Users and roles
4 answers
Accounts, roles, and what happens when somebody leaves.
Looking for something specific
The searchable index covers all 326 answers at once and filters as you type.
240 Add somebody to the system
- Users, Add a user.
- Give them a username and pick a role. Viewer unless you know they need more.
- Set a first password and tell them to change it.
They set up their own authenticator app the first time they sign in. Accounts are shared across every node, so you add them once.
241 Choose the right role
| Role | Can do |
|---|---|
| Viewer | Look at everything and change nothing. |
| Operator | Change sites, pools and certificates, and apply. |
| Admin | Everything, including users, the cluster and failover. |
Give people the smallest role that lets them do their job. It is easy to raise somebody later and awkward to explain an outage caused by an account that did not need the rights it had.
242 Handle somebody leaving
Turn the account off rather than deleting it. Turning it off ends their sessions immediately, so a browser they left open somewhere stops working. Keeping the account means the audit log still makes sense, because entries against a deleted user are much harder to follow a year later.
243 Reset somebody else's second factor
An admin can reset it from the Users page. If no admin can get in at all, use the console command on any node.
sudo docker exec nginx-fleet-manager \
python -m app.reset_admin alice --reset-totp