From 071f4b449498c25450bed4ce0b3d6366da36c518 Mon Sep 17 00:00:00 2001
From: Elan Hourticolon-Retzler <nb@elanhr.org>
Date: Fri, 14 Aug 2026 02:01:00 -0700
Subject: [PATCH] chore(noisegarden): Adds a read-only user to enable wiki
 mirror exports.

---
 group_vars/all/users.yml               |  6 ++++++
 host_vars/m3.noisebridge.net/users.yml |  1 +
 roles/security/tasks/users.yml         | 10 ++++++++++
 3 files changed, 17 insertions(+)

diff --git a/group_vars/all/users.yml b/group_vars/all/users.yml
index 616c40c6..c3858218 100644
--- a/group_vars/all/users.yml
+++ b/group_vars/all/users.yml
@@ -83,6 +83,12 @@ users:
     fullname: "Ronald Miloh Alexander"
     email: "..."
 
+  noisegarden:
+    fullname: "noisegarden wiki-migration service account (read-only)"
+    ssh_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN4eRBenRW/b0UDq9EkZ54DqqcMmhjd1GsrAeDx8b+qy noisegarden-migration"
+    groups:
+      - www-data
+
   nthmost:
     fullname: "Naomi Most"
     email: "..."
diff --git a/host_vars/m3.noisebridge.net/users.yml b/host_vars/m3.noisebridge.net/users.yml
index 116ab715..dbc94db1 100644
--- a/host_vars/m3.noisebridge.net/users.yml
+++ b/host_vars/m3.noisebridge.net/users.yml
@@ -4,4 +4,5 @@ security_users:
   - mcint
   - elan
   - jetpham
+  - noisegarden
   - nthmost
diff --git a/roles/security/tasks/users.yml b/roles/security/tasks/users.yml
index 10787118..eaef7975 100644
--- a/roles/security/tasks/users.yml
+++ b/roles/security/tasks/users.yml
@@ -35,3 +35,13 @@
   when: security_users_directory[item].ssh_key is defined
   tags:
     - access
+
+- name: Supplementary groups
+  ansible.builtin.user:
+    name: "{{ item }}"
+    groups: "{{ security_users_directory[item].groups }}"
+    append: true
+  loop: "{{ security_admins + security_users | flatten | unique }}"
+  when: security_users_directory[item].groups is defined
+  tags:
+    - access
\ No newline at end of file