huawei-cloud-obs-website-host

Huawei Cloud OBS Website Host Overview Configure an existing Huawei Cloud OBS bucket for static website hosting with Huawei Cloud OBS Python SDK and register a custom domain for the site. Use this skill when the user wants to: - enable or repair OBS static website hosting - set an index document or error document - make the site reachable through a custom domain backed by the OBS static website endpoint - add or repair a custom domain, including Huawei Cloud DNS when applicable - diagnose 403, 404, or DNS issues on a hosted OBS site What Good Looks Like - The bucket has static website hosting…

) { $ak = $true }\n if ($line -match '^\\s*(sk|secret_access_key)\\s*=\\s*(\\S.*)

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

) { $sk = $true }\n if ($line -match '^\\s*(securitytoken|security_token|token)\\s*=\\s*(\\S.*)

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

) { $st = $true }\n }\n \"obsutilconfig_exists=true\"\n \"ak_configured=$ak\"\n \"sk_configured=$sk\"\n \"securitytoken_configured=$st\"\n}\n```\n\nDo not use:\n\n- `cat ~/.obsutilconfig`\n- `grep -E \"ak|sk|token\" ~/.obsutilconfig`\n\n## Script Usage Intent\n\nUse the bundled scripts by default for the tasks they were built for:\n\n- `scripts/set_obs_website_sdk.py` applies or updates the bucket website configuration and registers the required custom domain. Use it whenever the task is to enable, repair, or change OBS static website hosting settings.\n- `scripts/verify_obs_website.py` validates the published website endpoint. Use it after any website configuration change, and also when the user asks whether the site is reachable or when troubleshooting 403/404 behavior.\n- Do not replace these scripts with ad hoc one-off code unless the script itself is broken and must be patched.\n- Use the scripts to keep credential handling, SDK object construction, and verification behavior consistent across runs.\n\n## Workflow\n\n1. Verify Python runtime and OBS SDK are available (`pip install esdk-obs-python` if missing).\n2. Verify the custom domain prerequisite (see **Security Compliance** section):\n - Confirm `custom_domain` is provided by the user.\n - If the user does not have a domain, guide them to register one at [Huawei Cloud Domain Registration](https://www.huaweicloud.com/product/domain.html) and complete **ICP filing (网站备案)** for mainland China regions. Stop here and wait for the user to complete this step.\n - Check whether the user manages DNS in Huawei Cloud DNS or with an external provider.\n - If Huawei Cloud DNS changes are part of this run, verify `hcloud` is installed and authenticated.\n - If DNS is managed outside Huawei Cloud or outside this run, collect that constraint explicitly before proceeding.\n3. Verify the bucket exists in the requested region (use **Bucket Existence and Region Check Method** below).\n4. Check that the caller has permission to update bucket website settings.\n5. Check that anonymous read is allowed for the website files (use the method in **Anonymous Read Check Method** below).\n6. Do not upload or modify website content objects (`index.html`, assets, etc.). Assume content already exists in the bucket.\n7. Configure static website hosting by running `scripts/set_obs_website_sdk.py` with `--custom-domain \u003cdomain>` (use `index.html` if `index_document` is not provided).\n - The script exists to keep SDK object construction and credential lookup consistent.\n - Use it instead of writing a one-off SDK call in the response.\n8. Register the required custom domain on the bucket via the OBS SDK path used by the script:\n - `client.setBucketCustomDomain(bucket_name, custom_domain)` — required even if DNS CNAME already exists.\n - If DNS record changes are requested in this run, create a DNS CNAME record to the OBS website hostname and wait for propagation. (read `references/hcloud-dns-obs-website.md`)\n - If DNS is managed outside Huawei Cloud or outside this run, provide the required CNAME target and explicitly instruct the user to create or update the CNAME record with their external DNS provider after OBS custom-domain registration is complete.\n - For externally managed DNS, include the practical handoff details the user needs: record type `CNAME`, host/name, target/value, and a verification command such as `dig`.\n9. Verify the published site by running `scripts/verify_obs_website.py --bucket-name \u003cbucket_name> --region \u003cregion> [--domain \u003ccustom_domain>] [--index-document \u003cname>]`.\n - If the user provided a custom domain, final verification MUST use that custom domain via `--domain \u003ccustom_domain>`.\n - Only use the default OBS hostname for interim checks or when no custom domain was provided.\n10. Confirm the root path returns the homepage (HTTP 200).\n11. Confirm a missing path returns the configured error behavior (HTTP 404 or configured error page).\n12. Verify DNS resolution (`dig` / `nslookup`) and HTTP access through the user-provided custom domain. Do not treat the setup as complete based only on the default OBS hostname when a custom domain is part of the request.\n\n## Bucket Existence and Region Check Method\n\nRun a read-only SDK check with `verify_obs_website.py` before website configuration.\n\n```bash\npython scripts/verify_obs_website.py \\\n --bucket-name \"\u003cbucket_name>\" \\\n --region \"\u003cregion>\" \\\n --index-document \"\u003cindex_document>\"\n```\n\n`obs endpoint` is auto-built as `https://obs.\u003cregion>.myhuaweicloud.com`.\n\nPass/Fail rules:\n\n- `PASS`: `headBucket` is `2xx` and region matches (or region cannot be returned but bucket is reachable with `2xx`).\n- `FAIL`: `headBucket` non-`2xx`, `getBucketLocation` non-`2xx`, or explicit region mismatch.\n\n## Anonymous Read Check Method\n\nUse anonymous HTTP requests against the OBS website endpoint (no AK/SK) as the source of truth.\n\n1. The verifier auto-builds the default website URL:\n - `http://\u003cbucket_name>.obs.\u003cregion>.myhuaweicloud.com`\n2. Run bundled verifier (preferred):\n\n```bash\npython scripts/verify_obs_website.py \\\n --bucket-name \"\u003cbucket_name>\" \\\n --region \"\u003cregion>\" \\\n --domain \"\u003ccustom_domain>\" \\\n --index-document \"\u003cindex_document>\"\n```\n\n3. If no custom domain was provided by the user, verify the default OBS website endpoint instead:\n\n```bash\npython scripts/verify_obs_website.py \\\n --bucket-name \"\u003cbucket_name>\" \\\n --region \"\u003cregion>\" \\\n --index-document \"\u003cindex_document>\"\n```\n\n4. If you need a quick single-file check, run:\n\n```bash\nsite_url=\"http://\u003ccustom_domain>\"\ncurl -s -o /dev/null -w \"%{http_code}\\n\" \"$site_url/\u003cindex_document>\"\n```\n\nPass/Fail rules:\n\n- `200` on `root_path` and `index_document`: anonymous read is working.\n- `403`: treat as two possible issues that must both be reported to the user: anonymous/public read is not enabled (ACL/policy issue), or the AK/SK used for SDK verification/configuration lacks required IAM permissions.\n- `404`: object path/name issue (for example, `index.html` missing or key path mismatch), not an anonymous-permission success.\n\nWhen `403` appears, treat setup as failed and tell the user both common possibilities:\n\n- bucket/object is not public-read for website access\n- AK/SK lacks required IAM permissions for OBS operations\n\nProvide remediation via `references/iam-policies.md`.\n\n## Response Shape\n\nAlways return:\n\n1. Input summary\n2. Actions performed\n3. Verification results\n4. Remediation steps if anything failed\n\nWhen DNS is externally managed, also include a short DNS handoff section that tells the user exactly which CNAME record to configure with their provider.\n\n## Safety Rules\n\n- Never print secrets, AK/SK, or tokens.\n- Do not claim success until the website endpoint is verified.\n- If the user provided a custom domain, final success must be based on verification through that custom domain, not only the default OBS hostname.\n- If permissions are missing, stop and report the missing capability.\n- If DNS provider ownership is unspecified, ask whether the zone is managed in Huawei Cloud DNS or externally before assuming `hcloud` steps.\n- If Huawei Cloud DNS changes are required for completion but the zone is unknown, ask for the zone instead of guessing.\n- Do not use the regular bucket endpoint as the final website result.\n- If the bucket name contains dots, warn that HTTPS access can be problematic.\n- If the user requires HTTPS access, success must be verified over `https://`. `verify_obs_website.py` always checks both HTTP and HTTPS endpoints, so a custom domain without a valid certificate is reported with a TLS remediation step. HTTPS on OBS requires a certificate bound to the custom domain via `setBucketCustomDomain(..., certificateInfo=...)`. OBS supports HTTPS only on a custom domain and only with international (general) certificates, not SM (national crypto) certificates.\n- Never print or echo private key material passed via `--private-key`.\n- `obsutil` is allowed only for managing `~/.obsutilconfig`; do not use it to configure website hosting.\n- Do not perform any object upload actions in this skill.\n- Especially during verification, use read-only checks only; never upload test files.\n- For externally managed DNS, do not stop at “DNS is external”; provide the user-facing CNAME handoff details needed to finish the setup.\n\n## Permission Failure Handling (MUST)\n\nWhen any command fails due to IAM permission errors:\n\n1. Read `references/iam-policies.md`.\n2. Show the required permission list and policy JSON to the user.\n3. Guide the user to create a custom IAM policy and grant it in Huawei Cloud IAM console.\n4. Pause execution and wait for user confirmation that permissions were granted.\n\n## References\n\nLoad `references/obs-python-sdk-website.md` for SDK method usage for website hosting **and custom domain registration** (`setBucketCustomDomain`).\nLoad `references/iam-policies.md` for required IAM actions and policy JSON.\nLoad `references/hcloud-dns-obs-website.md` for step-by-step DNS CNAME configuration for custom domains via Huawei Cloud DNS (`hcloud` CLI), including zone lookup, record creation, and verification.\n\n> **Known Pitfall:** The `setBucketWebsite` API in esdk-obs-python >= 3.x uses `WebsiteConfiguration` model objects, **not** keyword arguments like `indexDocumentSuffix`. Always import `WebsiteConfiguration`, `IndexDocument`, and `ErrorDocument` and construct them properly.\n\n## Scripts\n\nUse scripts only for repeatable checks and verification. Keep command output human-readable and focused on success/failure.\n\n- `scripts/set_obs_website_sdk.py \u003cbucket_name> \u003cendpoint> --custom-domain \u003cdomain> [--index-document \u003cname>] [--error-document \u003cname>]` applies static website hosting settings through the OBS SDK, registers the required custom domain, and reads credentials from CLI args, env vars, or `~/.obsutilconfig`. OBS supports HTTPS on a custom domain via `setBucketCustomDomain(..., certificateInfo=...)`. To bind a certificate, use `--certificate-name` together with either `--certificate` + `--private-key` (direct PEM) or `--certificate-id` (CCM certificate). Only international (general) certificates are supported, not SM (national crypto) certificates.\n- `scripts/verify_obs_website.py --bucket-name \u003cname> --region \u003cregion> [--domain \u003ccustom_domain>] [--index-document \u003cname>] [--json]` verifies endpoint DNS/HTTP/HTTPS behavior and also performs a read-only bucket existence + region check (`headBucket` + `getBucketLocation`). If `--domain` is provided, that custom domain is the final verification target; otherwise it auto-builds the default website URL as `http://\u003cbucket>.obs.\u003cregion>.myhuaweicloud.com`. Both `http://` and `https://` are always verified, so TLS certificate problems on a custom domain (certificate_verify_failed / hostname mismatch) are detected and reported with remediation steps. The OBS API endpoint remains `https://obs.\u003cregion>.myhuaweicloud.com`. It prints structured sections (`Input summary`, `Actions performed`, `Verification results`, `Remediation steps`) so agent responses can directly reuse them.\n\n## Validation Rules\n\nLoad `references/verification-method.md` for validation rules.","attachment_filenames":["references/cli-installation-guide.md","references/hcloud-dns-obs-website.md","references/iam-policies.md","references/obs-python-sdk-website.md","references/verification-method.md","scripts/set_obs_website_sdk.py","scripts/verify_obs_website.py"],"attachments":[{"filename":"references/cli-installation-guide.md","content":"# CLI Installation and Configuration Guide\n\nUse this reference when you need to install or configure **KooCLI (`hcloud`)** or **`obsutil`**.\n\n---\n\n## Table of Contents\n\n- [hcloud (KooCLI)](#hcloud-koocli)\n - [Linux Installation](#linux-installation)\n - [Windows Installation](#windows-installation)\n - [Configure hcloud](#configure-hcloud)\n- [obsutil](#obsutil)\n - [Config File Location](#config-file-location)\n - [Linux AMD64 (x86\\_64)](#linux-amd64-x86_64)\n - [Linux ARM64](#linux-arm64)\n - [macOS (AMD64)](#macos-amd64)\n - [Windows (AMD64)](#windows-amd64)\n - [Generate Config File](#generate-config-file)\n - [Secure Credential Check](#secure-credential-check)\n - [Notes](#notes)\n\n---\n\n## hcloud (KooCLI)\n\n### Linux Installation\n\n```bash\ncurl -sSL https://ap-southeast-3-hwcloudcli.obs.ap-southeast-3.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh\nbash ./hcloud_install.sh -y\n```\n\nInteractive install:\n\n```bash\nbash ./hcloud_install.sh\n```\n\n### Windows Installation\n\n1. Download the package:\n - `https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-windows-amd64.zip`\n2. Unzip it and get `hcloud.exe`.\n3. Add the folder containing `hcloud.exe` to `Path` if desired.\n4. Verify:\n\n```powershell\nhcloud version\n```\n\n### Configure hcloud\n\nInteractive init:\n\n```bash\nhcloud configure init\n```\n\nAK/SK mode:\n\n```bash\nhcloud configure set --cli-profile=default --cli-mode=AKSK --cli-region=\u003cregion> --cli-access-key=\u003cak> --cli-secret-key=\u003csk>\n```\n\nVerify current profile:\n\n```bash\nhcloud version\nhcloud configure list\n```\n\n---\n\n## obsutil\n\n### Config File Location\n\n`obsutil` auto-generates a config file named `.obsutilconfig` in user home directory:\n\n- macOS/Linux: `~/.obsutilconfig`\n- Windows: `C:\\Users\\\u003cusername>\\.obsutilconfig`\n\n### Linux AMD64 (x86_64)\n\n```bash\nwget https://obs-community.obs.cn-north-1.myhuaweicloud.com/obsutil/current/obsutil_linux_amd64.tar.gz\ntar -xzvf obsutil_linux_amd64.tar.gz\ncd obsutil_linux_amd64_*\nchmod 755 obsutil\n./obsutil version\n```\n\n### Linux ARM64\n\n```bash\nwget https://obs-community.obs.cn-north-1.myhuaweicloud.com/obsutil/current/obsutil_linux_arm64.tar.gz\ntar -xzvf obsutil_linux_arm64.tar.gz\ncd obsutil_linux_arm64_*\nchmod 755 obsutil\n./obsutil version\n```\n\n### macOS (AMD64)\n\n```bash\ncurl -O https://obs-community.obs.cn-north-1.myhuaweicloud.com/obsutil/current/obsutil_darwin_amd64.tar.gz\ntar -xzvf obsutil_darwin_amd64.tar.gz\ncd obsutil_darwin_amd64_*\nchmod 755 obsutil\n./obsutil version\n```\n\n### Windows (AMD64)\n\n1. Download the package:\n - `https://obs-community.obs.cn-north-1.myhuaweicloud.com/obsutil/current/obsutil_windows_amd64.zip`\n2. Unzip it.\n3. Open `cmd` or PowerShell in the extracted directory.\n4. Run:\n\n```powershell\nobsutil.exe version\n```\n\n### Generate Config File\n\n```bash\n# generate config file\n./obsutil config\n```\n\nWindows:\n\n```powershell\nobsutil.exe config\n```\n\n### Secure Credential Check (No Value Output)\n\nDo not print `ak`, `sk`, or `securitytoken` values to console. \nOnly print key presence status (`true` / `false`).\n\nNever run:\n\n- `cat ~/.obsutilconfig`\n- `grep -E \"ak|sk|token\" ~/.obsutilconfig`\n\n### Notes\n\n- Internet connectivity is required when downloading packages.\n- `chmod 755 obsutil` is required before running `obsutil` on Linux/macOS.\n- If `./obsutil version` returns version information, installation is successful.\n- For macOS, run `chmod 755 obsutil` in the extracted directory before first use.\n","content_type":"text/markdown; charset=utf-8","language":"markdown","size":3465,"content_sha256":"01ed0c7b7410d7715bf34598c634e16ece9a5ddeab0a085469b24bbf55b9b43f"},{"filename":"references/hcloud-dns-obs-website.md","content":"# Huawei Cloud DNS Configuration for OBS Static Website\n\nUse this reference when you need to configure DNS records for an OBS static website custom domain via Huawei Cloud DNS (hcloud CLI).\n\n## Prerequisites\n\n- `hcloud` CLI installed and configured with AK/SK credentials (see `references/cli-installation-guide.md`)\n- The DNS zone for your domain already exists in Huawei Cloud DNS\n\n## Workflow\n\n### 1. Find the DNS Zone ID\n\nList all public zones and locate the one matching your domain:\n\n```bash\nhcloud DNS ListPublicZones --cli-region=\u003cregion>\n```\n\nLook for the zone whose `name` matches your domain (e.g., `example.com.`). Note its `id`.\n\n### 2. Check Existing Record Sets\n\nVerify there is no conflicting record for your subdomain:\n\n```bash\nhcloud DNS ListRecordSets --zone_type=public --cli-region=\u003cregion>\n```\n\nLook for records with the name `\u003csubdomain>.\u003cdomain>.` (e.g., `www.example.com.`).\n\n### 3. Create a CNAME Record\n\nCreate a CNAME record pointing your custom domain to the OBS website endpoint:\n\n```bash\nhcloud DNS CreateRecordSet \\\n --zone_id=\"\u003czone_id>\" \\\n --name=\"\u003ccustom_domain>.\" \\\n --type=\"CNAME\" \\\n --records.1=\"\u003cbucket_name>.obs.\u003cregion>.myhuaweicloud.com.\" \\\n --cli-region=\u003cregion> \\\n --ttl=300\n```\n\n**Parameters:**\n| Parameter | Value | Description |\n|-----------|-------|-------------|\n| `--zone_id` | Zone UUID | The ID of your DNS zone from step 1 |\n| `--name` | `custom_domain.` | Full domain name **with trailing dot** |\n| `--type` | `CNAME` | Record type for domain alias |\n| `--records.1` | OBS website endpoint | Target URL **with trailing dot**, e.g. `my-bucket.obs.cn-north-4.myhuaweicloud.com.` |\n| `--cli-region` | Region | Region where the DNS API is called |\n| `--ttl` | `300` (recommended) | Time-to-live in seconds |\n\n**Example:**\n\n```bash\nhcloud DNS CreateRecordSet \\\n --zone_id=\"ff8080828fb6d17b018fbd5a2fac1d7f\" \\\n --name=\"www.example.com.\" \\\n --type=\"CNAME\" \\\n --records.1=\"my-bucket.obs.cn-north-4.myhuaweicloud.com.\" \\\n --cli-region=cn-north-4 \\\n --ttl=300\n```\n\n### 4. Verify DNS Resolution\n\nCheck that the CNAME record resolves correctly:\n\n```bash\ndig +short \u003ccustom_domain> CNAME\n```\n\nExpected output:\n\n```\n\u003cbucket_name>.obs.\u003cregion>.myhuaweicloud.com.\n```\n\n## Important Notes\n\n- **Trailing dot**: Both the `--name` and `--records.1` values must end with a `.` (period) — this is the fully qualified domain name (FQDN) format required by Huawei Cloud DNS API.\n- **DNS propagation**: After creation, the record status may show `PENDING_CREATE`. Propagation typically completes within minutes.\n- **OBS custom domain registration**: Creating a DNS CNAME record alone is NOT sufficient. You must also register the custom domain on the OBS bucket via `setBucketCustomDomain` (see `references/obs-python-sdk-website.md`). Use the `--custom-domain` flag of `scripts/set_obs_website_sdk.py`.\n- **HTTPS**: The OBS website endpoint serves HTTP by default, but HTTPS **is supported on a custom domain** by binding an SSL certificate directly to the bucket custom domain (see `references/obs-python-sdk-website.md`) — no CDN required. The default bucket domain is automatically HTTPS-managed by Huawei Cloud. CDN is an optional acceleration layer (also supports HTTPS). `verify_obs_website.py` always verifies both HTTP and HTTPS (including TLS certificate validation), so a custom domain without a bound certificate is reported with a TLS remediation step.\n- **Bucket name with dots**: If the bucket name contains dots, HTTPS access may be problematic (certificate verification failures). A custom domain (with a bound certificate) is recommended.\n\n## Troubleshooting\n\n| Symptom | Likely Cause | Solution |\n| --------------------------- | --------------------------------------------- | ----------------------------------------------------------- |\n| `dig` returns no result | DNS not propagated or record not created | Check `hcloud DNS ListRecordSets` to confirm record exists |\n| Custom domain not reachable | Missing `setBucketCustomDomain` on OBS bucket | Re-run `set_obs_website_sdk.py` with `--custom-domain` flag |\n","content_type":"text/markdown; charset=utf-8","language":"markdown","size":4191,"content_sha256":"ad99009dd9fd7b1efb3db89ece2e4d1b392c7b9c87f7708c2bb286ac751cf145"},{"filename":"references/iam-policies.md","content":"# IAM Policy - Huawei Cloud OBS Website Host\n\n## Permission Usage\n\n| API Action | Permission | Purpose |\n|------------|------------|---------|\n| obs:bucket:HeadBucket | Read bucket existence/access status | Verify bucket exists and caller can access it before configuration |\n| obs:bucket:GetBucketLocation | Read bucket region | Verify bucket region matches expected deployment region |\n| obs:bucket:GetBucketCustomDomainConfiguration | Read bucket custom domain configuration | Check whether a custom domain is already registered |\n| obs:bucket:GetBucketWebsite | Read bucket website configuration | Check static website hosting settings |\n| dns:recordset:list | List DNS recordsets | Check whether the CNAME record exists |\n| dns:zone:get | Read DNS zone details | Confirm the target zone exists |\n| dns:zone:list | List DNS zones | Find the target zone |\n| obs:bucket:PutBucketCustomDomainConfiguration | Update bucket custom domain configuration | Register or update a custom domain |\n| obs:bucket:PutBucketWebsite | Update bucket website configuration | Set index/error page |\n| dns:recordset:create | Create DNS recordset | Create the CNAME record |\n\n## Minimum Policy JSON\n\n```json\n{\n \"Version\": \"1.1\",\n \"Statement\": [\n {\n \"Effect\": \"Allow\",\n \"Action\": [\n \"obs:bucket:HeadBucket\",\n \"obs:bucket:GetBucketLocation\",\n \"obs:bucket:GetBucketCustomDomainConfiguration\",\n \"obs:bucket:GetBucketWebsite\",\n \"obs:bucket:PutBucketCustomDomainConfiguration\",\n \"obs:bucket:PutBucketWebsite\",\n \"dns:recordset:create\",\n \"dns:recordset:list\",\n \"dns:zone:get\",\n \"dns:zone:list\"\n ],\n \"Resource\": [\n \"*\"\n ]\n }\n ]\n}\n```\n\n## Notes\n\n- If you run `verify_obs_website.py` with `--bucket-name/--region`, `obs:bucket:HeadBucket` and `obs:bucket:GetBucketLocation` are required.\n- If you only configure bucket-level static website hosting and do not use a custom domain, DNS permissions are optional.\n- If you use a custom domain, both OBS and DNS permissions above are required.\n","content_type":"text/markdown; charset=utf-8","language":"markdown","size":2071,"content_sha256":"a6fabba9d5127b540f06811a5ac0626ddb6e80016d393f99cca12b55f16eae49"},{"filename":"references/obs-python-sdk-website.md","content":"# OBS Python SDK Website Configuration Notes\n\nUse Huawei Cloud OBS Python SDK (`esdk-obs-python >= 3.x`) for static website hosting configuration.\n\n## SDK package\n\n- Install: `pip install esdk-obs-python`\n- Required imports:\n ```python\n from obs import ObsClient, WebsiteConfiguration, IndexDocument, ErrorDocument\n ```\n\n## Required action\n\nUse SDK method for bucket website configuration:\n\n```python\nwebsite = WebsiteConfiguration(\n indexDocument=IndexDocument(suffix='index.html'),\n errorDocument=ErrorDocument(key='error.html') # optional\n)\nresp = client.setBucketWebsite('bucket-name', website)\n```\n\n**⚠️ Breaking Change:** \nThe older SDK style used keyword arguments such as `setBucketWebsite(bucketName, indexDocumentSuffix=..., errorDocument=...)`. That pattern is **deprecated in `esdk-obs-python >= 3.x`**. The new API requires a `WebsiteConfiguration` object. `indexDocument` must be an `IndexDocument(suffix='...')` object, and `errorDocument` must be an `ErrorDocument(key='...')` object.\n\n### Custom domain registration\n\nIf you need a custom domain, you must register it on the OBS bucket in addition to creating the DNS CNAME record:\n\n```python\n# Register a custom domain on the bucket (HTTP mode)\nresp = client.setBucketCustomDomain('bucket-name', 'www.example.com')\n```\n\n### Custom domain HTTPS\n\nOBS static website hosting serves HTTP by default, but it **does support HTTPS on a custom domain** by attaching an SSL certificate directly to the bucket custom domain (no CDN required). Only international (general) certificates are supported, not SM (Chinese national crypto) certificates. Configuration only works over HTTPS API requests.\n\nTwo ways to attach a certificate:\n\n```python\n# 1) Direct PEM upload: provide name + certificate + privateKey\ncert_info = {\n \"name\": \"cert-name\", # 3-63 chars\n \"certificate\": \"-----BEGIN CERTIFICATE-----\\n...\", # PEM, line breaks escaped with \\n\n \"privateKey\": \"-----BEGIN RSA PRIVATE KEY-----\\n...\" # no passphrase-protected keys\n}\nresp = client.setBucketCustomDomain('bucket-name', 'www.example.com', certificateInfo=cert_info)\n\n# 2) Reference a CCM certificate by ID (Cloud Certificate Manager)\ncert_info = {\n \"name\": \"cert-name\", # 3-63 chars\n \"certificateId\": \"xxxxxxxxxxxxxxxx\" # 16-char CCM certificate ID\n}\nresp = client.setBucketCustomDomain('bucket-name', 'www.example.com', certificateInfo=cert_info)\n\n# Query registered custom domains\nresp = client.getBucketCustomDomain('bucket-name')\n# resp.body == {'domains': [{'domainName': 'www.example.com', 'createTime': '...'}]}\n\n# Delete a custom domain\nresp = client.deleteBucketCustomDomain('bucket-name', 'www.example.com')\n```\n\nHTTPS constraints:\n- OBS only hosts HTTPS certificates on **custom domains** (not the default bucket domain, which is managed by Huawei Cloud).\n- Only international (general) certificates; SM (national crypto) certificates are not supported.\n- At least one international certificate must be configured before a CA certificate.\n- Max one international certificate + one CA certificate per custom domain; max 100 custom domains per bucket.\n- Certificate binding takes effect within about 60 seconds.\n- Bucket names **containing dots (`.`)** may cause HTTPS certificate verification failures on the client; use a custom domain instead.\n\n## Minimal flow\n\n1. Create `ObsClient` with AK/SK and OBS endpoint.\n2. Create `WebsiteConfiguration` with `IndexDocument` (and optional `ErrorDocument`).\n3. Call `client.setBucketWebsite(bucket_name, website)`.\n4. If custom domain needed, call `client.setBucketCustomDomain(bucket_name, domain_name)`.\n5. If HTTPS on the custom domain is required, attach a certificate via the `certificateInfo` dict (PEM or CCM `certificateId`).\n6. Check the HTTP status code (`2xx` expected).\n7. Verify the website endpoint with an HTTP GET to the root path (`verify_obs_website.py` always checks both HTTP and HTTPS, including TLS certificate validation).\n\n## Common failures\n\n- `setBucketWebsite` with `unexpected keyword argument 'indexDocumentSuffix'` → use the new `WebsiteConfiguration` object style\n- `403`: two common causes must both be considered and reported to the user: missing policy/ACL for anonymous public read, or insufficient AK/SK IAM permissions for website configuration / verification APIs.\n- `404`: wrong index document key or file not uploaded.\n- DNS mismatch: custom domain CNAME does not point to OBS website endpoint.\n- Custom domain not reachable: `setBucketCustomDomain` not called on the bucket (DNS alone is insufficient).\n- HTTPS certificate verification failure: the custom domain has no bound valid certificate (bind a certificate via `setBucketCustomDomain(certificateInfo=...)`, use a CCM certificate, or front OBS with CDN and terminate TLS there).\n","content_type":"text/markdown; charset=utf-8","language":"markdown","size":4833,"content_sha256":"68630dc34f95a82b0a2397074c668d6c307873a4843b4992d4d40a2a14f05e78"},{"filename":"references/verification-method.md","content":"# Validation Rules\n\n- The website endpoint should follow `BucketName.obs.\u003cregion>.myhuaweicloud.com`.\n- Public read must be enabled for website files, or the site will return access errors.\n- A custom domain must point to the OBS website endpoint with a CNAME record.\n- Treat DNS propagation as eventual; the setup is not complete until name resolution works.\n- Root path verification and one missing-path check are mandatory.\n","content_type":"text/markdown; charset=utf-8","language":"markdown","size":427,"content_sha256":"53a36eddb41fc7c9cb4c58e5478243623a2ac1f50d1c8eab680814c1ded6e73a"},{"filename":"scripts/set_obs_website_sdk.py","content":"#!/usr/bin/env python3\nimport argparse\nimport os\nfrom pathlib import Path\nimport sys\n\n\ndef build_parser() -> argparse.ArgumentParser:\n p = argparse.ArgumentParser(\n description=\"Set OBS static website hosting via Huawei OBS Python SDK\"\n )\n p.add_argument(\"bucket_name\", help=\"OBS bucket name\")\n p.add_argument(\"endpoint\", help=\"OBS endpoint, e.g. https://obs.\u003cregion>.myhuaweicloud.com\")\n p.add_argument(\"--index-document\", default=\"index.html\", help=\"Index document key\")\n p.add_argument(\"--error-document\", default=\"\", help=\"Error document key (optional)\")\n p.add_argument(\n \"--custom-domain\",\n required=True,\n help=\"Custom domain to register on the bucket (required)\",\n )\n p.add_argument(\n \"--access-key\",\n default=\"\",\n help=\"AK (optional; defaults to HW_ACCESS_KEY or ~/.obsutilconfig)\",\n )\n p.add_argument(\n \"--secret-key\",\n default=\"\",\n help=\"SK (optional; defaults to HW_SECRET_KEY or ~/.obsutilconfig)\",\n )\n p.add_argument(\n \"--security-token\",\n default=\"\",\n help=\"Security token (optional; defaults to HW_SECURITY_TOKEN or ~/.obsutilconfig)\",\n )\n p.add_argument(\n \"--obsutil-config\",\n default=str(Path.home() / \".obsutilconfig\"),\n help=\"obsutil config file path (default: ~/.obsutilconfig)\",\n )\n p.add_argument(\n \"--certificate\",\n default=\"\",\n help=\"HTTPS certificate (PEM) to attach to the custom domain. Requires --private-key and --certificate-name.\",\n )\n p.add_argument(\n \"--private-key\",\n default=\"\",\n help=\"Private key (PEM) matching --certificate. Requires --certificate and --certificate-name.\",\n )\n p.add_argument(\n \"--certificate-name\",\n default=\"\",\n help=\"Certificate name (3-63 chars) for the custom domain HTTPS binding.\",\n )\n p.add_argument(\n \"--certificate-id\",\n default=\"\",\n help=\"CCM certificate ID (16 chars) from Cloud Certificate Manager, alternative to PEM direct upload.\",\n )\n return p\n\n\ndef read_obsutil_config(path: str) -> dict[str, str]:\n cfg: dict[str, str] = {}\n p = Path(path).expanduser()\n if not p.exists():\n return cfg\n try:\n text = p.read_text(encoding=\"utf-8\", errors=\"ignore\")\n except Exception:\n return cfg\n for line in text.splitlines():\n s = line.strip()\n if not s or s.startswith(\"#\") or \"=\" not in s:\n continue\n key, value = s.split(\"=\", 1)\n cfg[key.strip().lower()] = value.strip()\n return cfg\n\n\ndef pick_credential(cli_val: str, env_val: str, cfg: dict[str, str], cfg_keys: tuple[str, ...]) -> str:\n if cli_val:\n return cli_val\n if env_val:\n return env_val\n for key in cfg_keys:\n val = cfg.get(key, \"\")\n if val:\n return val\n return \"\"\n\n\ndef build_cert_info(\n name: str, certificate: str, private_key: str, certificate_id: str\n) -> dict[str, str]:\n cert_info: dict[str, str] = {\"name\": name}\n if certificate or private_key:\n if not certificate or not private_key:\n raise SystemExit(\n \"--certificate and --private-key must be provided together \"\n \"when attaching a PEM certificate\"\n )\n cert_info[\"certificate\"] = certificate\n cert_info[\"privateKey\"] = private_key\n elif certificate_id:\n cert_info[\"certificateId\"] = certificate_id\n else:\n raise SystemExit(\n \"--certificate-name requires either --certificate/--private-key \"\n \"or --certificate-id\"\n )\n return cert_info\n\n\ndef main() -> int:\n parser = build_parser()\n args = parser.parse_args()\n custom_domain = args.custom_domain.strip()\n if not custom_domain:\n parser.error(\"--custom-domain must not be blank\")\n\n cert_info: dict[str, str] | None = None\n if args.certificate_name:\n if not (3 \u003c= len(args.certificate_name) \u003c= 63):\n parser.error(\"--certificate-name must be 3-63 characters long\")\n if args.certificate_id and len(args.certificate_id) != 16:\n parser.error(\"--certificate-id must be a 16-character CCM certificate ID\")\n cert_info = build_cert_info(\n args.certificate_name.strip(),\n args.certificate,\n args.private_key,\n args.certificate_id.strip(),\n )\n\n cfg = read_obsutil_config(args.obsutil_config)\n access_key = pick_credential(\n args.access_key,\n os.getenv(\"HW_ACCESS_KEY\", \"\"),\n cfg,\n (\"ak\", \"access_key_id\"),\n )\n secret_key = pick_credential(\n args.secret_key,\n os.getenv(\"HW_SECRET_KEY\", \"\"),\n cfg,\n (\"sk\", \"secret_access_key\"),\n )\n security_token = pick_credential(\n args.security_token,\n os.getenv(\"HW_SECURITY_TOKEN\", \"\"),\n cfg,\n (\"securitytoken\", \"security_token\", \"token\"),\n )\n\n missing = []\n if not access_key:\n missing.append(\"ak\")\n if not secret_key:\n missing.append(\"sk\")\n if missing:\n print(\n \"missing credentials: \"\n + \", \".join(missing)\n + \". Fill them in ~/.obsutilconfig (or pass CLI args / env vars).\",\n file=sys.stderr,\n )\n print(\n \"checked sources: --access-key/--secret-key, HW_ACCESS_KEY/HW_SECRET_KEY, and obsutil config file.\",\n file=sys.stderr,\n )\n return 2\n\n try:\n from obs import ObsClient, WebsiteConfiguration, IndexDocument, ErrorDocument # type: ignore # noqa: E501\n except Exception as exc: # noqa: BLE001\n print(f\"obs sdk not available: {exc}\", file=sys.stderr)\n print(\"install with: pip install esdk-obs-python\", file=sys.stderr)\n return 2\n\n client = ObsClient(\n access_key_id=access_key,\n secret_access_key=secret_key,\n security_token=security_token or None,\n server=args.endpoint,\n )\n\n try:\n # NOTE: esdk-obs-python >= 3.x requires WebsiteConfiguration model objects.\n # setBucketWebsite(bucketName, website, extensionHeaders=None)\n # where website is a WebsiteConfiguration with IndexDocument/ErrorDocument.\n index_doc = IndexDocument(suffix=args.index_document)\n if args.error_document:\n error_doc = ErrorDocument(key=args.error_document)\n website = WebsiteConfiguration(indexDocument=index_doc, errorDocument=error_doc)\n else:\n website = WebsiteConfiguration(indexDocument=index_doc)\n website_resp = client.setBucketWebsite(args.bucket_name, website)\n\n if cert_info:\n custom_domain_resp = client.setBucketCustomDomain(\n args.bucket_name, custom_domain, certificateInfo=cert_info\n )\n else:\n custom_domain_resp = client.setBucketCustomDomain(args.bucket_name, custom_domain)\n except Exception as exc: # noqa: BLE001\n print(f\"OBS configuration failed: {exc}\", file=sys.stderr)\n return 1\n finally:\n client.close()\n\n website_status = getattr(website_resp, \"status\", None)\n if website_status is None or not (200 \u003c= int(website_status) \u003c 300):\n print(f\"setBucketWebsite unexpected status: {website_status}\", file=sys.stderr)\n return 1\n\n custom_domain_status = getattr(custom_domain_resp, \"status\", None)\n if custom_domain_status is None or not (200 \u003c= int(custom_domain_status) \u003c 300):\n print(\n f\"setBucketCustomDomain unexpected status: {custom_domain_status}\",\n file=sys.stderr,\n )\n return 1\n\n https_mode = \" with HTTPS certificate\" if cert_info else \"\"\n print(f\"ok: website hosting configured, custom domain {custom_domain} registered{https_mode}\")\n return 0\n\n\nif __name__ == \"__main__\":\n raise SystemExit(main())\n","content_type":"text/x-python; charset=utf-8","language":"python","size":7877,"content_sha256":"d12da70c5c571ea2d2e6aae2ff135d83d1c122e864b6cf9ba79e2f85d736b799"},{"filename":"scripts/verify_obs_website.py","content":"#!/usr/bin/env python3\nimport argparse\nimport json\nimport os\nfrom pathlib import Path\nimport socket\nimport sys\nfrom datetime import datetime, timezone\nimport urllib.error\nimport urllib.parse\nimport urllib.request\n\n\ndef fetch(url: str) -> tuple[int | None, str, str]:\n req = urllib.request.Request(url, method=\"GET\")\n try:\n with urllib.request.urlopen(req, timeout=15) as resp:\n return resp.getcode(), \"\", resp.geturl()\n except urllib.error.HTTPError as exc:\n return exc.code, f\"HTTPError: {exc.reason}\", exc.url or url\n except Exception as exc: # noqa: BLE001\n return None, str(exc), url\n\n\ndef resolve_domain(hostname: str) -> tuple[list[str], str]:\n try:\n _, _, ips = socket.gethostbyname_ex(hostname)\n if not ips:\n return [], \"no A record resolved\"\n return sorted(set(ips)), \"\"\n except Exception as exc: # noqa: BLE001\n return [], str(exc)\n\n\ndef remediation_for_check(name: str, status: int | None, error: str) -> str:\n error_l = (error or \"\").lower()\n if \"certificate_verify_failed\" in error_l or \"hostname mismatch\" in error_l:\n return (\n \"TLS certificate mismatch. Bind a valid certificate for this custom domain \"\n \"or front OBS with CDN/ELB and terminate TLS there.\"\n )\n if status == 403:\n return (\n \"HTTP 403 has two common causes in this workflow: \"\n \"the bucket/object policy does not allow anonymous public read for website access, \"\n \"or the AK/SK used for OBS SDK checks/configuration lacks required IAM permissions. \"\n \"Verify both the website public-read policy/ACL and IAM actions such as \"\n \"obs:bucket:HeadBucket, obs:bucket:GetBucketLocation, and obs:bucket:PutBucketWebsite.\"\n )\n if status == 404:\n if name in {\"root_path\", \"index_document\"}:\n return \"Verify index document key/path and confirm website configuration points to the right index.\"\n return \"If a custom error page is configured, 404 can be expected; otherwise verify missing-path behavior.\"\n if status == 301 or status == 302:\n return \"Check whether endpoint/domain is redirecting unexpectedly; use the OBS website endpoint.\"\n if status is None:\n return f\"Network or DNS error: {error}. Verify domain resolution and endpoint reachability.\"\n if status >= 500:\n return \"Server-side failure. Retry and check OBS service health/endpoint correctness.\"\n return \"Review endpoint, website config, and object paths.\"\n\n\ndef read_obsutil_config(path: str) -> dict[str, str]:\n cfg: dict[str, str] = {}\n p = Path(path).expanduser()\n if not p.exists():\n return cfg\n try:\n text = p.read_text(encoding=\"utf-8\", errors=\"ignore\")\n except Exception:\n return cfg\n for line in text.splitlines():\n s = line.strip()\n if not s or s.startswith(\"#\") or \"=\" not in s:\n continue\n key, value = s.split(\"=\", 1)\n cfg[key.strip().lower()] = value.strip()\n return cfg\n\n\ndef pick_credential(\n cli_val: str, env_val: str, cfg: dict[str, str], cfg_keys: tuple[str, ...]\n) -> str:\n if cli_val:\n return cli_val\n if env_val:\n return env_val\n for key in cfg_keys:\n val = cfg.get(key, \"\")\n if val:\n return val\n return \"\"\n\n\ndef run_bucket_region_check(\n bucket_name: str,\n obs_endpoint: str,\n expected_region: str,\n access_key: str,\n secret_key: str,\n security_token: str,\n) -> dict[str, object]:\n result: dict[str, object] = {\n \"enabled\": True,\n \"bucket_name\": bucket_name,\n \"obs_endpoint\": obs_endpoint,\n \"expected_region\": expected_region,\n \"actual_region\": \"\",\n \"head_bucket_status\": None,\n \"get_bucket_location_status\": None,\n \"passed\": False,\n \"error\": \"\",\n }\n\n if not access_key or not secret_key:\n result[\"error\"] = \"missing AK/SK. Set HW_ACCESS_KEY and HW_SECRET_KEY (or pass --access-key/--secret-key).\"\n return result\n\n try:\n from obs import ObsClient # type: ignore\n except Exception as exc: # noqa: BLE001\n result[\"error\"] = f\"OBS SDK not available: {exc}. Install with: pip install esdk-obs-python\"\n return result\n\n client = ObsClient(\n access_key_id=access_key,\n secret_access_key=secret_key,\n security_token=security_token or None,\n server=obs_endpoint,\n )\n try:\n head = client.headBucket(bucket_name)\n head_status = int(getattr(head, \"status\", 0) or 0)\n result[\"head_bucket_status\"] = head_status\n if not (200 \u003c= head_status \u003c 300):\n result[\"error\"] = f\"headBucket returned non-2xx status: {head_status}\"\n return result\n\n location = client.getBucketLocation(bucket_name)\n location_status = int(getattr(location, \"status\", 0) or 0)\n result[\"get_bucket_location_status\"] = location_status\n if not (200 \u003c= location_status \u003c 300):\n result[\"error\"] = f\"getBucketLocation returned non-2xx status: {location_status}\"\n return result\n\n actual_region = str(getattr(getattr(location, \"body\", None), \"location\", \"\") or \"\")\n result[\"actual_region\"] = actual_region\n if expected_region and actual_region and actual_region != expected_region:\n result[\"error\"] = f\"region mismatch: expected={expected_region}, actual={actual_region}\"\n return result\n\n result[\"passed\"] = True\n return result\n except Exception as exc: # noqa: BLE001\n result[\"error\"] = str(exc)\n return result\n finally:\n client.close()\n\n\ndef main() -> int:\n parser = argparse.ArgumentParser(\n description=\"Verify Huawei OBS static website endpoint\"\n )\n parser.add_argument(\n \"--bucket-name\",\n required=True,\n help=\"OBS bucket name\",\n )\n parser.add_argument(\n \"--region\",\n required=True,\n help=\"OBS region, for example cn-north-4\",\n )\n parser.add_argument(\n \"--domain\",\n default=\"\",\n help=(\n \"Custom domain to verify instead of the default OBS website endpoint \"\n \"(optional; host or URL)\"\n ),\n )\n parser.add_argument(\n \"--index-document\",\n default=\"index.html\",\n help=\"Index document key (default: index.html)\",\n )\n parser.add_argument(\n \"--json\",\n action=\"store_true\",\n help=\"Output machine-readable JSON report\",\n )\n parser.add_argument(\n \"--access-key\",\n default=\"\",\n help=\"AK for optional bucket SDK check (defaults to HW_ACCESS_KEY)\",\n )\n parser.add_argument(\n \"--secret-key\",\n default=\"\",\n help=\"SK for optional bucket SDK check (defaults to HW_SECRET_KEY)\",\n )\n parser.add_argument(\n \"--security-token\",\n default=\"\",\n help=\"Security token for optional bucket SDK check (defaults to HW_SECURITY_TOKEN or ~/.obsutilconfig)\",\n )\n parser.add_argument(\n \"--obsutil-config\",\n default=str(Path.home() / \".obsutilconfig\"),\n help=\"obsutil config file path for optional bucket SDK check (default: ~/.obsutilconfig)\",\n )\n parser.add_argument(\n \"--https\",\n action=\"store_true\",\n help=(\n \"Deprecated no-op: HTTPS verification is now always performed \"\n \"(kept for backward compatibility).\"\n ),\n )\n args = parser.parse_args()\n\n raw_domain = args.domain.strip()\n if raw_domain:\n if \"://\" in raw_domain:\n parsed = urllib.parse.urlparse(raw_domain)\n else:\n parsed = urllib.parse.urlparse(f\"http://{raw_domain}\")\n else:\n parsed = urllib.parse.urlparse(\n f\"http://{args.bucket_name}.obs.{args.region}.myhuaweicloud.com\"\n )\n\n if not parsed.netloc and parsed.path:\n # Handle plain host input like \"example.com\" parsed into path.\n parsed = urllib.parse.urlparse(f\"http://{parsed.path}\")\n\n host_port = parsed.netloc\n if not host_port:\n print(f\"invalid domain: {args.domain}\", file=sys.stderr)\n return 2\n\n path_prefix = parsed.path.rstrip(\"/\")\n # Always verify both HTTP and HTTPS so TLS certificate problems (e.g. a\n # custom domain with an invalid/unbound certificate) are detected, matching\n # the SKILL.md HTTPS/TLS verification guarantees.\n scheme_bases = [\n (\"http\", f\"http://{host_port}{path_prefix}\"),\n (\"https\", f\"https://{host_port}{path_prefix}\"),\n ]\n raw_site = scheme_bases[0][1]\n\n checks: list[dict[str, object]] = []\n verification_target = \"custom_domain\" if raw_domain else \"default_obs_domain\"\n for scheme, base in scheme_bases:\n checks.extend(\n [\n {\n \"scheme\": scheme,\n \"name\": \"root_path\",\n \"url\": f\"{base}/\",\n \"expected\": \"HTTP 200\",\n \"pass_statuses\": {200},\n },\n {\n \"scheme\": scheme,\n \"name\": \"index_document\",\n \"url\": f\"{base}/{args.index_document}\",\n \"expected\": \"HTTP 200\",\n \"pass_statuses\": {200},\n },\n {\n \"scheme\": scheme,\n \"name\": \"missing_path\",\n \"url\": f\"{base}/nonexistent-path\",\n \"expected\": \"HTTP 404 or configured custom error page behavior\",\n \"pass_statuses\": {404, 200},\n \"advisory_only\": True,\n },\n ]\n )\n\n domain = parsed.hostname or \"\"\n dns_ips, dns_error = ([], \"\")\n if domain:\n dns_ips, dns_error = resolve_domain(domain)\n\n results: list[dict[str, object]] = []\n dns_passed = bool(dns_ips) if domain else True\n all_passed = dns_passed\n remediation_steps: list[str] = []\n bucket_check: dict[str, object] = {\"enabled\": False}\n\n if not dns_passed:\n remediation_steps.append(\n f\"DNS resolution failed for {domain}: {dns_error}. Verify A/CNAME record and propagation.\"\n )\n\n actions_performed = [\"DNS resolution check for endpoint domain\"]\n obs_endpoint = f\"https://obs.{args.region}.myhuaweicloud.com\"\n cfg = read_obsutil_config(args.obsutil_config)\n access_key = pick_credential(\n args.access_key,\n os.getenv(\"HW_ACCESS_KEY\", \"\"),\n cfg,\n (\"ak\", \"access_key_id\"),\n )\n secret_key = pick_credential(\n args.secret_key,\n os.getenv(\"HW_SECRET_KEY\", \"\"),\n cfg,\n (\"sk\", \"secret_access_key\"),\n )\n security_token = pick_credential(\n args.security_token,\n os.getenv(\"HW_SECURITY_TOKEN\", \"\"),\n cfg,\n (\"securitytoken\", \"security_token\", \"token\"),\n )\n bucket_check = run_bucket_region_check(\n bucket_name=args.bucket_name,\n obs_endpoint=obs_endpoint,\n expected_region=args.region,\n access_key=access_key,\n secret_key=secret_key,\n security_token=security_token,\n )\n actions_performed.append(\"OBS SDK read-only check: headBucket + getBucketLocation\")\n if not bool(bucket_check.get(\"passed\", False)):\n all_passed = False\n error = str(bucket_check.get(\"error\", \"\") or \"bucket/region check failed\")\n if \"403\" in error:\n remediation = (\n f\"Bucket/region check failed: {error}. \"\n \"When troubleshooting 403, tell the user both common possibilities: \"\n \"the bucket/object is not public-read for website access, or the AK/SK lacks \"\n \"required IAM permissions. Verify bucket public-read policy/ACL and IAM actions \"\n \"such as obs:bucket:HeadBucket and obs:bucket:GetBucketLocation.\"\n )\n else:\n remediation = (\n f\"Bucket/region check failed: {error}. \"\n \"Verify bucket name, OBS endpoint, region, and IAM permissions.\"\n )\n remediation_steps.append(remediation)\n\n for scheme, _base in scheme_bases:\n actions_performed.extend(\n [\n f\"HTTP GET root path over {scheme.upper()}\",\n f\"HTTP GET index document over {scheme.upper()}\",\n f\"HTTP GET missing path over {scheme.upper()}\",\n ]\n )\n\n for check in checks:\n status, error, final_url = fetch(check[\"url\"])\n passed = status in check[\"pass_statuses\"]\n advisory_only = bool(check.get(\"advisory_only\", False))\n if not passed and not advisory_only:\n all_passed = False\n remediation = remediation_for_check(check[\"name\"], status, error)\n if remediation not in remediation_steps:\n remediation_steps.append(remediation)\n else:\n remediation = \"\"\n results.append(\n {\n \"name\": check[\"name\"],\n \"scheme\": check[\"scheme\"],\n \"url\": check[\"url\"],\n \"expected\": check[\"expected\"],\n \"status\": status,\n \"final_url\": final_url,\n \"passed\": passed,\n \"advisory_only\": advisory_only,\n \"error\": error,\n \"remediation\": remediation,\n }\n )\n\n report = {\n \"input_summary\": {\n \"site_url\": raw_site,\n \"bucket_name\": args.bucket_name,\n \"region\": args.region,\n \"domain_override\": raw_domain,\n \"verification_target\": verification_target,\n \"target_host\": host_port,\n \"checked_schemes\": [scheme for scheme, _base in scheme_bases],\n \"index_document\": args.index_document,\n \"checked_at_utc\": datetime.now(timezone.utc).isoformat(),\n \"domain\": domain,\n },\n \"actions_performed\": actions_performed,\n \"verification_results\": {\n \"bucket_region\": bucket_check,\n \"dns\": {\n \"domain\": domain,\n \"resolved_ips\": dns_ips,\n \"passed\": dns_passed,\n \"error\": dns_error,\n },\n \"http_checks\": results,\n \"overall_passed\": all_passed,\n },\n \"remediation_steps\": remediation_steps,\n }\n\n if args.json:\n print(json.dumps(report, ensure_ascii=True, indent=2))\n else:\n print(\"Input summary:\")\n print(f\"- site_url: {report['input_summary']['site_url']}\")\n print(f\"- bucket_name: {report['input_summary']['bucket_name']}\")\n print(f\"- region: {report['input_summary']['region']}\")\n print(f\"- domain_override: {report['input_summary']['domain_override'] or 'none'}\")\n print(f\"- verification_target: {report['input_summary']['verification_target']}\")\n print(f\"- target_host: {report['input_summary']['target_host']}\")\n print(f\"- checked_schemes: {','.join(report['input_summary']['checked_schemes'])}\")\n print(f\"- index_document: {report['input_summary']['index_document']}\")\n print(f\"- checked_at_utc: {report['input_summary']['checked_at_utc']}\")\n print(f\"- domain: {report['input_summary']['domain']}\")\n print()\n print(\"Actions performed:\")\n for action in report[\"actions_performed\"]:\n print(f\"- {action}\")\n print()\n print(\"Verification results:\")\n bucket_region_report = report[\"verification_results\"][\"bucket_region\"]\n if bucket_region_report.get(\"enabled\"):\n if bucket_region_report.get(\"passed\"):\n print(\n \"- bucket_region: PASS \"\n f\"(bucket={bucket_region_report['bucket_name']}; \"\n f\"expected_region={bucket_region_report['expected_region'] or 'n/a'}; \"\n f\"actual_region={bucket_region_report['actual_region'] or 'unknown'})\"\n )\n else:\n print(\n \"- bucket_region: FAIL \"\n f\"({bucket_region_report.get('error', 'unknown error')})\"\n )\n dns_report = report[\"verification_results\"][\"dns\"]\n if dns_report[\"passed\"]:\n print(f\"- dns: PASS (resolved_ips={','.join(dns_report['resolved_ips'])})\")\n else:\n print(f\"- dns: FAIL ({dns_report['error']})\")\n for item in report[\"verification_results\"][\"http_checks\"]:\n status_text = \"PASS\" if item[\"passed\"] else \"FAIL\"\n observed = item[\"status\"] if item[\"status\"] is not None else f\"ERROR ({item['error']})\"\n print(\n f\"- {item['scheme']} {item['name']}: {status_text} \"\n f\"(expected: {item['expected']}; observed: {observed}; url: {item['url']})\"\n )\n print(f\"- overall: {'PASS' if report['verification_results']['overall_passed'] else 'FAIL'}\")\n print()\n if remediation_steps:\n print(\"Remediation steps:\")\n for step in remediation_steps:\n print(f\"- {step}\")\n else:\n print(\"Remediation steps:\")\n print(\"- none\")\n\n return 0 if all_passed else 1\n\n\nif __name__ == \"__main__\":\n raise SystemExit(main())\n","content_type":"text/x-python; charset=utf-8","language":"python","size":17306,"content_sha256":"ba5c4ec9616edd34fd397ab1e6b24628f7513adc3f8393922f9f58a1d91ad920"}],"content_json":{"type":"doc","content":[{"type":"heading","attrs":{"level":1},"content":[{"text":"Huawei Cloud OBS Website Host","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"Configure an existing Huawei Cloud OBS bucket for static website hosting with Huawei Cloud OBS Python SDK and register a custom domain for the site.","type":"text"}]},{"type":"paragraph","content":[{"text":"Use this skill when the user wants to:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"enable or repair OBS static website hosting","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"set an index document or error document","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"make the site reachable through a custom domain backed by the OBS static website endpoint","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"add or repair a custom domain, including Huawei Cloud DNS when applicable","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"diagnose 403, 404, or DNS issues on a hosted OBS site","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"What Good Looks Like","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"The bucket has static website hosting enabled.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"The bucket can serve ","type":"text"},{"text":"index.html","type":"text","marks":[{"type":"code_inline"}]},{"text":" from the website endpoint.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Anonymous users can read the website content.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"A missing path returns the configured error page or a clean 404.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"A custom domain is registered and resolves to the OBS website endpoint through DNS. A custom domain is ","type":"text"},{"text":"mandatory","type":"text","marks":[{"type":"strong"}]},{"text":" — the default OBS bucket domain is not permitted for online object preview per security compliance requirements.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"The setup is not considered complete until the custom domain is registered on the bucket and resolves correctly.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"The OBS website endpoint is used, not the regular bucket API endpoint.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"A 403 usually has two common causes: anonymous/public read is not enabled on the bucket or objects, or the AK/SK used for OBS operations lacks required IAM permissions.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"A 404 usually means the index document name or upload path is wrong.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Security Compliance: Custom Domain Requirement","type":"text"}]},{"type":"paragraph","content":[{"text":"Based on Huawei Cloud security compliance requirements, the OBS bucket default domain name (","type":"text"},{"text":"\u003cbucket_name>.obs.\u003cregion>.myhuaweicloud.com","type":"text","marks":[{"type":"code_inline"}]},{"text":") is ","type":"text"},{"text":"prohibited","type":"text","marks":[{"type":"strong"}]},{"text":" from being used for online preview of objects within the bucket. A custom domain is therefore ","type":"text"},{"text":"mandatory","type":"text","marks":[{"type":"strong"}]},{"text":" for static website hosting.","type":"text"}]},{"type":"paragraph","content":[{"text":"If the user does not have a custom domain prepared:","type":"text"}]},{"type":"ordered_list","attrs":{"order":1,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Direct the user to register a domain through the ","type":"text"},{"text":"Huawei Cloud Domain Registration Service","type":"text","marks":[{"type":"link","attrs":{"href":"https://www.huaweicloud.com/product/domain.html","title":null}}]},{"text":", or other common domain registration sites.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"For users in mainland China, the domain must also complete ","type":"text"},{"text":"ICP filing (网站备案)","type":"text","marks":[{"type":"strong"}]},{"text":" before it can be used for website hosting.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Only after the domain is registered (and filed, if applicable) should the static website hosting configuration continue.","type":"text"}]}]}]},{"type":"blockquote","content":[{"type":"paragraph","content":[{"text":"Important:","type":"text","marks":[{"type":"strong"}]},{"text":" Do not proceed with static website hosting configuration until the custom domain prerequisite is confirmed. The default OBS domain is not a valid alternative for website access even in the testing environment.","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Required Inputs","type":"text"}]},{"type":"paragraph","content":[{"text":"Collect these before making changes:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"region","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"bucket_name","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"custom_domain","type":"text","marks":[{"type":"code_inline"}]},{"text":" (","type":"text"},{"text":"required","type":"text","marks":[{"type":"strong"}]},{"text":" — see Security Compliance section above)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"index_document","type":"text","marks":[{"type":"code_inline"}]},{"text":" (optional, default: ","type":"text"},{"text":"index.html","type":"text","marks":[{"type":"code_inline"}]},{"text":")","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"error_document","type":"text","marks":[{"type":"code_inline"}]},{"text":" (optional)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"dns_zone","type":"text","marks":[{"type":"code_inline"}]},{"text":" or DNS account context (optional; required only if the user wants Huawei Cloud DNS changes in this run)","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Assume static website files are already uploaded by the user.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Dependencies","type":"text"}]},{"type":"paragraph","content":[{"text":"The skill depends on the following runtime/tooling components:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Python 3.10+ (required for ","type":"text"},{"text":"scripts/set_obs_website_sdk.py","type":"text","marks":[{"type":"code_inline"}]},{"text":" and ","type":"text"},{"text":"scripts/verify_obs_website.py","type":"text","marks":[{"type":"code_inline"}]},{"text":")","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Huawei OBS Python SDK package: ","type":"text"},{"text":"esdk-obs-python","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"obsutil","type":"text","marks":[{"type":"code_inline"}]},{"text":" (for generating and maintaining ","type":"text"},{"text":".obsutilconfig","type":"text","marks":[{"type":"code_inline"}]},{"text":" credential config)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Huawei Cloud AK/SK credentials (from ","type":"text"},{"text":".obsutilconfig","type":"text","marks":[{"type":"code_inline"}]},{"text":")","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Network access to OBS endpoint and website endpoint","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"hcloud","type":"text","marks":[{"type":"code_inline"}]},{"text":" CLI (required only when this skill manages Huawei Cloud DNS record operations)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"dig / nslookup (optional)","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Install command:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"pip install esdk-obs-python","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"hcloud CLI Reference","type":"text"}]},{"type":"paragraph","content":[{"text":"Load ","type":"text"},{"text":"references/cli-installation-guide.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" when hcloud CLI or obsutil installation and configuration is needed. Load ","type":"text"},{"text":"references/hcloud-dns-obs-website.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" when creating or managing DNS CNAME records for OBS static website custom domains (step-by-step guide with hcloud ","type":"text"},{"text":"DNS CreateRecordSet","type":"text","marks":[{"type":"code_inline"}]},{"text":" commands).","type":"text"}]},{"type":"paragraph","content":[{"text":"Security note:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Never hardcode AK/SK in scripts or checked-in files.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Prefer environment variables for SDK scripts and secure local profile storage for CLI use.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"obsutil Config Dependency","type":"text"}]},{"type":"paragraph","content":[{"text":"Load ","type":"text"},{"text":"references/cli-installation-guide.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" when you need obsutil installation or ","type":"text"},{"text":".obsutilconfig","type":"text","marks":[{"type":"code_inline"}]},{"text":" setup guidance.","type":"text"}]},{"type":"paragraph","content":[{"text":"The Python SDK helper script (","type":"text"},{"text":"scripts/set_obs_website_sdk.py","type":"text","marks":[{"type":"code_inline"}]},{"text":") reads credentials by default from:","type":"text"}]},{"type":"ordered_list","attrs":{"order":1,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"CLI flags (","type":"text"},{"text":"--access-key","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"--secret-key","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"--security-token","type":"text","marks":[{"type":"code_inline"}]},{"text":")","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Environment variables (","type":"text"},{"text":"HW_ACCESS_KEY","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"HW_SECRET_KEY","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"HW_SECURITY_TOKEN","type":"text","marks":[{"type":"code_inline"}]},{"text":")","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":".obsutilconfig","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"paragraph","content":[{"text":"If ","type":"text"},{"text":"ak","type":"text","marks":[{"type":"code_inline"}]},{"text":"/","type":"text"},{"text":"sk","type":"text","marks":[{"type":"code_inline"}]},{"text":" are empty across all sources, the script must stop and ask the user to fill missing keys in ","type":"text"},{"text":".obsutilconfig","type":"text","marks":[{"type":"code_inline"}]},{"text":" (or provide CLI/env credentials).","type":"text"}]},{"type":"paragraph","content":[{"text":"Credential check rule:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Only report presence/absence of keys (","type":"text"},{"text":"ak","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"sk","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"securitytoken","type":"text","marks":[{"type":"code_inline"}]},{"text":").","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Never print credential values during checks.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Never print full lines from ","type":"text"},{"text":".obsutilconfig","type":"text","marks":[{"type":"code_inline"}]},{"text":" to console.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Treat console output as model context; any leaked value is a security incident.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Safe check examples (status only, no secret values):","type":"text"}]},{"type":"paragraph","content":[{"text":"Linux/macOS:","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"CFG=\"${HOME}/.obsutilconfig\"\nif [ ! -f \"$CFG\" ]; then\n echo \"obsutilconfig_exists=false\"\n echo \"ak_configured=false\"\n echo \"sk_configured=false\"\n echo \"securitytoken_configured=false\"\nelse\n awk -F= '\n BEGIN { ak=0; sk=0; st=0 }\n /^[[:space:]]*#/ { next }\n /^[[:space:]]*(ak|access_key_id)[[:space:]]*=/ { if ($2 ~ /[^[:space:]]/) ak=1 }\n /^[[:space:]]*(sk|secret_access_key)[[:space:]]*=/ { if ($2 ~ /[^[:space:]]/) sk=1 }\n /^[[:space:]]*(securitytoken|security_token|token)[[:space:]]*=/ { if ($2 ~ /[^[:space:]]/) st=1 }\n END {\n print \"obsutilconfig_exists=true\"\n print \"ak_configured=\" (ak ? \"true\" : \"false\")\n print \"sk_configured=\" (sk ? \"true\" : \"false\")\n print \"securitytoken_configured=\" (st ? \"true\" : \"false\")\n }\n ' \"$CFG\"\nfi","type":"text"}]},{"type":"paragraph","content":[{"text":"Windows (PowerShell):","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"powershell"},"content":[{"text":"$cfg = Join-Path $HOME \".obsutilconfig\"\nif (-not (Test-Path $cfg)) {\n \"obsutilconfig_exists=false\"\n \"ak_configured=false\"\n \"sk_configured=false\"\n \"securitytoken_configured=false\"\n} else {\n $lines = Get-Content $cfg\n $ak = $false; $sk = $false; $st = $false\n foreach ($line in $lines) {\n if ($line -match '^\\s*#') { continue }\n if ($line -match '^\\s*(ak|access_key_id)\\s*=\\s*(\\S.*)

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

) { $ak = $true }\n if ($line -match '^\\s*(sk|secret_access_key)\\s*=\\s*(\\S.*)

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

) { $sk = $true }\n if ($line -match '^\\s*(securitytoken|security_token|token)\\s*=\\s*(\\S.*)

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.

) { $st = $true }\n }\n \"obsutilconfig_exists=true\"\n \"ak_configured=$ak\"\n \"sk_configured=$sk\"\n \"securitytoken_configured=$st\"\n}","type":"text"}]},{"type":"paragraph","content":[{"text":"Do not use:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"cat ~/.obsutilconfig","type":"text","marks":[{"type":"code_inline"}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"grep -E \"ak|sk|token\" ~/.obsutilconfig","type":"text","marks":[{"type":"code_inline"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Script Usage Intent","type":"text"}]},{"type":"paragraph","content":[{"text":"Use the bundled scripts by default for the tasks they were built for:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"scripts/set_obs_website_sdk.py","type":"text","marks":[{"type":"code_inline"}]},{"text":" applies or updates the bucket website configuration and registers the required custom domain. Use it whenever the task is to enable, repair, or change OBS static website hosting settings.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"scripts/verify_obs_website.py","type":"text","marks":[{"type":"code_inline"}]},{"text":" validates the published website endpoint. Use it after any website configuration change, and also when the user asks whether the site is reachable or when troubleshooting 403/404 behavior.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Do not replace these scripts with ad hoc one-off code unless the script itself is broken and must be patched.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Use the scripts to keep credential handling, SDK object construction, and verification behavior consistent across runs.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Workflow","type":"text"}]},{"type":"ordered_list","attrs":{"order":1,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Verify Python runtime and OBS SDK are available (","type":"text"},{"text":"pip install esdk-obs-python","type":"text","marks":[{"type":"code_inline"}]},{"text":" if missing).","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Verify the custom domain prerequisite (see ","type":"text"},{"text":"Security Compliance","type":"text","marks":[{"type":"strong"}]},{"text":" section):","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Confirm ","type":"text"},{"text":"custom_domain","type":"text","marks":[{"type":"code_inline"}]},{"text":" is provided by the user.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"If the user does not have a domain, guide them to register one at ","type":"text"},{"text":"Huawei Cloud Domain Registration","type":"text","marks":[{"type":"link","attrs":{"href":"https://www.huaweicloud.com/product/domain.html","title":null}}]},{"text":" and complete ","type":"text"},{"text":"ICP filing (网站备案)","type":"text","marks":[{"type":"strong"}]},{"text":" for mainland China regions. Stop here and wait for the user to complete this step.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Check whether the user manages DNS in Huawei Cloud DNS or with an external provider.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"If Huawei Cloud DNS changes are part of this run, verify ","type":"text"},{"text":"hcloud","type":"text","marks":[{"type":"code_inline"}]},{"text":" is installed and authenticated.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"If DNS is managed outside Huawei Cloud or outside this run, collect that constraint explicitly before proceeding.","type":"text"}]}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Verify the bucket exists in the requested region (use ","type":"text"},{"text":"Bucket Existence and Region Check Method","type":"text","marks":[{"type":"strong"}]},{"text":" below).","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Check that the caller has permission to update bucket website settings.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Check that anonymous read is allowed for the website files (use the method in ","type":"text"},{"text":"Anonymous Read Check Method","type":"text","marks":[{"type":"strong"}]},{"text":" below).","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Do not upload or modify website content objects (","type":"text"},{"text":"index.html","type":"text","marks":[{"type":"code_inline"}]},{"text":", assets, etc.). Assume content already exists in the bucket.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Configure static website hosting by running ","type":"text"},{"text":"scripts/set_obs_website_sdk.py","type":"text","marks":[{"type":"code_inline"}]},{"text":" with ","type":"text"},{"text":"--custom-domain \u003cdomain>","type":"text","marks":[{"type":"code_inline"}]},{"text":" (use ","type":"text"},{"text":"index.html","type":"text","marks":[{"type":"code_inline"}]},{"text":" if ","type":"text"},{"text":"index_document","type":"text","marks":[{"type":"code_inline"}]},{"text":" is not provided).","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"The script exists to keep SDK object construction and credential lookup consistent.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Use it instead of writing a one-off SDK call in the response.","type":"text"}]}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Register the required custom domain on the bucket via the OBS SDK path used by the script:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"client.setBucketCustomDomain(bucket_name, custom_domain)","type":"text","marks":[{"type":"code_inline"}]},{"text":" — required even if DNS CNAME already exists.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"If DNS record changes are requested in this run, create a DNS CNAME record to the OBS website hostname and wait for propagation. (read ","type":"text"},{"text":"references/hcloud-dns-obs-website.md","type":"text","marks":[{"type":"code_inline"}]},{"text":")","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"If DNS is managed outside Huawei Cloud or outside this run, provide the required CNAME target and explicitly instruct the user to create or update the CNAME record with their external DNS provider after OBS custom-domain registration is complete.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"For externally managed DNS, include the practical handoff details the user needs: record type ","type":"text"},{"text":"CNAME","type":"text","marks":[{"type":"code_inline"}]},{"text":", host/name, target/value, and a verification command such as ","type":"text"},{"text":"dig","type":"text","marks":[{"type":"code_inline"}]},{"text":".","type":"text"}]}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Verify the published site by running ","type":"text"},{"text":"scripts/verify_obs_website.py --bucket-name \u003cbucket_name> --region \u003cregion> [--domain \u003ccustom_domain>] [--index-document \u003cname>]","type":"text","marks":[{"type":"code_inline"}]},{"text":".","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"If the user provided a custom domain, final verification MUST use that custom domain via ","type":"text"},{"text":"--domain \u003ccustom_domain>","type":"text","marks":[{"type":"code_inline"}]},{"text":".","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Only use the default OBS hostname for interim checks or when no custom domain was provided.","type":"text"}]}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Confirm the root path returns the homepage (HTTP 200).","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Confirm a missing path returns the configured error behavior (HTTP 404 or configured error page).","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Verify DNS resolution (","type":"text"},{"text":"dig","type":"text","marks":[{"type":"code_inline"}]},{"text":" / ","type":"text"},{"text":"nslookup","type":"text","marks":[{"type":"code_inline"}]},{"text":") and HTTP access through the user-provided custom domain. Do not treat the setup as complete based only on the default OBS hostname when a custom domain is part of the request.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Bucket Existence and Region Check Method","type":"text"}]},{"type":"paragraph","content":[{"text":"Run a read-only SDK check with ","type":"text"},{"text":"verify_obs_website.py","type":"text","marks":[{"type":"code_inline"}]},{"text":" before website configuration.","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"python scripts/verify_obs_website.py \\\n --bucket-name \"\u003cbucket_name>\" \\\n --region \"\u003cregion>\" \\\n --index-document \"\u003cindex_document>\"","type":"text"}]},{"type":"paragraph","content":[{"text":"obs endpoint","type":"text","marks":[{"type":"code_inline"}]},{"text":" is auto-built as ","type":"text"},{"text":"https://obs.\u003cregion>.myhuaweicloud.com","type":"text","marks":[{"type":"code_inline"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"Pass/Fail rules:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"PASS","type":"text","marks":[{"type":"code_inline"}]},{"text":": ","type":"text"},{"text":"headBucket","type":"text","marks":[{"type":"code_inline"}]},{"text":" is ","type":"text"},{"text":"2xx","type":"text","marks":[{"type":"code_inline"}]},{"text":" and region matches (or region cannot be returned but bucket is reachable with ","type":"text"},{"text":"2xx","type":"text","marks":[{"type":"code_inline"}]},{"text":").","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"FAIL","type":"text","marks":[{"type":"code_inline"}]},{"text":": ","type":"text"},{"text":"headBucket","type":"text","marks":[{"type":"code_inline"}]},{"text":" non-","type":"text"},{"text":"2xx","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"getBucketLocation","type":"text","marks":[{"type":"code_inline"}]},{"text":" non-","type":"text"},{"text":"2xx","type":"text","marks":[{"type":"code_inline"}]},{"text":", or explicit region mismatch.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Anonymous Read Check Method","type":"text"}]},{"type":"paragraph","content":[{"text":"Use anonymous HTTP requests against the OBS website endpoint (no AK/SK) as the source of truth.","type":"text"}]},{"type":"ordered_list","attrs":{"order":1,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"The verifier auto-builds the default website URL:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"http://\u003cbucket_name>.obs.\u003cregion>.myhuaweicloud.com","type":"text","marks":[{"type":"code_inline"}]}]}]}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Run bundled verifier (preferred):","type":"text"}]}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"python scripts/verify_obs_website.py \\\n --bucket-name \"\u003cbucket_name>\" \\\n --region \"\u003cregion>\" \\\n --domain \"\u003ccustom_domain>\" \\\n --index-document \"\u003cindex_document>\"","type":"text"}]},{"type":"ordered_list","attrs":{"order":3,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"If no custom domain was provided by the user, verify the default OBS website endpoint instead:","type":"text"}]}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"python scripts/verify_obs_website.py \\\n --bucket-name \"\u003cbucket_name>\" \\\n --region \"\u003cregion>\" \\\n --index-document \"\u003cindex_document>\"","type":"text"}]},{"type":"ordered_list","attrs":{"order":4,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"If you need a quick single-file check, run:","type":"text"}]}]}]},{"type":"code_block","attrs":{"wrap":false,"language":"bash"},"content":[{"text":"site_url=\"http://\u003ccustom_domain>\"\ncurl -s -o /dev/null -w \"%{http_code}\\n\" \"$site_url/\u003cindex_document>\"","type":"text"}]},{"type":"paragraph","content":[{"text":"Pass/Fail rules:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"200","type":"text","marks":[{"type":"code_inline"}]},{"text":" on ","type":"text"},{"text":"root_path","type":"text","marks":[{"type":"code_inline"}]},{"text":" and ","type":"text"},{"text":"index_document","type":"text","marks":[{"type":"code_inline"}]},{"text":": anonymous read is working.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"403","type":"text","marks":[{"type":"code_inline"}]},{"text":": treat as two possible issues that must both be reported to the user: anonymous/public read is not enabled (ACL/policy issue), or the AK/SK used for SDK verification/configuration lacks required IAM permissions.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"404","type":"text","marks":[{"type":"code_inline"}]},{"text":": object path/name issue (for example, ","type":"text"},{"text":"index.html","type":"text","marks":[{"type":"code_inline"}]},{"text":" missing or key path mismatch), not an anonymous-permission success.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"When ","type":"text"},{"text":"403","type":"text","marks":[{"type":"code_inline"}]},{"text":" appears, treat setup as failed and tell the user both common possibilities:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"bucket/object is not public-read for website access","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"AK/SK lacks required IAM permissions for OBS operations","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Provide remediation via ","type":"text"},{"text":"references/iam-policies.md","type":"text","marks":[{"type":"code_inline"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Response Shape","type":"text"}]},{"type":"paragraph","content":[{"text":"Always return:","type":"text"}]},{"type":"ordered_list","attrs":{"order":1,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Input summary","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Actions performed","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Verification results","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Remediation steps if anything failed","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"When DNS is externally managed, also include a short DNS handoff section that tells the user exactly which CNAME record to configure with their provider.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Safety Rules","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Never print secrets, AK/SK, or tokens.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Do not claim success until the website endpoint is verified.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"If the user provided a custom domain, final success must be based on verification through that custom domain, not only the default OBS hostname.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"If permissions are missing, stop and report the missing capability.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"If DNS provider ownership is unspecified, ask whether the zone is managed in Huawei Cloud DNS or externally before assuming ","type":"text"},{"text":"hcloud","type":"text","marks":[{"type":"code_inline"}]},{"text":" steps.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"If Huawei Cloud DNS changes are required for completion but the zone is unknown, ask for the zone instead of guessing.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Do not use the regular bucket endpoint as the final website result.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"If the bucket name contains dots, warn that HTTPS access can be problematic.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"If the user requires HTTPS access, success must be verified over ","type":"text"},{"text":"https://","type":"text","marks":[{"type":"code_inline"}]},{"text":". ","type":"text"},{"text":"verify_obs_website.py","type":"text","marks":[{"type":"code_inline"}]},{"text":" always checks both HTTP and HTTPS endpoints, so a custom domain without a valid certificate is reported with a TLS remediation step. HTTPS on OBS requires a certificate bound to the custom domain via ","type":"text"},{"text":"setBucketCustomDomain(..., certificateInfo=...)","type":"text","marks":[{"type":"code_inline"}]},{"text":". OBS supports HTTPS only on a custom domain and only with international (general) certificates, not SM (national crypto) certificates.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Never print or echo private key material passed via ","type":"text"},{"text":"--private-key","type":"text","marks":[{"type":"code_inline"}]},{"text":".","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"obsutil","type":"text","marks":[{"type":"code_inline"}]},{"text":" is allowed only for managing ","type":"text"},{"text":"~/.obsutilconfig","type":"text","marks":[{"type":"code_inline"}]},{"text":"; do not use it to configure website hosting.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Do not perform any object upload actions in this skill.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Especially during verification, use read-only checks only; never upload test files.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"For externally managed DNS, do not stop at “DNS is external”; provide the user-facing CNAME handoff details needed to finish the setup.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Permission Failure Handling (MUST)","type":"text"}]},{"type":"paragraph","content":[{"text":"When any command fails due to IAM permission errors:","type":"text"}]},{"type":"ordered_list","attrs":{"order":1,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Read ","type":"text"},{"text":"references/iam-policies.md","type":"text","marks":[{"type":"code_inline"}]},{"text":".","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Show the required permission list and policy JSON to the user.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Guide the user to create a custom IAM policy and grant it in Huawei Cloud IAM console.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Pause execution and wait for user confirmation that permissions were granted.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"References","type":"text"}]},{"type":"paragraph","content":[{"text":"Load ","type":"text"},{"text":"references/obs-python-sdk-website.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" for SDK method usage for website hosting ","type":"text"},{"text":"and custom domain registration","type":"text","marks":[{"type":"strong"}]},{"text":" (","type":"text"},{"text":"setBucketCustomDomain","type":"text","marks":[{"type":"code_inline"}]},{"text":"). Load ","type":"text"},{"text":"references/iam-policies.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" for required IAM actions and policy JSON. Load ","type":"text"},{"text":"references/hcloud-dns-obs-website.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" for step-by-step DNS CNAME configuration for custom domains via Huawei Cloud DNS (","type":"text"},{"text":"hcloud","type":"text","marks":[{"type":"code_inline"}]},{"text":" CLI), including zone lookup, record creation, and verification.","type":"text"}]},{"type":"blockquote","content":[{"type":"paragraph","content":[{"text":"Known Pitfall:","type":"text","marks":[{"type":"strong"}]},{"text":" The ","type":"text"},{"text":"setBucketWebsite","type":"text","marks":[{"type":"code_inline"}]},{"text":" API in esdk-obs-python >= 3.x uses ","type":"text"},{"text":"WebsiteConfiguration","type":"text","marks":[{"type":"code_inline"}]},{"text":" model objects, ","type":"text"},{"text":"not","type":"text","marks":[{"type":"strong"}]},{"text":" keyword arguments like ","type":"text"},{"text":"indexDocumentSuffix","type":"text","marks":[{"type":"code_inline"}]},{"text":". Always import ","type":"text"},{"text":"WebsiteConfiguration","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"IndexDocument","type":"text","marks":[{"type":"code_inline"}]},{"text":", and ","type":"text"},{"text":"ErrorDocument","type":"text","marks":[{"type":"code_inline"}]},{"text":" and construct them properly.","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Scripts","type":"text"}]},{"type":"paragraph","content":[{"text":"Use scripts only for repeatable checks and verification. Keep command output human-readable and focused on success/failure.","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"scripts/set_obs_website_sdk.py \u003cbucket_name> \u003cendpoint> --custom-domain \u003cdomain> [--index-document \u003cname>] [--error-document \u003cname>]","type":"text","marks":[{"type":"code_inline"}]},{"text":" applies static website hosting settings through the OBS SDK, registers the required custom domain, and reads credentials from CLI args, env vars, or ","type":"text"},{"text":"~/.obsutilconfig","type":"text","marks":[{"type":"code_inline"}]},{"text":". OBS supports HTTPS on a custom domain via ","type":"text"},{"text":"setBucketCustomDomain(..., certificateInfo=...)","type":"text","marks":[{"type":"code_inline"}]},{"text":". To bind a certificate, use ","type":"text"},{"text":"--certificate-name","type":"text","marks":[{"type":"code_inline"}]},{"text":" together with either ","type":"text"},{"text":"--certificate","type":"text","marks":[{"type":"code_inline"}]},{"text":" + ","type":"text"},{"text":"--private-key","type":"text","marks":[{"type":"code_inline"}]},{"text":" (direct PEM) or ","type":"text"},{"text":"--certificate-id","type":"text","marks":[{"type":"code_inline"}]},{"text":" (CCM certificate). Only international (general) certificates are supported, not SM (national crypto) certificates.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"scripts/verify_obs_website.py --bucket-name \u003cname> --region \u003cregion> [--domain \u003ccustom_domain>] [--index-document \u003cname>] [--json]","type":"text","marks":[{"type":"code_inline"}]},{"text":" verifies endpoint DNS/HTTP/HTTPS behavior and also performs a read-only bucket existence + region check (","type":"text"},{"text":"headBucket","type":"text","marks":[{"type":"code_inline"}]},{"text":" + ","type":"text"},{"text":"getBucketLocation","type":"text","marks":[{"type":"code_inline"}]},{"text":"). If ","type":"text"},{"text":"--domain","type":"text","marks":[{"type":"code_inline"}]},{"text":" is provided, that custom domain is the final verification target; otherwise it auto-builds the default website URL as ","type":"text"},{"text":"http://\u003cbucket>.obs.\u003cregion>.myhuaweicloud.com","type":"text","marks":[{"type":"code_inline"}]},{"text":". Both ","type":"text"},{"text":"http://","type":"text","marks":[{"type":"code_inline"}]},{"text":" and ","type":"text"},{"text":"https://","type":"text","marks":[{"type":"code_inline"}]},{"text":" are always verified, so TLS certificate problems on a custom domain (certificate_verify_failed / hostname mismatch) are detected and reported with remediation steps. The OBS API endpoint remains ","type":"text"},{"text":"https://obs.\u003cregion>.myhuaweicloud.com","type":"text","marks":[{"type":"code_inline"}]},{"text":". It prints structured sections (","type":"text"},{"text":"Input summary","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"Actions performed","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"Verification results","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"Remediation steps","type":"text","marks":[{"type":"code_inline"}]},{"text":") so agent responses can directly reuse them.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Validation Rules","type":"text"}]},{"type":"paragraph","content":[{"text":"Load ","type":"text"},{"text":"references/verification-method.md","type":"text","marks":[{"type":"code_inline"}]},{"text":" for validation rules.","type":"text"}]}]},"metadata":{"date":"2026-11-02","name":"huawei-cloud-obs-website-host","tags":["static-site-hosting","obs-website-hosting"],"author":"@skillopedia","source":{"stars":59,"repo_name":"huaweicloud-skills","origin_url":"https://github.com/huaweicloud/huaweicloud-skills/blob/HEAD/skills/storage/obs/huawei-cloud-obs-website-host/SKILL.md","repo_owner":"huaweicloud","body_sha256":"27255e0682364c6bd045dd19647d8182dbf3b0f3e0105769e6eb50081124f223","cluster_key":"daa129757cc3bc390084ca66e8acd2ab6c313211f6fd58186f0e92a18945d3fd","clean_bundle":{"format":"clean-skill-bundle-v1","source":"huaweicloud/huaweicloud-skills/skills/storage/obs/huawei-cloud-obs-website-host/SKILL.md","text_bytes":40170,"source_commit":"bad25df61c331db250f0cc79f1fa7acee08b3fc8","skills_sh_rank":1596,"attachment_count":7,"text_attachments":7,"attachment_storage":"skill_attachments","binary_attachments":0},"cluster_size":1,"skill_md_path":"skills/storage/obs/huawei-cloud-obs-website-host/SKILL.md","import_metadata":{"date":"2026-11-02","author":"@skillopedia","version":"v1","category":"devops-infrastructure","category_label":"DevOps"},"exact_dupes_collapsed_into_this":0},"version":"v1","category":"devops-infrastructure","import_tag":"skills-sh-top20k-2026-11","description":"Configure Huawei Cloud OBS static website hosting with Python SDK and a custom domain. Use when the user needs to enable or repair OBS website hosting, set index or error pages, expose an existing bucket for public website access through a custom domain, or connect that domain through Huawei Cloud DNS when Huawei manages the zone. Triggers include OBS static website hosting, website endpoint, index page, error page, public-read bucket website access, custom domain CNAME, Huawei Cloud DNS, setBucketWebsite. 中文触发词包括：OBS 静态网站托管、网站托管、自定义域名解析。"}},"renderedAt":1793671604059}

Important: agents should read /llm.txt, /llms.txt, or /.well-known/skills.json to discover the public Skillopedia API.