almanac.diviner
d2df3064bcc3stable

almanac.diviner
View Options

			@title Almanac User Guide
			@group userguide

			Using Almanac to manage services.

			= Overview =

			IMPORTANT: Almanac is a prototype application. See
			@{article:User Guide: Prototype Applications}.

			Locking and Unlocking Services
			==============================

			Services can be locked to prevent edits from the web UI. This primarily hardens
			Almanac against attacks involving account compromise. Notably, locking cluster
			services prevents an attacker from modifying the Phabricator cluster definition.
			For more details on this scenario, see
			@{article:User Guide: Phabricator Clusters}.

			Beyond hardening cluster definitions, you might also want to lock a service to
			prevent accidental edits.

			To lock a service, run:

			phabricator/ $ ./bin/almanac lock <service>

			To unlock a service later, run:

			phabricator/ $ ./bin/almanac unlock <service>

			Locking a service also locks all of the service's bindings and properties, as
			well as the devices connected to the service. Generally, no part of the
			service definition can be modified while it is locked.

			Devices (and their properties) will remain locked as long as they are bound to
			at least one locked service. To edit a device, you'll need to unlock all the
			services it is bound to.

			Locked services and devices will show that they are locked in the web UI, and
			editing options will be unavailable.