From dd7c5faa08f49005c737cd8d9ffd84f5687541c6 Mon Sep 17 00:00:00 2001 From: LeeW Date: Wed, 26 Feb 2025 17:03:24 +0100 Subject: [PATCH] updates instructions - remove "any user", simply make explicit --- README.md | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index f173eff..5c04369 100644 --- a/README.md +++ b/README.md @@ -11,9 +11,8 @@ Roles: * Existing User: user who already has access to the appropriate project * E.g. look up in the [groups](/groups/) dir * E.g. look up in in [verify/.sops.yaml](verify/.sops.yaml) -* Any User: either New User or Existing User -## 1. Onboarding: New User: create and add a gpg key +## 1. Onboarding: [New User]: create and add a gpg key - create a branch titled `add_pubkey_-` - e.g. `git branch add_pubkey_test-user` - Note: no strict naming convention for the branch, it's strictly a Human-in-the-Loop process @@ -23,9 +22,9 @@ Roles: - file format: `@netgo.de.gpg.pub` - git: commit the new file, push - open a MergeRequest/PullRequest -- hand-off to an Existing User for approval and further configuration +- hand-off to an Existing User of the repo. -### 1b. Onboarding: Any User: Add new user to groups +### 1b. Onboarding: [Existing User|New User]: Add new user to groups Access for each repo is tracked using the `./groups/` directory; each sub-directory represents a "group" (Note: some "groups" are also "roles", e.g. `admin`) @@ -38,7 +37,7 @@ ln -s ../../ Note: this step can be performed by anyone (either new user or existing user), but it makes the most sense for an existing user to configure the groups since this is domain-specific knowledge (i.e. new users won't typically know the grups) -## 2. Offboarding: Any User: Archive Expired Keys (EOL) +## 2. Offboarding: [Existing User]: Archive Expired Keys (EOL) To mark a key as expired, move it to the `archive/` dir as follows: @@ -46,7 +45,7 @@ To mark a key as expired, move it to the `archive/` dir as follows: mv ${keyname} "archive/${keyname}_$(date '+%Y-%m-%d').archive" ``` -## 3. Existing User: Configure sops config +## 3. [Existing User]: Configure sops config Context: This repo stores the keys used to encrypt secrets in other repos; these "consumer" repos each contain a sops config `.sops.yaml` which manages access to the encrypted files (e.g. `secrets.yaml`)