# Setting up OTP stuff for Arch's various accounts

Arch has master accounts with some service providers. These are to be treated with utmost
care for obvious reasons. We use 2FA where ever possible.

The general flow for these is:
- Install pass-otp: `pacman -S pass-otp`
- Use pass-otp to log in via a master seed
- (Optional) Depending on the service provider, you can then add your own authenticator

## GitHub

Run

    pass otp insert -i GitHub -a archlinux-master-token github.com/archlinux-master-token -s

When asked for a secret, provide the `github_master_seed` from `misc/vault_github.yml`.
You can then run

    pass otp code github.com/archlinux-master-token

to generate a token to log in.

Sadly, GitHub doesn't support multiple 2FA devices so this is all we get.


## Hetzner

Run

    pass otp insert -i Hetzner -a archlinux-master-token Hetzner/archlinux-master-token -s

When asked for a secret, provide the `hetzner_master_seed` from `misc/vault_hetzner.yml`.
You can then run

    pass otp code Hetzner/archlinux-master-token

to generate a token to log in.

## UptimeRobot

Run

    pass otp insert -i UptimeRobot -a archlinux UptimeRobot/archlinux-master-token -s

When asked for a secret, provide the `2FA token seed` from `misc/additional-credentials.vault`.
You can then run

    pass otp code UptimeRobot/archlinux-master-token

to generate a token to log in.

## Rsync.net

Run

    pass otp insert -i rsync.net -a archlinux Rsync.net/archlinux-master-token -s

When asked for a secret, provide the `2FA token seed` from `group_vars/all/vault_rsync.net.yml`.
You can then run

    pass otp code Rsync.net/archlinux-master-token

to generate a token to log in.

### Adding your own account

Hetzner supports multiple 2FA devices at once which allows you to add your own 2FA app of choice
in addition to pass-otp.

To add yours, go to the 2FA management page: https://accounts.hetzner.com/tfa

Add a new authentication method with your username and add the token of this
key to either pass otp or an OTP tool of your choice.

Make sure to put your nickname into the description so we know who that key belongs to.

If you choose to use pass, you can add the key by running something
similar to `pass otp insert -i Hetzner -a archlinux Hetzner/archlinux -s`.

If you want to use your own tool, you can either scan the QR code or enter the shown string manually.
