New nametfv is now teriac. See what changed and how to move over.
v0.2.1
teriac server Emergency access and reports

Emergency access and reports

Time-limited break-glass grants from the dashboard, with every step audited and announced, plus a weekly chat summary and delivery metrics.

New in 0.2.0. Upgrade teriac server to 0.2.0 or later to use the settings on this page.

Emergency access

Production is down, and the people who'd approve the fix are asleep. Break-glass access lets a named grantor give someone a permission for a few hours, with a reason, and records every step.

break_glass:                            # in repos.yaml
  grantors: [admin, "user:sre-lead@acme.com", "group:oncall"]
  max_hours: 4
  notify: [infra-alerts]
Key Default
grantors Who can grant: admin (dashboard admins), user:<x> (a username or SSO email), group:<x> (an SSO group, from the OIDC groups claim)
max_hours 4 Longest a grant may last, 1 to 72
notify Channel names from channels, told about every grant, first use, revoke and expiry

Giving access

On the dashboard's Access page, a grantor fills in:

Field
User The source-control username the access is for
Repo One repo, or all repos
Projects Globs, e.g. prod/**. Leave empty for every project
Permissions Any of teriac's permissions: apply, apply_destroy, state_remove, force_unlock, …
Skip Optional: approvals, freeze, protected, policy
Hours Up to max_hours
Reason At least 10 characters. It goes to the audit log

For example: apply on prod/** for 2 hours, skipping approvals, because "Restore the payments database after the outage, INC-4821".

What gets recorded

The grant, its first use, a revoke, and the expiry each:

  • go to the audit log;
  • are sent to the notify channels (🚨 Emergency access #12 granted to alice).

A grant ends on its own when its hours are up. Dashboard admins and grantors can revoke it earlier from the Access page.

break_glass is server-wide only: it goes at the top of repos.yaml, not in a repo entry.

API

Request
GET /api/grants Active grants and the 50 most recent, plus whether you may grant
POST /api/grants Give access (grantors only). Body: user, repo, projects, actions, bypass, hours, reason
POST /api/grants/<id>/revoke Revoke a grant (admins and grantors) 
curl -X POST https://teriac.acme.dev/api/grants \
  -H "Authorization: Bearer $TERIAC_API_TOKEN" -H "Content-Type: application/json" \
  -d '{"user":"alice","repo":"github.com/acme/infra","projects":["prod/**"],
       "actions":["apply"],"bypass":["approvals"],"hours":2,
       "reason":"Restore the payments database after the outage, INC-4821"}'

Weekly summary

A chat message once a week, so the team sees how infrastructure changes are going without opening the dashboard. Like break_glass, it's server-wide:

summary:                                # in repos.yaml
  schedule: "0 9 * * 1"                 # Mondays at 09:00
  timezone: Europe/Berlin
  notify: [infra-alerts]
  days: 7

It covers:

  • runs, failures, and how fast changes ship: PR to applied, failed applies, time to fix;
  • open drift, and locks held for more than 3 days;
  • the slowest projects and the most active people;
  • policy findings, refused actions, and emergency access given.

Delivery metrics

The dashboard's Metrics page has delivery tiles next to the run, timing and resource charts:

Tile
PR to applied Median time from opening a PR to applying it
Failed applies Share of applies that failed
Time to fix Median time from a failed apply to that project's next successful one
Applies per week How often changes ship

They follow the date range you pick, like the rest of the dashboard.