infrastructure/group_vars/all/root_access.yml

---

# deploy tag 'sudo' when this changes
sudo_users:
  - root
  - foutrelis
  - freswa
  - grazzolini
  - heftig
  - jelle
  - svenstaro
  - anthraxx
  - klausenbusk

# deploy tag 'root_ssh' when this changes
root_ssh_keys:
  - key: foutrelis.pub
  - key: freswa.pub
  - key: grazzolini.pub
  - key: heftig.pub
  - key: jelle.pub
  - key: svenstaro.pub
  - key: anthraxx.pub
  - key: klausenbusk.pub
    additional_keys: [klausenbusk_2.pub]

# run playbook 'playbooks/tasks/reencrypt-vault-key.yml' when this changes
# before running it, make sure to gpg --lsign-key all of the below keys
root_gpgkeys:
  - 86CFFCA918CF3AF47147588051E8B148A9999C34  # foutrelis
  - 05C7775A9E8B977407FE08E69D4C5AA15426DA0A  # freswa
  - ECCAC84C1BA08A6CC8E63FBBF22FB1D78A77AEAB  # grazzolini
  - A2FF3A36AAA56654109064AB19802F8B0D70FC30  # heftig
  - E499C79F53C96A54E572FEE1C06086337C50773E  # jelle
  - 8FC15A064950A99DD1BD14DD39E4B877E62EB915  # svenstaro
  - E240B57E2C4630BA768E2F26FC1B547C8D8172C8  # anthraxx
  - DB650286BD9EAE39890D3FE6FE3DC1668CB24956  # klausenbusk
Put root ssh keys into group variables 2016-05-27 22:46:00 +02:00			`---`

Document what to run when root_access variables are changed Signed-off-by: Florian Pritz <bluewind@xinu.at> 2019-02-10 15:27:46 +01:00			`# deploy tag 'sudo' when this changes`
Move sudo_users to root_pubkeys.yml This ensures that all info regarding "who has root" is in one place. Signed-off-by: Florian Pritz <bluewind@xinu.at> 2019-02-10 15:06:33 +01:00			`sudo_users:`
Retire seblu and pierre 2019-10-10 23:48:50 +02:00			`- root`
Move sudo_users to root_pubkeys.yml This ensures that all info regarding "who has root" is in one place. Signed-off-by: Florian Pritz <bluewind@xinu.at> 2019-02-10 15:06:33 +01:00			`- foutrelis`
Give freswa full DevOps access 2020-11-15 15:22:15 +01:00			`- freswa`
root_access: For some reason, after all this time, still did not had sudo access. 2019-04-14 23:11:27 +02:00			`- grazzolini`
Move sudo_users to root_pubkeys.yml This ensures that all info regarding "who has root" is in one place. Signed-off-by: Florian Pritz <bluewind@xinu.at> 2019-02-10 15:06:33 +01:00			`- heftig`
Retire seblu and pierre 2019-10-10 23:48:50 +02:00			`- jelle`
Move sudo_users to root_pubkeys.yml This ensures that all info regarding "who has root" is in one place. Signed-off-by: Florian Pritz <bluewind@xinu.at> 2019-02-10 15:06:33 +01:00			`- svenstaro`
root_access: Add anthraxx to the root access file. 2019-09-12 22:41:14 +02:00			`- anthraxx`
Give Kristian full DevOps access 2021-06-02 16:17:31 +02:00			`- klausenbusk`
Move sudo_users to root_pubkeys.yml This ensures that all info regarding "who has root" is in one place. Signed-off-by: Florian Pritz <bluewind@xinu.at> 2019-02-10 15:06:33 +01:00
Document what to run when root_access variables are changed Signed-off-by: Florian Pritz <bluewind@xinu.at> 2019-02-10 15:27:46 +01:00			`# deploy tag 'root_ssh' when this changes`
Put root ssh keys into group variables 2016-05-27 22:46:00 +02:00			`root_ssh_keys:`
root_ssh: Support giving root access to only some hosts 2021-04-01 18:12:56 +02:00			`- key: foutrelis.pub`
			`- key: freswa.pub`
			`- key: grazzolini.pub`
			`- key: heftig.pub`
			`- key: jelle.pub`
			`- key: svenstaro.pub`
			`- key: anthraxx.pub`
Give klausenbusk root access to {bugs,monitoring}.al.org klausenbusk is our new newest Junior DevOp and he needs some access: * bugs.al.org for helping with migrating Flyspray tasks to GitLab * monitoring.al.org for setting up centralized logging 2021-04-01 18:15:03 +02:00			`- key: klausenbusk.pub`
root_ssh: Add additional SSH key for klausenbusk He has too many smartcards! 2021-06-02 17:42:54 +02:00			`additional_keys: [klausenbusk_2.pub]`
playbooks/fetch-borg-keys.yml: Encrypt keys with GPG Signed-off-by: Florian Pritz <bluewind@xinu.at> 2018-01-10 21:02:25 +01:00
Document what to run when root_access variables are changed Signed-off-by: Florian Pritz <bluewind@xinu.at> 2019-02-10 15:27:46 +01:00			`# run playbook 'playbooks/tasks/reencrypt-vault-key.yml' when this changes`
Add note about having all keys lsigned before trying to reencrypt the vault 2019-10-10 23:52:43 +02:00			`# before running it, make sure to gpg --lsign-key all of the below keys`
playbooks/fetch-borg-keys.yml: Encrypt keys with GPG Signed-off-by: Florian Pritz <bluewind@xinu.at> 2018-01-10 21:02:25 +01:00			`root_gpgkeys:`
Make ansible-lint happy yaml: truthy value should be one of [false, true] (truthy) yaml: wrong indentation: expected 4 but found 2 (indentation) yaml: too few spaces before comment (comments) yaml: missing starting space in comment (comments) yaml: too many blank lines (1 > 0) (empty-lines) yaml: too many spaces after colon (colons) yaml: comment not indented like content (comments-indentation) yaml: no new line character at the end of file (new-line-at-end-of-file) load-failure: Failed to load or parse file parser-error: couldn't resolve module/action 'hosts'. This often indicates a misspelling, missing collection, or incorrect module path. 2021-02-14 14:05:32 +01:00			`- 86CFFCA918CF3AF47147588051E8B148A9999C34 # foutrelis`
			`- 05C7775A9E8B977407FE08E69D4C5AA15426DA0A # freswa`
			`- ECCAC84C1BA08A6CC8E63FBBF22FB1D78A77AEAB # grazzolini`
			`- A2FF3A36AAA56654109064AB19802F8B0D70FC30 # heftig`
			`- E499C79F53C96A54E572FEE1C06086337C50773E # jelle`
			`- 8FC15A064950A99DD1BD14DD39E4B877E62EB915 # svenstaro`
			`- E240B57E2C4630BA768E2F26FC1B547C8D8172C8 # anthraxx`
Give Kristian full DevOps access 2021-06-02 16:17:31 +02:00			`- DB650286BD9EAE39890D3FE6FE3DC1668CB24956 # klausenbusk`