mirror/ infrastructure
1
1
Fork 0
mirror of https://gitlab.archlinux.org/archlinux/infrastructure.git synced 2024-04-27 15:15:00 +02:00
Code Issues
infrastructure/group_vars/all/root_access.yml

50 lines
1.8 KiB
YAML
Raw Normal View History

Document what to run when root_access variables are changed Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-02-10 15:27:46 +01:00
# deploy tag 'sudo' when this changes
Move sudo_users to root_pubkeys.yml This ensures that all info regarding "who has root" is in one place. Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-02-10 15:06:33 +01:00
sudo_users:
Retire seblu and pierre
2019-10-10 23:48:50 +02:00
- root
Move sudo_users to root_pubkeys.yml This ensures that all info regarding "who has root" is in one place. Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-02-10 15:06:33 +01:00
- foutrelis
Give freswa full DevOps access
2020-11-15 15:22:15 +01:00
- freswa
Move sudo_users to root_pubkeys.yml This ensures that all info regarding "who has root" is in one place. Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-02-10 15:06:33 +01:00
- heftig
Retire seblu and pierre
2019-10-10 23:48:50 +02:00
- jelle
Move sudo_users to root_pubkeys.yml This ensures that all info regarding "who has root" is in one place. Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-02-10 15:06:33 +01:00
- svenstaro
root_access: Add anthraxx to the root access file.
2019-09-12 22:41:14 +02:00
- anthraxx
Give Kristian full DevOps access
2021-06-02 16:17:31 +02:00
- klausenbusk
Give Leonidas full DevOps access
2023-01-30 07:03:04 +01:00
- artafinde
Promote gromit to full DevOps Fix #573
2024-02-11 22:24:33 +01:00
- gromit
Move sudo_users to root_pubkeys.yml This ensures that all info regarding "who has root" is in one place. Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-02-10 15:06:33 +01:00
Document what to run when root_access variables are changed Signed-off-by: Florian Pritz <bluewind@xinu.at>
2019-02-10 15:27:46 +01:00
# deploy tag 'root_ssh' when this changes
Put root ssh keys into group variables
2016-05-27 22:46:00 +02:00
root_ssh_keys:
root_ssh: Support giving root access to only some hosts
2021-04-01 18:12:56 +02:00
- key: foutrelis.pub
- key: freswa.pub
Fix filename for heftig's new key in root_access The new key is under pubkeys/heftig_nitrokey.pub, and pubkeys/heftig.pub was renamed to pubkeys/heftig_yubikey.pub. Update root_ssh_keys to refer to "heftig_nitrokey.pub" as "heftig.pub" does not exist anymore. Fixes: 13a4bddf0d45 ("pubkeys/heftig: Add my new Nitrokey, reorganize")
2023-12-28 00:11:40 +01:00
- key: heftig_nitrokey.pub
root_ssh: Support giving root access to only some hosts
2021-04-01 18:12:56 +02:00
- key: jelle.pub
- key: svenstaro.pub
- key: anthraxx.pub
Give klausenbusk root access to {bugs,monitoring}.al.org klausenbusk is our new newest Junior DevOp and he needs some access: * bugs.al.org for helping with migrating Flyspray tasks to GitLab * monitoring.al.org for setting up centralized logging
2021-04-01 18:15:03 +02:00
- key: klausenbusk.pub
Onboard artafinde as Junior DevOps artafinde is our new newest Junior DevOp[1] and will get access to: * monitoring.al.org: for setting up gitlab-exporter[1] * gitlab.al.org: for setting up gitlab-exporter[1] * dashboards.al.org: in case he wants to do more monitoring related stuff [1] https://lists.archlinux.org/pipermail/arch-devops/2022-May/000558.html [2] https://gitlab.archlinux.org/artafinde/gitlab-exporter/ Fix #452
2022-05-06 19:55:47 +02:00
- key: artafinde.pub
Onboard gromit as Junior DevOps gromit is our newest Junior DevOps[1] and will get access to: * bugs.archlinux.org: for helping with the bug migration * wiki.archlinux.org: for helping with (archwiki) maintenance [1] https://lists.archlinux.org/archives/list/arch-devops@lists.archlinux.org/message/2LAOGIVY33MZLBZCDSQHDQVQNEULLUTW/ Fix #543
2023-10-20 23:37:44 +02:00
- key: gromit.pub
playbooks/fetch-borg-keys.yml: Encrypt keys with GPG Signed-off-by: Florian Pritz <bluewind@xinu.at>
2018-01-10 21:02:25 +01:00
README, root_access: Mention how to reencrypt when using TOFU
2023-12-28 00:21:12 +01:00
# run 'playbooks/tasks/reencrypt-vault-{super,default}-key.yml' when this
# changes; before doing so, make sure to 'gpg --lsign-key' all keys from both
# sets (or if you use TOFU, `gpg --tofu-policy good`) before committing the
# re-encrypted password file, then test that both vaults are working using
# `ansible-vault view misc/vaults/vault_{hetzner,hcloud}.yml`
Move highly sensitive secrets to new "super" vault The idea bebind this is to be able to give vault access to new DevOps members without giving away more important credentials like Hetzner's.
2022-05-01 14:26:32 +02:00
# NOTE: adding a key to this list gives access to both default and super vaults
vault_super_pgpkeys: &vault_super_pgpkeys
Make ansible-lint happy yaml: truthy value should be one of [false, true] (truthy) yaml: wrong indentation: expected 4 but found 2 (indentation) yaml: too few spaces before comment (comments) yaml: missing starting space in comment (comments) yaml: too many blank lines (1 > 0) (empty-lines) yaml: too many spaces after colon (colons) yaml: comment not indented like content (comments-indentation) yaml: no new line character at the end of file (new-line-at-end-of-file) load-failure: Failed to load or parse file parser-error: couldn't resolve module/action 'hosts'. This often indicates a misspelling, missing collection, or incorrect module path.
2021-02-14 14:05:32 +01:00
- 86CFFCA918CF3AF47147588051E8B148A9999C34 # foutrelis
- 05C7775A9E8B977407FE08E69D4C5AA15426DA0A # freswa
Re-encrypt vault passwords with heftig's new key Follow-up to merge request archlinux/infrastructure!786. New key is already trusted by four master keys in archlinux-keyring 20231222-1. https://gitlab.archlinux.org/archlinux/archlinux-keyring/-/issues/254
2023-12-27 23:56:32 +01:00
- 83BC8889351B5DEBBB68416EB8AC08600F108CDF # heftig
Make ansible-lint happy yaml: truthy value should be one of [false, true] (truthy) yaml: wrong indentation: expected 4 but found 2 (indentation) yaml: too few spaces before comment (comments) yaml: missing starting space in comment (comments) yaml: too many blank lines (1 > 0) (empty-lines) yaml: too many spaces after colon (colons) yaml: comment not indented like content (comments-indentation) yaml: no new line character at the end of file (new-line-at-end-of-file) load-failure: Failed to load or parse file parser-error: couldn't resolve module/action 'hosts'. This often indicates a misspelling, missing collection, or incorrect module path.
2021-02-14 14:05:32 +01:00
- E499C79F53C96A54E572FEE1C06086337C50773E # jelle
- 8FC15A064950A99DD1BD14DD39E4B877E62EB915 # svenstaro
- E240B57E2C4630BA768E2F26FC1B547C8D8172C8 # anthraxx
Give Kristian full DevOps access
2021-06-02 16:17:31 +02:00
- DB650286BD9EAE39890D3FE6FE3DC1668CB24956 # klausenbusk
Give Leonidas full DevOps access
2023-01-30 07:03:04 +01:00
- B4B759625D4633430B74877059E43E106B247368 # artafinde
Promote gromit to full DevOps Fix #573
2024-02-11 22:24:33 +01:00
- F00B96D15228013FFC9C9D0393B11DAA4C197E3D # gromit
Move highly sensitive secrets to new "super" vault The idea bebind this is to be able to give vault access to new DevOps members without giving away more important credentials like Hetzner's.
2022-05-01 14:26:32 +02:00
README, root_access: Mention how to reencrypt when using TOFU
2023-12-28 00:21:12 +01:00
# run 'playbooks/tasks/reencrypt-vault-default-key.yml' when this changes;
# before doing so, make sure to 'gpg --lsign-key' all keys below (or if you use
# TOFU, `gpg --tofu-policy good`) before committing the re-encrypted password
# file, then test that the vault is working by running `ansible-vault view
# misc/vaults/vault_hcloud.yml`
Move highly sensitive secrets to new "super" vault The idea bebind this is to be able to give vault access to new DevOps members without giving away more important credentials like Hetzner's.
2022-05-01 14:26:32 +02:00
vault_default_pgpkeys:
- *vault_super_pgpkeys