infrastructure/.gitlab/issue_templates/Offboarding.md

Offboarding an Arch Linux team member

Details

• Team member username:
• Currently held roles:
• Removal request:
  • Voting result:

All roles checklist

• Remove user email by reverting instructions from docs/email.md.
  • Remove entry in group_vars/all/archusers.yml.
  • Remove SSH pubkey from pubkeys/<username>.pub.
  • Run ansible-playbook -t archusers $(git grep -l archusers playbooks/ | grep -v phrik).
  • Setup forwarding if requested (please add the current date as a comment above the mail address in Postfix's users file).
    • Inform the user of the conditions for forwarding.
      • In most cases we only offer forwarding for 6 months.
      • We will inform the user prior to disabling the forwarding.
      • The forwarding can be extended if there are good reasons for doing so.
• Set user to inactive in archweb: https://www.archlinux.org/admin/auth/user/
• Remove member from staff mailing list.
• Moderate email address on arch-dev-public (find member and moderate).
• Ask the user to leave #archlinux-staff on Libera Chat and forget the password.
• Remove staff cloak on Libera Chat (Group contacts).
• Remove the user from relevant staff groups on Keycloak.
• Move the user from the public list of their usergroup on archweb (support staff / TUs / devs) to the respective fellow site (fellow support staff / fellow TUs / fellow devs)
• Remove the user from the Arch Linux GitHub organisation

Main key offboarding checklist

• Remove user email for the master-key.archlinux.org subdomain by reverting instructions from docs/email.md.
• Create an issue in archlinux-keyring using the "Remove Main Key" template.

Package Maintainer/Developer offboarding checklist

• Remove member from arch-tu and/or arch-dev mailing lists.
• Ask the user to leave #archlinux-tu and/or #archlinux-dev aswell as #archlinux-packaging on Libera Chat and forget the password(s).
• Create an issue in archlinux-keyring using the "Remove Packager Key" template.
• Remove stale package relations for the now inactive user.
• Remove their extended permissions on AURweb

DevOps offboarding checklist

• Remove entries in group_vars/all/root_access.yml.
• Run ansible-playbook -t root_ssh playbooks/all-hosts-basic.yml.
• Run ansible-playbook playbooks/hetzner_storagebox.yml playbooks/rsync.net.yml.
• Remove member from arch-devops-private mailing lists.
• Remove pubkey from Hetzner's key management.

Wiki Administrator checklist

• Remove member from arch-wiki-admins mailing list.