Administration
This page is for the owner role. The commands below only work with an
owner token; everyone else gets forbidden.
Inviting someone
Access is by invitation, keyed on the GitHub login:
rapadura admin invite panthedog # becomes staff
rapadura admin invite someone-else --role owner
rapadura admin invites # pending invites
rapadura admin revoke-invite panthedog # withdraw an unused invite
After the invite the person runs rapadura login, authorizes on GitHub and
is in. The invite disappears when used; from then on the person shows up in
rapadura admin users.
WordPress account
The WordPress account is created the first time the person creates a site,
with the email they pass in --email. To prepare it ahead of time, so
--email is not needed:
rapadura admin wp-account panthedog --email panthedog@example.com
The person must have run rapadura login at least once.
Roles
- staff: creates and manages their own hotsites and WordPress sites;
cannot see anyone else's; cannot use
rapadura admin. - owner: sees and changes every site, invites, revokes tokens, reads the audit log. The wp-cli policy applies to the owner too: anything beyond it is done on the server, never through the gateway.
Tokens
Every machine that ran rapadura login holds its own token, valid 90 days.
rapadura admin tokens # all tokens, with last use
rapadura admin revoke-token 7 # revoke immediately
To cut someone off entirely, revoke all of their tokens. A token without GitHub, for automation or tests, is minted on the server:
sudo -u rapadura-gw rapadura admin bootstrap-token --data-dir /srv/rapadura \
--login account-name --role staff --name "what it is for" --ttl 72h
The token is shown once. Treat it as a password.
Audit
rapadura admin audit -n 50
Who did what, on which site, when, with the result. wp-cli commands are recorded in full, including refused ones.
Other people's sites
The owner sees everything in rapadura sites list and can publish, roll
back or delete any site with the same commands. A deleted site answers 410
and is kept; restoring is still manual on the server. To remove it for good
and free the name:
rapadura admin purge-site qa-test.rapadura.net --yes