systems-administration
Runs servers and corporate systems — patching, configuration baselines, change control, capacity, and the routine that prevents incidents. Use this to establish a patching cadence, standardize server configuration, plan a maintenance window, decide change control for infrastructure, or clean up systems that have drifted from any known state.
git clone --depth 1 https://github.com/cbrock84/headcount /tmp/systems-administration && cp -r /tmp/systems-administration/plugins/it-operations/skills/systems-administration ~/.claude/skills/systems-administrationSKILL.md
# Systems administration Well-run systems are boring. The work is in the routine that keeps them that way, and almost every serious incident traces back to a routine that was skipped. Cloud environment design belongs to `technology:cloud-infrastructure`; this is operating the systems the company runs on. ## Configuration baselines and drift Every system class needs a defined baseline: build, hardening, agents, logging, accounts. Systems built by hand from memory diverge immediately and cannot be reasoned about as a group. Drift is the real enemy. Detect it continuously and correct rather than document — a system that no longer matches its baseline is a system whose behavior under patching or failover is unknown. The strongest form is disposability: rebuild rather than repair. A system you can rebuild in an hour never accumulates the sediment of a decade of manual fixes. ## Patching as a cadence Set a regular, predictable window and hold it. Ad hoc patching means patching happens when someone worries, which is never in proportion to actual risk. Tier by exposure: internet-facing systems on the shortest cycle, then internal, then isolated. Emergency patching is a separate path with its own authority, used for actively exploited vulnerabilities — `security:vulnerability-management` decides what is urgent, this skill executes it. Track **coverage**, not activity. "Patching is running" is not an answer; "97% of servers are within 30 days, here are the twelve that are not and why" is. ## Change control proportionate to risk Heavyweight approval for trivial changes produces circumvention, and circumvention produces unrecorded changes, which is worse than no process. Tier it: standard pre-approved changes, normal changes with review, emergency changes with after-the-fact record. Every change needs an owner, a back-out plan, and a record — the back-out plan being the part most often assumed rather than written. Maintenance windows exist to make disruption predictable. Announce them, keep them, and finish inside them. ## Know what you have An unmanaged system is a system nobody patches. Reconcile what is running against `it-operations:it-asset-management` regularly, and treat anything unaccounted for as urgent — the server nobody owns is the one still running an unsupported operating system. ## Never - Repair a drifted system without correcting the baseline that let it drift. - Patch on worry rather than cadence. - Make a change with no back-out plan. - Leave a discovered unmanaged system unclaimed.
Corporate Strategy (CSO). Owns plugins/corporate-strategy/** and nothing else. Delegate work in this department's remit here.
Customer Experience (CCO). Owns plugins/customer-experience/** and nothing else. Delegate work in this department's remit here.
Data & Analytics (CDO). Owns plugins/data-analytics/** and nothing else. Delegate work in this department's remit here.
Demand Generation (CMO). Owns plugins/demand-generation/** and nothing else. Delegate work in this department's remit here.
Office of the CEO. Owns plugins/executive/** and nothing else. Delegate work in this department's remit here.
Finance (CFO). Owns plugins/finance/** and nothing else. Delegate work in this department's remit here.
Corporate IT. Owns plugins/it-operations/** and nothing else. Delegate service desk, systems and network administration, virtualization and cloud, telephony and conferencing, endpoints, assets, identity lifecycle, and backup work here.
Reviewer-class. Read-only review of what other departments commit to — contract terms, privacy and data handling, risk acceptance, and compliance findings. Holds no write surface. Its findings are not overrulable by the department under review.