Don't do steps (3) or (4)! Those are useless at best, and dangerous at worst.

You should only generate keys or register devices which are directly part of the primary Phabricator cluster (running Phabricator itself and fully-trusted). The warning on bin/almanac trust-key is serious. Registering these devices will let your unit tests log in as any user, read and write any data, etc., which is very bad.

https://secure.phabricator.com/book/phabricator/article/drydock_hosts/#almanac-hosts is the current guidance on what you should do.

Ok thanks. So I don't need to register my build agent with ./bin/almanac register?

Right. You just need to:

• Pick a name for it.
• Plug in the IP address.
• Bind it to your pool to actually put it in service.

So what does ./bin/almanac register actually do?

In T9760#144107, @epriestley wrote:

• Bind it to your pool to actually put it in service.

This just means adding a device interface? So I could have a single Almanac device with multiple interfaces on the same port but pointing to different machines?

This just means adding a device interface?

No. Go to the Service, (buildpool001.mycompany.com) and bind new devices to add them to service (e.g., bind build003 and build004) or remove old devices (e.g., unbind build001 to take it out of service).

So I could have a single Almanac device with multiple interfaces on the same port but pointing to different machines?

Yes, but there's no advantage to doing this and it's incredibly confusing.

Right okay, but I can't autoscale the Drydock Pool right? Because I need to manually create new devices through the UI.

bin/almanac register is just a shortcut for "put the private half of a key in the right place on disk, and the public half on the specified Almanac device". Maybe a clearer name would be bin/almanac install-keys.

Build hosts should not be authenticating to Phabricator as cluster devices so they should not have any device keys.

Right, Almanac does not support autoscaling. We'll have an EC2 blueprint (and similar) in the future which can manage autoscaling more simply. Almanac is the ground level "I have a list of IPs" version of things.

In T9760#144113, @epriestley wrote:

Right, Almanac does not support autoscaling.

OK, thanks. This is basically the purpose of this ticket (it may be a duplicate)

I don't plan Almanac to ever autoscale. Autoscaling would be via a new, non-Almanac EC2 blueprint (or similar blueprints, which permit creation of new host resources). I'm just going to merge this into T5544.