document mass password rotation (tpo/tpa/team#41530)

service/password-manager.md

@@ -99,7 +99,81 @@ be rotated.
 
 See [mass password rotation](#mass-password-rotation) procedures.
 
-## TODO: Mass password rotation
+## Mass password rotation
+
+It's possible (but very time consuming) to rotate multiple passwords
+in the store. For this, the [pass-update](https://github.com/roddhjav/pass-update/) tool is useful, as it
+automates part of the process. It will:
+
+ 1. for all (or a subset of) passwords
+ 2. copy the current password to the clipboard (or show it)
+ 3. wait for the operator to copy-paste it to the site
+ 4. generate and save a new password, and copy it to the clipboard
+
+So a bulk update procedure looks like this:
+
+    pass update -c
+
+That will take a long time to proceed those, so it's probably better
+to do it one service at a time. Here's documentation specific to each
+section of the password manager. You should prioritize the `dns` and
+`hosting` sections.
+
+See [issue 41530](https://gitlab.torproject.org/tpo/tpa/team/-/issues/41530) for a mass-password rotation run.
+
+### DNS and hosting
+
+Those two are similar and give access to critical parts of the
+infrastructure, so they are worth processing first. Start with current
+hosting and DNS providers:
+
+    pass update -c dns/joker dns/portal.netnod.se hosting/accounts.hetzner.com hosting/app.fastly.com
+
+Then the rest of them:
+
+    pass update -c hosting
+
+### Services
+
+Those are generally websites with special accesses. They are of a
+lesser priority, but should nevertheless be processed:
+
+    pass update -c services
+
+It might be worth examining the service list to prioritize some of
+them.
+
+### root
+
+Next, the root passwords need to be rotated.
+
+TODO: fabric task?
+
+### OOB
+
+Similarly, out-of band access need to be reset. This involves logging
+in to each server's BIOS and changing the password. `pass update`,
+again, should help, but instead of going through a web browser, it's
+likely more efficient to do this over SSH:
+
+    pass update -c oob
+
+### LUKS
+
+Next, full disk encryption keys.
+
+TODO: fabric task?
+
+### lists
+
+Individual list passwords may be rotated, but that's a lot of trouble
+and coordination. The site password should be changed, at least. When
+Mailman 3 is deployed, all those will go away anyway.
+
+### misc
+
+Those can probably be left alone; it's unclear if they have any
+relevance left and should probably be removed.
 
 ## Pager playbook