# Eleven Messenger fleet — operator command allowlist.
# Installed at /etc/sudoers.d/lchat-operators (mode 0440) by the operator-setup stage.
# This file IS the operator ops surface: amend it via a reviewed PR + redeploy,
# never by hand-editing on a box. Root shells are bootstrap-only.
#
# NB: the fleet runs Ubuntu 26.04, whose default sudo is sudo-rs (the Rust
# rewrite). sudo-rs rejects argument wildcards (e.g. `systemctl restart
# lchat-*`) — only a whole-argument `*` (any args) is allowed. So systemctl is
# scoped through the lchat-svc helper (deploy/lchat-svc), not an argument glob.
# Keep every command spec here either exact-args or `<path> *`.
%lchat-operators ALL=(root) NOPASSWD: /opt/lchat/lchat, /opt/lchat/lchat *
# Scoped systemctl for lchat* units (the helper enforces the prefix):
%lchat-operators ALL=(root) NOPASSWD: /usr/local/sbin/lchat-svc *
# The SSH-flip deadman units are not lchat-prefixed, so grant them exactly:
%lchat-operators ALL=(root) NOPASSWD: /usr/bin/systemctl start sshroot-revert.service, /usr/bin/systemctl stop sshroot-revert.timer, /usr/bin/systemctl stop sshflip-revert.timer
%lchat-operators ALL=(root) NOPASSWD: /usr/bin/wg, /usr/bin/wg *, /usr/bin/wg-quick save wg0
%lchat-operators ALL=(root) NOPASSWD: /usr/local/sbin/lchat-env-install *
%lchat-operators ALL=(root) NOPASSWD: /opt/lchat/fleet-backup.sh