Fopt\u002Fpocketbase\n\n# Enable & start\nsudo systemctl daemon-reload\nsudo systemctl enable pocketbase\nsudo systemctl start pocketbase\nsudo systemctl status pocketbase\n\n# Logs\nsudo journalctl -u pocketbase -f\n```\n\n### File descriptor limit\n\nFor high-traffic deployments, increase the limit:\n\n```ini\n# In the [Service] section:\nLimitNOFILE=65535\n```\n\nAlso set system-wide in `\u002Fetc\u002Fsecurity\u002Flimits.conf`:\n```\npocketbase soft nofile 65535\npocketbase hard nofile 65535\n```\n\n### Go memory limit\n\nFor constrained environments:\n\n```ini\nEnvironment=GOMEMLIMIT=400MiB\n```\n\n## Docker\n\n### Dockerfile\n\n```dockerfile\nFROM alpine:latest\n\nARG PB_VERSION=0.25.0\n\nRUN apk add --no-cache \\\n    unzip \\\n    ca-certificates\n\n# Download and install PocketBase\n# NOTE: verify the checksum in production — see https:\u002F\u002Fgithub.com\u002Fpocketbase\u002Fpocketbase\u002Freleases\nADD https:\u002F\u002Fgithub.com\u002Fpocketbase\u002Fpocketbase\u002Freleases\u002Fdownload\u002Fv${PB_VERSION}\u002Fpocketbase_${PB_VERSION}_linux_amd64.zip \u002Ftmp\u002Fpb.zip\nRUN unzip \u002Ftmp\u002Fpb.zip -d \u002Fpb\u002F && rm \u002Ftmp\u002Fpb.zip\n\n# Copy hooks and migrations\nCOPY .\u002Fpb_hooks \u002Fpb\u002Fpb_hooks\nCOPY .\u002Fpb_migrations \u002Fpb\u002Fpb_migrations\n\nEXPOSE 8090\n\nCMD [\"\u002Fpb\u002Fpocketbase\", \"serve\", \"--http=0.0.0.0:8090\"]\n```\n\n### docker-compose.yml\n\n```yaml\nservices:\n  pocketbase:\n    build: .\n    ports:\n      - \"127.0.0.1:8090:8090\"  # bind to localhost only — expose via reverse proxy\n    volumes:\n      - pb_data:\u002Fpb\u002Fpb_data\n      - .\u002Fpb_hooks:\u002Fpb\u002Fpb_hooks\n      - .\u002Fpb_migrations:\u002Fpb\u002Fpb_migrations\n    restart: unless-stopped\n    healthcheck:\n      test: [\"CMD\", \"wget\", \"--no-verbose\", \"--tries=1\", \"--spider\", \"http:\u002F\u002Flocalhost:8090\u002Fapi\u002Fhealth\"]\n      interval: 30s\n      timeout: 5s\n      retries: 3\n\nvolumes:\n  pb_data:\n```\n\n## Reverse Proxy\n\n### Caddy (recommended — auto TLS)\n\n```\n# \u002Fetc\u002Fcaddy\u002FCaddyfile\nmyapp.com {\n    reverse_proxy localhost:8090\n}\n```\n\nThat's it. Caddy handles TLS certificates automatically via Let's Encrypt.\n\n### nginx\n\n```nginx\n# \u002Fetc\u002Fnginx\u002Fsites-available\u002Fpocketbase\nserver {\n    listen 80;\n    server_name myapp.com;\n    return 301 https:\u002F\u002F$server_name$request_uri;\n}\n\nserver {\n    listen 443 ssl http2;\n    server_name myapp.com;\n\n    ssl_certificate \u002Fetc\u002Fletsencrypt\u002Flive\u002Fmyapp.com\u002Ffullchain.pem;\n    ssl_certificate_key \u002Fetc\u002Fletsencrypt\u002Flive\u002Fmyapp.com\u002Fprivkey.pem;\n    ssl_protocols TLSv1.2 TLSv1.3;\n    ssl_ciphers HIGH:!aNULL:!MD5;\n\n    client_max_body_size 50M;\n\n    # Block public access to the admin dashboard\n    location \u002F_\u002F {\n        return 403;\n    }\n\n    location \u002F {\n        proxy_pass http:\u002F\u002F127.0.0.1:8090;\n        proxy_http_version 1.1;\n        proxy_set_header Upgrade $http_upgrade;\n        proxy_set_header Connection \"upgrade\";\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n        proxy_set_header X-Forwarded-Proto $scheme;\n\n        # SSE support for realtime\n        proxy_buffering off;\n        proxy_cache off;\n        proxy_read_timeout 3600s;\n    }\n}\n```\n\n**Critical for realtime**: `proxy_buffering off` and `proxy_read_timeout` must be set for SSE subscriptions to work.\n\n```bash\n# Let's Encrypt with nginx\nsudo apt install certbot python3-certbot-nginx\nsudo certbot --nginx -d myapp.com\n```\n\n## SMTP Configuration\n\nConfigure in Dashboard > Settings > Mail settings, or via hooks:\n\n```js\n\u002F\u002F pb_hooks\u002Fsettings.pb.js\nonBootstrap(function(e) {\n    var settings = e.app.settings()\n    settings.smtp.enabled = true\n    settings.smtp.host = $os.getenv(\"SMTP_HOST\")\n    settings.smtp.port = parseInt($os.getenv(\"SMTP_PORT\") || \"587\")\n    settings.smtp.username = $os.getenv(\"SMTP_USER\")\n    settings.smtp.password = $os.getenv(\"SMTP_PASS\")\n    settings.smtp.tls = true  \u002F\u002F STARTTLS\n    \u002F\u002F settings.smtp.authMethod = \"PLAIN\"  \u002F\u002F or \"LOGIN\"\n    settings.meta.senderName = \"My App\"\n    settings.meta.senderAddress = \"noreply@myapp.com\"\n    e.app.save(settings)\n    return e.next()\n})\n```\n\n## Security Hardening\n\n### Superuser MFA\n\nAlways enable MFA for superuser accounts in production:\nDashboard > Superusers > Auth options > MFA > Enable\n\n### Settings encryption key\n\nEncrypt sensitive settings (SMTP passwords, S3 keys) at rest:\n\n```bash\n.\u002Fpocketbase serve --encryptionEnv=PB_ENCRYPTION_KEY\n```\n\nSet `PB_ENCRYPTION_KEY` environment variable to a 32+ character random string. Once set, settings are encrypted in the DB. **Do not lose this key** — you won't be able to decrypt settings without it.\n\n### Rate limiting\n\nBuilt-in rate limiter (enabled by default). Configure in Dashboard > Settings > Rate limits, or:\n\n```js\nsettings.rateLimits.enabled = true\nsettings.rateLimits.rules = [\n    { label: \"*:auth*\", maxRequests: 10, duration: 300 },  \u002F\u002F 10 auth attempts per 5 min\n    { label: \"POST:\u002Fapi\u002Fcollections\u002F*\u002Frecords\", maxRequests: 50, duration: 60 },\n]\n```\n\n### Hide the Dashboard in production\n\n```bash\n.\u002Fpocketbase serve --http=\"127.0.0.1:8090\"  # bind to localhost only\n```\n\nAccess the dashboard only via SSH tunnel:\n```bash\nssh -L 8090:127.0.0.1:8090 user@server\n```\n\n## S3 Storage\n\nFor file uploads, offload to S3-compatible storage:\n\nDashboard > Settings > Files storage > S3\n\n```js\n\u002F\u002F Or via hooks:\nonBootstrap(function(e) {\n    var settings = e.app.settings()\n    settings.s3.enabled = true\n    settings.s3.bucket = $os.getenv(\"S3_BUCKET\")\n    settings.s3.region = $os.getenv(\"S3_REGION\")\n    settings.s3.endpoint = $os.getenv(\"S3_ENDPOINT\")\n    settings.s3.accessKey = $os.getenv(\"S3_ACCESS_KEY\")\n    settings.s3.secret = $os.getenv(\"S3_SECRET\")\n    settings.s3.forcePathStyle = true  \u002F\u002F for MinIO\u002FBackblaze\n    e.app.save(settings)\n    return e.next()\n})\n```\n\nCompatible providers: AWS S3, Backblaze B2, Cloudflare R2, MinIO, DigitalOcean Spaces, Wasabi.\n\n## Backups\n\n### Small databases (\u003C 1GB)\n\nUse the built-in backup feature:\n- Dashboard > Settings > Backups\n- Or via API: `POST \u002Fapi\u002Fbackups`\n- Auto-schedule: configure cron in Dashboard\n\n### Large databases\n\nThe Dashboard backup uses SQLite's online backup API (locks DB briefly). For large DBs, use:\n\n```bash\n# sqlite3 .backup command (hot backup, minimal locking)\nsqlite3 \u002Fopt\u002Fpocketbase\u002Fpb_data\u002Fdata.db \".backup '\u002Ftmp\u002Fbackup.db'\"\n\n# Then rsync to remote\nrsync -avz \u002Ftmp\u002Fbackup.db backup-server:\u002Fbackups\u002Fpocketbase\u002Fdata-$(date +%Y%m%d).db\n```\n\n**Never copy the `.db` file directly** while PocketBase is running — it may be in an inconsistent state.\n\n### Backup script\n\n```bash\n#!\u002Fbin\u002Fbash\n# \u002Fopt\u002Fpocketbase\u002Fbackup.sh\nset -euo pipefail\n\nBACKUP_DIR=\"\u002Fbackups\u002Fpocketbase\"\nDB_PATH=\"\u002Fopt\u002Fpocketbase\u002Fpb_data\u002Fdata.db\"\nDATE=$(date +%Y%m%d_%H%M%S)\n\nmkdir -p \"$BACKUP_DIR\"\n\n# Hot backup\nsqlite3 \"$DB_PATH\" \".backup '${BACKUP_DIR}\u002Fdata_${DATE}.db'\"\n\n# Also backup pb_data files (uploads, if not using S3)\ntar -czf \"${BACKUP_DIR}\u002Fpb_data_${DATE}.tar.gz\" -C \u002Fopt\u002Fpocketbase pb_data --exclude='pb_data\u002Fdata.db*'\n\n# Retain last 30 days\nfind \"$BACKUP_DIR\" -name \"data_*.db\" -mtime +30 -delete\nfind \"$BACKUP_DIR\" -name \"pb_data_*.tar.gz\" -mtime +30 -delete\n```\n\n```bash\n# Crontab: daily at 2 AM\n0 2 * * * \u002Fopt\u002Fpocketbase\u002Fbackup.sh >> \u002Fvar\u002Flog\u002Fpocketbase-backup.log 2>&1\n```\n\n## Health Check\n\n```bash\ncurl http:\u002F\u002Flocalhost:8090\u002Fapi\u002Fhealth\n# {\"code\":200,\"message\":\"API is healthy.\"}\n```\n\n## Deployment Checklist\n\n1. **Binary**: correct architecture (linux_amd64 \u002F linux_arm64)\n2. **systemd**: service enabled, LimitNOFILE set\n3. **Reverse proxy**: Caddy or nginx with TLS, proxy_buffering off for SSE\n4. **SMTP**: configured and tested (send a test verification email)\n5. **Superuser**: strong password + MFA enabled\n6. **Encryption key**: `--encryptionEnv` set for sensitive settings\n7. **Backups**: automated daily, tested restore procedure\n8. **Rate limiting**: enabled with sane defaults\n9. **File storage**: S3 configured if expecting many uploads\n10. **Monitoring**: health check endpoint monitored, journalctl logs reviewed\n11. **Firewall**: only 80\u002F443 exposed, 8090 bound to localhost\n12. **GOMEMLIMIT**: set if on constrained VPS\n","# PocketBase Production Deployment\n\n## Single Binary Deployment\n\nPocketBase is a single binary. No runtime dependencies.\n\n```bash\n# Download\nwget https:\u002F\u002Fgithub.com\u002Fpocketbase\u002Fpocketbase\u002Freleases\u002Fdownload\u002Fv0.X.X\u002Fpocketbase_0.X.X_linux_amd64.zip\nunzip pocketbase_*.zip\nchmod +x pocketbase\n\n# Run\n.\u002Fpocketbase serve --http=\"0.0.0.0:8090\"\n```\n\nData stored in `pb_data\u002F` (SQLite DB, uploaded files, logs).\n\n## systemd Service\n\n```ini\n# \u002Fetc\u002Fsystemd\u002Fsystem\u002Fpocketbase.service\n[Unit]\nDescription=PocketBase\nAfter=network.target\n\n[Service]\nType=simple\nUser=pocketbase\nGroup=pocketbase\nLimitNOFILE=4096\nRestart=always\nRestartSec=5s\nWorkingDirectory=\u002Fopt\u002Fpocketbase\nExecStart=\u002Fopt\u002Fpocketbase\u002Fpocketbase serve --http=\"127.0.0.1:8090\"\n\n# Security hardening\nNoNewPrivileges=true\nProtectSystem=strict\nProtectHome=true\nReadWritePaths=\u002Fopt\u002Fpocketbase\u002Fpb_data \u002Fopt\u002Fpocketbase\u002Fpb_hooks \u002Fopt\u002Fpocketbase\u002Fpb_migrations\nPrivateTmp=true\n\n# Memory limit (adjust to your server)\n# MemoryMax=512M\n\n[Install]\nWantedBy=multi-user.target\n```\n\n```bash\n# Setup\nsudo useradd --system --no-create-home pocketbase\nsudo mkdir -p \u002Fopt\u002Fpocketbase\nsudo cp pocketbase \u002Fopt\u002Fpocketbase\u002F\nsudo chown -R pocketbase:pocketbase \u002Fopt\u002Fpocketbase\n\n# Enable & start\nsudo systemctl daemon-reload\nsudo systemctl enable pocketbase\nsudo systemctl start pocketbase\nsudo systemctl status pocketbase\n\n# Logs\nsudo journalctl -u pocketbase -f\n```\n\n### File descriptor limit\n\nFor high-traffic deployments, increase the limit:\n\n```ini\n# In the [Service] section:\nLimitNOFILE=65535\n```\n\nAlso set system-wide in `\u002Fetc\u002Fsecurity\u002Flimits.conf`:\n```\npocketbase soft nofile 65535\npocketbase hard nofile 65535\n```\n\n### Go memory limit\n\nFor constrained environments:\n\n```ini\nEnvironment=GOMEMLIMIT=400MiB\n```\n\n## Docker\n\n### Dockerfile\n\n```dockerfile\nFROM alpine:latest\n\nARG PB_VERSION=0.25.0\n\nRUN apk add --no-cache \\\n    unzip \\\n    ca-certificates\n\n# Download and install PocketBase\n# NOTE: verify the checksum in production — see https:\u002F\u002Fgithub.com\u002Fpocketbase\u002Fpocketbase\u002Freleases\nADD https:\u002F\u002Fgithub.com\u002Fpocketbase\u002Fpocketbase\u002Freleases\u002Fdownload\u002Fv${PB_VERSION}\u002Fpocketbase_${PB_VERSION}_linux_amd64.zip \u002Ftmp\u002Fpb.zip\nRUN unzip \u002Ftmp\u002Fpb.zip -d \u002Fpb\u002F && rm \u002Ftmp\u002Fpb.zip\n\n# Copy hooks and migrations\nCOPY .\u002Fpb_hooks \u002Fpb\u002Fpb_hooks\nCOPY .\u002Fpb_migrations \u002Fpb\u002Fpb_migrations\n\nEXPOSE 8090\n\nCMD [\"\u002Fpb\u002Fpocketbase\", \"serve\", \"--http=0.0.0.0:8090\"]\n```\n\n### docker-compose.yml\n\n```yaml\nservices:\n  pocketbase:\n    build: .\n    ports:\n      - \"127.0.0.1:8090:8090\"  # bind to localhost only — expose via reverse proxy\n    volumes:\n      - pb_data:\u002Fpb\u002Fpb_data\n      - .\u002Fpb_hooks:\u002Fpb\u002Fpb_hooks\n      - .\u002Fpb_migrations:\u002Fpb\u002Fpb_migrations\n    restart: unless-stopped\n    healthcheck:\n      test: [\"CMD\", \"wget\", \"--no-verbose\", \"--tries=1\", \"--spider\", \"http:\u002F\u002Flocalhost:8090\u002Fapi\u002Fhealth\"]\n      interval: 30s\n      timeout: 5s\n      retries: 3\n\nvolumes:\n  pb_data:\n```\n\n## Reverse Proxy\n\n### Caddy (recommended — auto TLS)\n\n```\n# \u002Fetc\u002Fcaddy\u002FCaddyfile\nmyapp.com {\n    reverse_proxy localhost:8090\n}\n```\n\nThat's it. Caddy handles TLS certificates automatically via Let's Encrypt.\n\n### nginx\n\n```nginx\n# \u002Fetc\u002Fnginx\u002Fsites-available\u002Fpocketbase\nserver {\n    listen 80;\n    server_name myapp.com;\n    return 301 https:\u002F\u002F$server_name$request_uri;\n}\n\nserver {\n    listen 443 ssl http2;\n    server_name myapp.com;\n\n    ssl_certificate \u002Fetc\u002Fletsencrypt\u002Flive\u002Fmyapp.com\u002Ffullchain.pem;\n    ssl_certificate_key \u002Fetc\u002Fletsencrypt\u002Flive\u002Fmyapp.com\u002Fprivkey.pem;\n    ssl_protocols TLSv1.2 TLSv1.3;\n    ssl_ciphers HIGH:!aNULL:!MD5;\n\n    client_max_body_size 50M;\n\n    # Block public access to the admin dashboard\n    location \u002F_\u002F {\n        return 403;\n    }\n\n    location \u002F {\n        proxy_pass http:\u002F\u002F127.0.0.1:8090;\n        proxy_http_version 1.1;\n        proxy_set_header Upgrade $http_upgrade;\n        proxy_set_header Connection \"upgrade\";\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n        proxy_set_header X-Forwarded-Proto $scheme;\n\n        # SSE support for realtime\n        proxy_buffering off;\n        proxy_cache off;\n        proxy_read_timeout 3600s;\n    }\n}\n```\n\n**Critical for realtime**: `proxy_buffering off` and `proxy_read_timeout` must be set for SSE subscriptions to work.\n\n```bash\n# Let's Encrypt with nginx\nsudo apt install certbot python3-certbot-nginx\nsudo certbot --nginx -d myapp.com\n```\n\n## SMTP Configuration\n\nConfigure in Dashboard > Settings > Mail settings, or via hooks:\n\n```js\n\u002F\u002F pb_hooks\u002Fsettings.pb.js\nonBootstrap(function(e) {\n    var settings = e.app.settings()\n    settings.smtp.enabled = true\n    settings.smtp.host = $os.getenv(\"SMTP_HOST\")\n    settings.smtp.port = parseInt($os.getenv(\"SMTP_PORT\") || \"587\")\n    settings.smtp.username = $os.getenv(\"SMTP_USER\")\n    settings.smtp.password = $os.getenv(\"SMTP_PASS\")\n    settings.smtp.tls = true  \u002F\u002F STARTTLS\n    \u002F\u002F settings.smtp.authMethod = \"PLAIN\"  \u002F\u002F or \"LOGIN\"\n    settings.meta.senderName = \"My App\"\n    settings.meta.senderAddress = \"noreply@myapp.com\"\n    e.app.save(settings)\n    return e.next()\n})\n```\n\n## Security Hardening\n\n### Superuser MFA\n\nAlways enable MFA for superuser accounts in production:\nDashboard > Superusers > Auth options > MFA > Enable\n\n### Settings encryption key\n\nEncrypt sensitive settings (SMTP passwords, S3 keys) at rest:\n\n```bash\n.\u002Fpocketbase serve --encryptionEnv=PB_ENCRYPTION_KEY\n```\n\nSet `PB_ENCRYPTION_KEY` environment variable to a 32+ character random string. Once set, settings are encrypted in the DB. **Do not lose this key** — you won't be able to decrypt settings without it.\n\n### Rate limiting\n\nBuilt-in rate limiter (enabled by default). Configure in Dashboard > Settings > Rate limits, or:\n\n```js\nsettings.rateLimits.enabled = true\nsettings.rateLimits.rules = [\n    { label: \"*:auth*\", maxRequests: 10, duration: 300 },  \u002F\u002F 10 auth attempts per 5 min\n    { label: \"POST:\u002Fapi\u002Fcollections\u002F*\u002Frecords\", maxRequests: 50, duration: 60 },\n]\n```\n\n### Hide the Dashboard in production\n\n```bash\n.\u002Fpocketbase serve --http=\"127.0.0.1:8090\"  # bind to localhost only\n```\n\nAccess the dashboard only via SSH tunnel:\n```bash\nssh -L 8090:127.0.0.1:8090 user@server\n```\n\n## S3 Storage\n\nFor file uploads, offload to S3-compatible storage:\n\nDashboard > Settings > Files storage > S3\n\n```js\n\u002F\u002F Or via hooks:\nonBootstrap(function(e) {\n    var settings = e.app.settings()\n    settings.s3.enabled = true\n    settings.s3.bucket = $os.getenv(\"S3_BUCKET\")\n    settings.s3.region = $os.getenv(\"S3_REGION\")\n    settings.s3.endpoint = $os.getenv(\"S3_ENDPOINT\")\n    settings.s3.accessKey = $os.getenv(\"S3_ACCESS_KEY\")\n    settings.s3.secret = $os.getenv(\"S3_SECRET\")\n    settings.s3.forcePathStyle = true  \u002F\u002F for MinIO\u002FBackblaze\n    e.app.save(settings)\n    return e.next()\n})\n```\n\nCompatible providers: AWS S3, Backblaze B2, Cloudflare R2, MinIO, DigitalOcean Spaces, Wasabi.\n\n## Backups\n\n### Small databases (\u003C 1GB)\n\nUse the built-in backup feature:\n- Dashboard > Settings > Backups\n- Or via API: `POST \u002Fapi\u002Fbackups`\n- Auto-schedule: configure cron in Dashboard\n\n### Large databases\n\nThe Dashboard backup uses SQLite's online backup API (locks DB briefly). For large DBs, use:\n\n```bash\n# sqlite3 .backup command (hot backup, minimal locking)\nsqlite3 \u002Fopt\u002Fpocketbase\u002Fpb_data\u002Fdata.db \".backup '\u002Ftmp\u002Fbackup.db'\"\n\n# Then rsync to remote\nrsync -avz \u002Ftmp\u002Fbackup.db backup-server:\u002Fbackups\u002Fpocketbase\u002Fdata-$(date +%Y%m%d).db\n```\n\n**Never copy the `.db` file directly** while PocketBase is running — it may be in an inconsistent state.\n\n### Backup script\n\n```bash\n#!\u002Fbin\u002Fbash\n# \u002Fopt\u002Fpocketbase\u002Fbackup.sh\nset -euo pipefail\n\nBACKUP_DIR=\"\u002Fbackups\u002Fpocketbase\"\nDB_PATH=\"\u002Fopt\u002Fpocketbase\u002Fpb_data\u002Fdata.db\"\nDATE=$(date +%Y%m%d_%H%M%S)\n\nmkdir -p \"$BACKUP_DIR\"\n\n# Hot backup\nsqlite3 \"$DB_PATH\" \".backup '${BACKUP_DIR}\u002Fdata_${DATE}.db'\"\n\n# Also backup pb_data files (uploads, if not using S3)\ntar -czf \"${BACKUP_DIR}\u002Fpb_data_${DATE}.tar.gz\" -C \u002Fopt\u002Fpocketbase pb_data --exclude='pb_data\u002Fdata.db*'\n\n# Retain last 30 days\nfind \"$BACKUP_DIR\" -name \"data_*.db\" -mtime +30 -delete\nfind \"$BACKUP_DIR\" -name \"pb_data_*.tar.gz\" -mtime +30 -delete\n```\n\n```bash\n# Crontab: daily at 2 AM\n0 2 * * * \u002Fopt\u002Fpocketbase\u002Fbackup.sh >> \u002Fvar\u002Flog\u002Fpocketbase-backup.log 2>&1\n```\n\n## Health Check\n\n```bash\ncurl http:\u002F\u002Flocalhost:8090\u002Fapi\u002Fhealth\n# {\"code\":200,\"message\":\"API is healthy.\"}\n```\n\n## Deployment Checklist\n\n1. **Binary**: correct architecture (linux_amd64 \u002F linux_arm64)\n2. **systemd**: service enabled, LimitNOFILE set\n3. **Reverse proxy**: Caddy or nginx with TLS, proxy_buffering off for SSE\n4. **SMTP**: configured and tested (send a test verification email)\n5. **Superuser**: strong password + MFA enabled\n6. **Encryption key**: `--encryptionEnv` set for sensitive settings\n7. **Backups**: automated daily, tested restore procedure\n8. **Rate limiting**: enabled with sane defaults\n9. **File storage**: S3 configured if expecting many uploads\n10. **Monitoring**: health check endpoint monitored, journalctl logs reviewed\n11. **Firewall**: only 80\u002F443 exposed, 8090 bound to localhost\n12. **GOMEMLIMIT**: set if on constrained VPS\n",{"name":5,"description":7},"main","2b749c82b5d11fac39d9a6e021ce3f5b8a541bd1","cli-tool\u002Fcomponents\u002Fskills\u002Fpocketbase\u002Fpb-deploy",3911,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates","https:\u002F\u002Faitmpl.com","https:\u002F\u002Fgithub.com\u002Fdavila7","https:\u002F\u002Fdanielavila.me","Building AI dev tools with LLMs","2026-11-11 21:38:31",{"source":8,"skillName":5,"commands":64,"prompt":74,"zipAvailable":75},[65,68,71],{"tool":66,"command":67},"npx","npx skills add davila7\u002Fclaude-code-templates --skill pb-deploy",{"tool":69,"command":70},"bunx","bunx skills add davila7\u002Fclaude-code-templates --skill pb-deploy",{"tool":72,"command":73},"pnpm","pnpm dlx skills add davila7\u002Fclaude-code-templates --skill pb-deploy","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fpocketbase\u002Fpb-deploy\u002FSKILL.md",true,[],[78,105,132,165,200,224],{"skillNo":79,"name":80,"nameZh":6,"description":81,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":82,"categories":83,"keywords":87,"publishedAt":48},"01M70NHBTQ8BV0A2SCAZXEPHCX","wealthville-pool-scoring","Score DeFi liquidity pools before providing liquidity. Returns a 0-100 pool score and an Enter\u002FHold\u002FExit\u002FReduce\u002FAvoid verdict with calibrated confidence for ~68,800 Solana pools and 575 EVM pools, plus a public miss-inclusive track record. Use when asked whether a pool is worth LPing into, which pools look best right now, or how accurate the scores have actually been.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fweb-data\u002Fwealthville-pool-scoring\u002FSKILL.md",[84],{"categoryNo":85,"categoryName":86,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[88,89,90,91,92,29,93,94,37,26,95,96,97,98,99,100,101,102,103,104],"scoring","pool","wealthville pool scoring","liquidity","which","exit","now","reduce","with","record","track","verdict","evm","solana","how","public","look",{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":112,"publishedAt":48},"01M70MB6VR8ERJ4EM8D5KHBMEV","technical-debt-auditor","Scans a codebase and produces a quantified technical debt report with a prioritized remediation plan. Analyzes dead code, TODO\u002FFIXME\u002FHACK markers, dependency staleness, complexity hotspots, code duplication signals, test coverage gaps, unused exports, and outdated patterns. Use this skill when the user asks to audit their codebase for tech debt, wants a health check of their code quality, says things like \"where should I focus refactoring\", \"find code smells\", \"audit my codebase\", \"what technical debt do we have\", \"prioritize cleanup work\", or asks about code quality metrics. Also trigger when the user mentions \"code rot\", \"legacy cleanup\", \"refactoring priorities\", or wants to understand the overall health of a project before a major effort. Trigger even if the user doesn't say \"technical debt\" explicitly — any request to systematically assess code quality and identify improvement priorities belongs here.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdevelopment\u002Ftechnical-debt-auditor\u002FSKILL.md",[111],{"categoryNo":85,"categoryName":86,"taxonomyType":21,"taxonomyTypeDesc":22},[113,114,115,116,117,118,119,120,121,122,123,26,124,125,126,127,128,129,130,131],"technical debt","debt","technical","technical debt auditor","auditor","coverage","complexity","markers","project","cleanup","unused","code","todo","work","plan","focus","signals","audit","dependency",{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":147,"publishedAt":48},"01M70KPYH9QNHCNME5GJQGE22K","readonly-sql-guard","Make an agent's database access provably read-only. Use when an agent runs caller-supplied SQL against a production\u002FERP\u002Fanalytics database (a \"query\" MCP tool, text-to-SQL, an admin console), or when reviewing DB-access code for write\u002FDDL\u002Fside-effect\u002Ftransaction-escape risks. Checks what a statement CALLS, not just its shape.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdatabase\u002Freadonly-sql-guard\u002FSKILL.md",[138,141,142],{"categoryNo":139,"categoryName":140,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":85,"categoryName":86,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":143,"categoryName":144,"taxonomyType":145,"taxonomyTypeDesc":146},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[148,149,150,151,152,153,154,29,155,156,157,158,159,160,161,37,162,163,26,164],"readonly","guard","sql guard","sql","readonly sql guard","erp","effect","read-only","db","just","tool","calls","only","MCP","access","database","query",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":169,"licenseFileUrl":170,"sourceHtmlUrl":171,"categories":172,"keywords":176,"publishedAt":48},"01M6AFY6F7CC2BBZP1QD6VTNVC","web-artifacts-builder","Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn\u002Fui). Use for complex artifacts requiring state management, routing, or shadcn\u002Fui components - not for simple single-file HTML\u002FJSX artifacts.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FSKILL.md",[173],{"categoryNo":174,"categoryName":175,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",[177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,29,199],"artifacts builder","web","web artifacts builder","artifacts","builder","state","routing","state management","component","css","frontend","ui","Tools","file","components","shadcn","react","Tailwind","suite","jsx","html","single-file","ui components",{"skillNo":201,"name":202,"nameZh":6,"description":203,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":169,"licenseFileUrl":204,"sourceHtmlUrl":205,"categories":206,"keywords":211,"publishedAt":48},"01M6AFWF33SFV9Z3SF4PEEE4BF","webapp-testing","Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FSKILL.md",[207,210],{"categoryNo":208,"categoryName":209,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":174,"categoryName":175,"taxonomyType":21,"taxonomyTypeDesc":22},[212,213,214,215,216,178,217,187,188,218,219,220,221,29,222,96,223],"webapp testing","testing","webapp","browser","playwright","applications","debugging","toolkit","logs","screenshots","local","behavior",{"skillNo":225,"name":226,"nameZh":6,"description":227,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":169,"licenseFileUrl":228,"sourceHtmlUrl":229,"categories":230,"keywords":238,"publishedAt":48},"01M6AF67Q67JJJ5V51JR2P52KA","discernment-nudge","After you give a substantive answer or draft that the user may act on — advice or recommendations, drafted artifacts such as goals, plans, pitches, proposals, or emails, estimates or projections, analysis or interpretation of data, factual claims they may rely on, or a multi-step argument — invoke this skill BEFORE finalizing your reply and then, if it applies, append 2-3 short follow-up questions, each tied to something specific in what you just produced, that help the user check key facts, probe the reasoning or assumptions, and notice missing context. Do this at most once per conversation. Skip it when the user asked a trivial how-to or simple lookup, wants a purely educational explanation, asked you only to format, convert, or assemble a file from content they provided, is writing code they will run, is doing creative writing or casual chat, or already asked you to double-check, cite, or review — the skill file explains these boundaries and the exact output format.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fdiscernment-nudge\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fdiscernment-nudge\u002FSKILL.md",[231,234,235],{"categoryNo":232,"categoryName":233,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":85,"categoryName":86,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":236,"categoryName":237,"taxonomyType":145,"taxonomyTypeDesc":146},"01JBSEEDCAT000000000000036","内容创作者",[239,240,241,242,243,244,245,246,180,247,190,124,248,249,250,251,35,160,252,26,253,254,255,256,257,102,258],"discernment nudge","nudge","interpretation","help","run","reasoning","data","writing","lookup","content","review","conversation","short","invoke","you","analysis","claims","argument","assemble","recommendations"]