Skip to content
d-centralize handbook

Offboarding an employee

These steps are performed by a d-centralize admin.

Removing a user

Section titled “Removing a user”

Run the person-scoped offboarding flow from the scripts repository. It shows the complete plan by default and applies it only with --apply:

Terminal window
uv run onboarding/sync_users.py --offboard <localpart>
uv run onboarding/sync_users.py --offboard <localpart> --apply

The command deletes the person’s cuda-dev containers and WireGuard peers, deactivates their mailbox, blocks GitLab, deactivates Mattermost, removes Sentry membership, disables Nextcloud accounts, and disables Keycloak last. It is person-scoped and safe to rerun after a partial failure.

After the command succeeds:

  1. Remove the person from onboarding/users.yaml and merge the change.
  2. Reconcile the Vaultwarden roster with uv run onboarding/sync_users.py --service vaultwarden --apply.
  3. Complete the manual organisation steps:
    • draft the returned-key agreement in inContract;
    • remove the person from the Loqed app;
    • email Inphos support to remove Wi-Fi and service portal access;
    • deactivate the person in Kimai, which takes them out of the lists people pick from. Disabling their Keycloak account already stops them signing in, and deactivating the Kimai account needs the break-glass administrator: the kimai-admins group grants ROLE_ADMIN, which manages the time tracking but not the accounts.

Use uv run onboarding/sync_users.py --prune-mailboxes --apply for the mailbox retention sweep. It deletes managed SSO mailboxes only after they have stayed disabled and idle for more than one year.