generic-worker on macOS: more docs, move minion config out of roster

etc/taskcluster/macos/README.md

@@ -15,10 +15,20 @@ cd etc/taskcluster/macos
 ./salt-ssh '*' state.apply test=True
 ```
 
-## Servers
+## (Re)deploying a server
 
-Servers are provisioned manually from MacStadium.
+* Place an order or file a ticket with MacStadium to get a new hardware or reinstall an OS.
-The `config/roster` file lists them by DNS name.
+
+* Change the administrator password to one generated with
+  `</dev/urandom tr -d -c 'a-zA-Z' | head -c 8; echo`
+  (this short because of VNC),
+  and save it in the shared 1Password account.
+
+* Give the public IPv4 address a DNS name through Cloudflare.
+
+* Add a correponding entry in the `config/roster` file.
+
+* Log in through VNC, and run `xcode-select --install`
 
 
 ## Taskcluster secrets

etc/taskcluster/macos/config/master

@@ -5,3 +5,9 @@ file_roots:
 extension_modules: ../modules
 ext_pillar:
   - taskcluster_secrets:
+roster_defaults:
+    # https://github.com/saltstack/salt/issues/50477
+    minion_opts:
+        providers:
+            user: mac_user
+            group: mac_group

etc/taskcluster/macos/config/roster

@@ -1,8 +1,2 @@
 mac1:
     host: servo-tc-mac1.servo.org
-
-    # https://github.com/saltstack/salt/issues/50477
-    minion_opts:
-        providers:
-            user: mac_user
-            group: mac_group