mirror of
https://we.phorge.it/source/phorge.git
synced 2024-12-11 08:06:13 +01:00
41 lines
1.3 KiB
Text
41 lines
1.3 KiB
Text
|
@title Almanac User Guide
|
||
|
|
@group userguide
|
||
|
|
|
||
|
|
Using Almanac to manage services.
|
||
|
|
|
||
|
|
= Overview =
|
||
|
|
|
||
|
|
IMPORTANT: Almanac is a prototype application. See
|
||
|
|
@{article:User Guide: Prototype Applications}.
|
||
|
|
|
||
|
|
Locking and Unlocking Services
|
||
|
|
==============================
|
||
|
|
|
||
|
|
Services can be locked to prevent edits from the web UI. This primarily hardens
|
||
|
|
Almanac against attacks involving account compromise. Notably, locking cluster
|
||
|
|
services prevents an attacker from modifying the Phabricator cluster definition.
|
||
|
|
For more details on this scenario, see
|
||
|
|
@{article:User Guide: Phabricator Clusters}.
|
||
|
|
|
||
|
|
Beyond hardening cluster definitions, you might also want to lock a service to
|
||
|
|
prevent accidental edits.
|
||
|
|
|
||
|
|
To lock a service, run:
|
||
|
|
|
||
|
|
phabricator/ $ ./bin/almanac lock <service>
|
||
|
|
|
||
|
|
To unlock a service later, run:
|
||
|
|
|
||
|
|
phabricator/ $ ./bin/almanac unlock <service>
|
||
|
|
|
||
|
|
Locking a service also locks all of the service's bindings and properties, as
|
||
|
|
well as the devices connected to the service. Generally, no part of the
|
||
|
|
service definition can be modified while it is locked.
|
||
|
|
|
||
|
|
Devices (and their properties) will remain locked as long as they are bound to
|
||
|
|
at least one locked service. To edit a device, you'll need to unlock all the
|
||
|
|
services it is bound to.
|
||
|
|
|
||
|
|
Locked services and devices will show that they are locked in the web UI, and
|
||
|
|
editing options will be unavailable.
|