Fix #446

Access to homedir is opt-in for support staff.

Fix #447

Jelle van der Waa authored 2 years ago and Levente Polyak committed 2 years ago

Signed-off-by: Levente Polyak <anthraxx@archlinux.org>

Fix #438

Kind of sensitive information that doesn't need to be available to all
hosts.

After the promotion of foxboron to dev, we have changed his role on archusers
and ran the playbook against the machines.

Fix #433

Fix #430

Fix #426, #427, #428 and #429.

Fix #436

The gluebuddy client is required for gluebuddy to retrieve users and
groups membership without being able to change other keycloak data. The
realm-management roles cannot be assigned yet via keycloak as it does
not know about the roles and realm-management client.

Issue: #442

Issue: #420

https://lists.archlinux.org/private/arch-dev/2021-October/016798.html

New username; separate and longer account manager + storage passwords.

Also, have to use --remote-path=borg1 when interacting with rsync.net.

This was a regression which has been fixed upstream.

This reverts commit 67e7677e.

We're no longer allowed to reserve formerly used namespaces.

Ref #396

Ref #388

These groups are no longer required as docker/arch-boxes images are
build by Gitlab.

Closes: #389

Looks like a oversight when he was offboarded as DevOps.
As support staff he shouldn't have access to

!473

#377

Ref #381

Ref #374

Ref #373

It simplifies it a bit.

Primarily to be used for mail accounts on mail.archlinux.org.

This offers improved separation between the server backups and should
avoid bumping against the storage box 10 concurrent connection limit.

Fixes: archlinux/infrastructure#362