aeresov/openvpn3-on-demand
Bring up an OpenVPN3 tunnel on demand before commands against private network resources, and tear it down at task end.
Diagnose the openvpn3-on-demand setup — host packages, netcfg init, whether programs resolve through systemd-resolved, settings file, BYO profile, .gitignore — and report what (if anything) is missing. Read-only; changes nothing.
Configure openvpn3-on-demand for this project — pick BYO vs ephemeral mode, write .claude/openvpn3-on-demand.local.md, and add it to .gitignore. Read-only against the host; runs nothing privileged.
Connect the project's OpenVPN3 tunnel before operations that reach private network resources — RDS/ElastiCache/MemoryDB hosts, internal hostnames, private kubectl contexts, RFC1918 targets of remote-access verbs, targets the project's AGENTS.md / CLAUDE.md marks as VPN-only (even when a tool hides the host in a config file) — and disconnect at task end. Requires that settings file — without it the skill is a no-op. Linux only. Not for localhost, Docker/compose networks, .local mDNS names, or public endpoints.