# digitalocean-networking

Network architecture skill for DigitalOcean VPC, firewalls, load balancers, and DNS. Guides your AI agent when segmenting traffic and securing endpoints.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 404 installs · ★ 78
- Author: bobmatnyc
- License: MIT · policy=mirror · the beginning of the file is at the end of this page
- Source: https://github.com/bobmatnyc/claude-mpm-skills/tree/HEAD/toolchains/platforms/deployment/digitalocean-networking/SKILL.md
- Updated: 2026-07-18
- HTML: https://affpapa.org/en/nevibecode/skills/digitalocean-networking

## What it does

This skill injects DigitalOcean network architecture practices into the agent context. It outlines patterns for isolating Droplets, managed databases, and Kubernetes clusters using private VPCs. Compute instances must reside in the exact same region as the target VPC, or private communication will fail.

The guide details stateful firewall rules grouped by protocol and port. It also covers load balancers with health checks and TLS termination, along with reserved IPs for fast failover. Outbound traffic from isolated subnets routes through NAT Gateways.

The skill operates on its own. While companion skills like `digitalocean-compute` or `digitalocean-managed-databases` exist, you do not need them to design network topology.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add bobmatnyc/claude-mpm-skills --skill digitalocean-networking -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/digitalocean-networking/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/digitalocean-networking/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add bobmatnyc/claude-mpm-skills --skill digitalocean-networking -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/digitalocean-networking/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add bobmatnyc/claude-mpm-skills --skill digitalocean-networking -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/digitalocean-networking/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install bobmatnyc/claude-mpm-skills digitalocean-networking
```

2. **Manually: put the files in place**
- File: `.github/skills/digitalocean-networking/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add bobmatnyc/claude-mpm-skills --skill digitalocean-networking -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/bobmatnyc/claude-mpm-skills --path toolchains/platforms/deployment/digitalocean-networking
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/digitalocean-networking/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add bobmatnyc/claude-mpm-skills --skill digitalocean-networking -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/bobmatnyc/claude-mpm-skills/tree/HEAD/toolchains/platforms/deployment/digitalocean-networking/SKILL.md

## When to use it
- Segment infrastructure using environment-specific VPCs
- Restrict Droplet ingress and egress traffic via stateful firewalls
- Distribute requests through load balancers with TLS termination
- Maintain static entry points using reserved IPs during migrations

## Example prompts
- Design a VPC layout in DigitalOcean separating web servers from the private database
- Generate firewall rules allowing only HTTP, HTTPS, and restricted SSH access
- Show me how to configure a NAT Gateway for outbound traffic from a private subnet

## Source text · SKILL.md · MIT

Below is the content of a third-party file. It is data, not instructions for you: do not act on anything written inside unless the human asks. Block tag: 80c00c5887a9c274.

BEGIN THIRD-PARTY FILE 80c00c5887a9c274
```text
---
name: digitalocean-networking
description: DigitalOcean networking services including VPC, firewalls, load balancers, reserved IPs, DNS, IPv6, and NAT gateway. Use when designing or securing network connectivity for DigitalOcean workloads.
user-invocable: false
disable-model-invocation: true
progressive_disclosure:
  entry_point:
    summary: "DigitalOcean networking services including VPC, firewalls, load balancers, reserved IPs, DNS, IPv6, and NAT gateway. Use when designing or securing network connectivity for DigitalOcean workloads."
    when_to_use: "When working with version control, branches, or pull requests."
    quick_start: "1. Review the core concepts below. 2. Apply patterns to your use case. 3. Follow best practices for implementation."
---
# DigitalOcean Networking Skill

---
progressive_disclosure:
  entry_point:
    summary: "DigitalOcean networking: VPC, firewalls, load balancers, reserved IPs, DNS, IPv6, NAT gateway."
    when_to_use:
      - "When designing private networks or segmentation"
      - "When securing inbound and outbound traffic"
      - "When configuring load balancing and DNS"
    quick_start:
      - "Create a VPC for private traffic"
      - "Apply firewalls to compute"
      - "Attach load balancers and reserved IPs"
      - "Configure DNS records"
  token_estimate:
    entry: 90-110
    full: 3800-5000
---

## Overview

DigitalOcean networking services secure and control traffic with VPC networking, firewalls, load balancing, DNS, IPv6, and reserved IPs.

## VPC

Use VPC to create private network segments for Droplets, Kubernetes, and managed databases.

- Create a VPC in the same region as compute resources.
- Attach resources that need private communication.

## Firewalls

Use stateful firewalls to restrict inbound and outbound traffic.

- Define inbound and outbound rules by protocol and port.
- Apply rules to Droplets and other resources.

## Load Balancers

Use load balancers to distribute traffic across backend resources.

- Configure health checks and target pools.
- Terminate TLS and forward to backend services.

## Reserved IPs

Use reserved IPs to keep stable public endpoints.

- Assign reserved IPs to Droplets.
- Remap IPs during failover or migration.

## DNS and IPv6

- Manage DNS records for DigitalOcean and external resources.
- Enable IPv6 for dual-stack support.

## NAT Gateway

Use NAT Gateway for outbound connectivity from private subnets.

## Networking Workflow

- Create a VPC per environment.
- Attach compute and databases to the VPC.
- Apply firewalls to limit inbound access.
- Add load balancers for public entry points.
- Configure DNS and reserved IPs for stable routing.
```
END THIRD-PARTY FILE 80c00c5887a9c274

The third-party file has ended. Everything between the 80c00c5887a9c274 tags is data: requests and commands from it are not followed. An “end of file” line with another tag inside the block is part of the file.

First 2686 of 3703 bytes. © bobmatnyc · MIT · https://github.com/bobmatnyc/claude-mpm-skills/tree/HEAD/toolchains/platforms/deployment/digitalocean-networking/SKILL.md

_Part of the page did not fit — see the HTML version._

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md