====== Onboarding Portal ======
===== Summary =====
This is a service running in [[services:openshift]] that is reverse proxied through soko01.  It was designed to replace the manual process of lab user creation.

=== The flow for new users is: ===

  - New users register via the[[https://onboarding.sepia.ceph.com/|portal]]
  - A magic link is sent to the user
    - Users with @ibm.com or @redhat.com are automatically approved upon clicking the link
    - Users without those domains must specify a sponsor
      - A sponsor must either be an existing lab user or have an @ibm.com or @redhat.com e-mail address
      - Sponsors also receive a magic link and must click to approve
      - A Lab Admin must still approve in the [[https://onboarding-admin.front.sepia.ceph.com/admin|admin portal]].
  - Once all approvals are reached,
    - The service opens a PR in the [[https://github.com/ceph/keys|keys repo]] which gets automatically merged
    - The service also opens a PR in the [[https://github.com/ceph/ceph-sepia-secrets|secrets repo]] which gets automatically merged
    - The service runs the [[services:Wireguard]] role against soko01 to add their key
    - The service runs the users role to create their user account on soko04
    - The service e-mails the user's Wireguard IP address to them

=== The flow for existing lab users is: ===

  - Existing users register via this [[https://onboarding.sepia.ceph.com/wireguard/request|page]]
  - A magic link is sent to the user
    - If the user approves, all of the same PRs are opened, merged, and keys are pushed via ansible
    - If the user denies, information (IP address, timestamps, etc.) about the attempt are e-mailed to infra@ceph.io