infrastructure/.gitlab/issue_templates/Onboarding.md

/confidential

Onboarding an Arch Linux team member

Details

• Team member username:
• Application:
• Voting result:
• SSH public key:
• Full Name:
• Personal e-mail address:
• PGP key ID used with personal e-mail address:
• Communication e-mail address: [arch, personal]

All roles checklist

• Add user mail if TU or developer, or support staff and communication e-mail address is arch.
  • Add new user email as per docs/email.md.
  • Add entry in group_vars/all/archusers.yml.
    • If support staff hosts should be set to mail.archlinux.org.
    • homedir.archlinux.org is also allowed for support staff, but it is opt-in.
  • Add SSH pubkey to pubkeys/<username>.pub.
  • Run ansible-playbook -t archusers $(git grep -l archusers playbooks/ | grep -v phrik).
• Create a new user in archweb. Select the appropriate group membership and allowed repos (if applicable).
• Subscribe communication e-mail address to internal staff mailing list.
• Allow sending from communication e-mail address on arch-dev-public (subscribe and/or find address and remove moderation).
• Give the user access to #archlinux-staff on Libera Chat.
• Give the user a link to our staff services page.
• Replace the Team member username with the @-prefixed username on Gitlab.
• Remove personal information (such as Full Name and Personal e-mail address, as well as the clearsigned representation of this data), remove the description history and make the issue non-confidential.
• Request staff cloak on Libera Chat (Group contacts)

Main key onboarding checklist

• Add new user email for the master-key.archlinux.org subdomain as per docs/email.md.
• Create an issue in archlinux-keyring using the "New Main Key" template.

TU/Developer onboarding checklist

• Create an issue in archlinux-keyring using the "New Packager Key" template.
• Assign the user to the Trusted Users or Developers group on Keycloak.
• Assign the user to the Trusted Users or Developers group on archlinux.org.
• Subscribe communication e-mail address to internal arch-tu or arch-dev mailing list.
• Give the user access to #archlinux-tu or #archlinux-dev on Libera Chat.

Support staff checklist

• Assign the user to the proper support staff group on Keycloak.

DevOps onboarding checklist

• Add entries in group_vars/all/root_access.yml.
• Run ansible-playbook -t root_ssh playbooks/all-hosts-basic.yml.
• Run ansible-playbook playbooks/hetzner_storagebox.yml playbooks/rsync.net.yml.
• Subscribe communication e-mail address to internal arch-devops-private mailing list.
• Add pubkey to Hetzner's key management for Dedicated server rescue system.

Wiki Administrator checklist

• Subscribe communication e-mail address to the arch-wiki-admins mailing list.