UID

UID ranges

Reserved UIDs & GIDs

Althrough we try to keep this up-to-date it the authoritative source is admin.yaml

Make sure to add reservation entry to admin.yaml

If you want the account to be created every where you must reserve the UID in the puppet admin module and use systemd-sysuser. like in this example.

If the user will just exist on a few machines then you should reserve the account in the admin module with a commented block. like in this example, then create the user with a normal user block e.g.

    systemd::sysuser { 'phd':
        ensure      => present,
        id          => '920:920',
        description => 'Phabricator daemon user',
        home_dir    => '/var/run/phd',
    }

• (table columns are sortable)

Permission/security hierarchy

the security hierarchy looks as follows as decribed by TimStarling:

• root > wikidev > mwdeploy > www-data
  • root can own wikidev but wikidev can't own root
  • wikidev can own mwdeploy but mwdeploy can't own wikidev
  • scripts owned by mwdeploy can only be run by www-data
  • everything has to su to www-data before running maintenance scripts

also see: task T79786