There is no need to run all playbooks for this.

The idea bebind this is to be able to give vault access to new DevOps
members without giving away more important credentials like Hetzner's.

Kristian Klausen authored 3 years ago and Jelle van der Waa committed 3 years ago

We are usually setting up forwarding when offboarding, so it should be
documented, also we shouldn't keep the forwards around forever.

- Link to referenced files in the git repo.
- Use new issue URLs that preselect the issue template.

Only run it for te required playbooks, exclude the phrik playbook as we
only need it to give demize access to phrik and only running archusers
removes demize from the phrik group. Seperate bug which should be
fixed...

github-pull-closer[1] needs write access for closing the PRs.

[1] https://gitlab.archlinux.org/archlinux/github-pull-closer/

Fix #390

Fix #386

Be more explicit about selecting allowed repos because these were missed
in previous onboardings.

.gitlab/issue_templates/Onboarding.md:
Create the ticket as confidential by default (using a short action).
Make the required information in the Details section more explicit and
add entries that are relevant when creating an SSO and/or archweb
account.
Add a note for sponsors of new users, so that they also add a
clearsigned version of the data they provide.
Add a dot at the end of each sentence.
Make the entries for mailing list operations more generic and rely on
the *communication e-mail address*, which may be the user's personal
mail address or a newly created @archlinux.org mail address.
Add warning message about creating a confidential ticket when providing
personal data.
Add checkbox to remind about the removal of personal information,
removal of description history and setting the ticket to be
non-confidential (if it has been confidential due to personal data).
Add checkbox that reminds setting the Team member username to the
@-prefixed username on gitlab (after the user has logged in).

Fix #80

Kristian Klausen authored 3 years ago and Jelle van der Waa committed 3 years ago

[1] https://archlinux.org/news/move-of-official-irc-channels-to-liberachat/

.gitlab/issue_templates/Onboarding.md:
Extend the information for onboarding of packager signing keys and new
main signing keys, including comments on who is supposed to create the
tickets towards the archlinux-keyring project.

.gitlab/issue_templates/Offboarding.md:
Add more specific information for developer offboarding (e.g. also
remove from arch-dev mailing list).
Add more specific information on which templates to choose and where to
open a ticket for signing key removal.

implements #226

Levente Polyak authored 3 years ago and Jelle van der Waa committed 3 years ago

This shouldn't be possible as it may lead to accidentally allowing
external users to be added to a project.
We should only add members to a project or group on staff request to
devops.

Levente Polyak authored 4 years ago and Sven-Hendrik Haase committed 4 years ago

Strictly speaking this is not a devops duty, but I believe this is
currently the best place to ensure we won't ever forget to create a
keyring revocation ticket for an offboarded former staff.

This makes it easier for projects to use it as they only have to provide a single CNAME entry
instead of having to provide a A and a AAAA entry.

The template has to be a markdown file.

Jelle van der Waa authored 4 years ago and Jelle van der Waa committed 4 years ago

Add the relevant mailing list subscriptions for all, Devops, TU and
Developer specific mailing lists.

Closes: #131

Expand the Support group with subgroups for the Wiki, Forum, Security
Tracker and Archweb. The subgroups are just a placeholder for groups for
the roles which a user can be in for the service. New onboarded users
should be assigned to correct groups for their Support staff team.

We've stopped providing kvm and virtualbox special devices as they are not actually necessary.