From d9925b931d61311460f4ed81d502e12fbc3dfdb0 Mon Sep 17 00:00:00 2001
From: ducoterra <git@ducoterra.net>
Date: Mon, 12 Oct 2026 10:31:36 -0400
Subject: [PATCH] add sudoers allowlist for ops user automation

Passwordless sudo access scoped to specific commands (dnf, systemctl,
firewall-cmd, ansible, qemu/virt, btrfs, acl) for ansible and
maintenance automations on the fedora host.

LLM-Generated: true
---
 active/os_fedora/sudoers.d/ops | 59 ++++++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)
 create mode 100644 active/os_fedora/sudoers.d/ops

diff --git a/active/os_fedora/sudoers.d/ops b/active/os_fedora/sudoers.d/ops
new file mode 100644
index 0000000..a34123e
--- /dev/null
+++ b/active/os_fedora/sudoers.d/ops
@@ -0,0 +1,59 @@
+# This is the sudoers file for the ops user to give limited access to specific commands without a password
+# Used for automations like ansible and maintenance
+
+# Hostname
+ops ALL=(root) NOPASSWD: /usr/bin/hostnamectl hostname *
+
+# Reboot
+ops ALL=(root) NOPASSWD: /usr/bin/reboot
+
+# System updates
+ops ALL=(root) NOPASSWD: /usr/bin/dnf update*, /usr/bin/dnf upgrade*, /usr/bin/dnf install *, /usr/bin/dnf remove *
+
+# Package cache management
+ops ALL=(root) NOPASSWD: /usr/bin/dnf clean all, /usr/bin/dnf makecache, /usr/bin/dnf autoremove
+
+# Repos
+ops ALL=(root) NOPASSWD: /usr/bin/dnf config-manager addrepo *
+
+# Service management
+ops ALL=(root) NOPASSWD: /usr/bin/systemctl start *, /usr/bin/systemctl restart *, /usr/bin/systemctl reload *, /usr/bin/systemctl enable *
+
+# Firewall
+ops ALL=(root) NOPASSWD: /usr/bin/firewall-cmd *
+
+# Ansible
+ops ALL=(root) NOPASSWD: /bin/sh -c echo BECOME-SUCCESS-* ; /usr/bin/python3 /home/ops/.ansible*
+
+# qemu-img
+ops ALL=(root) NOPASSWD: /usr/bin/qemu-img *
+
+# virsh
+ops ALL=(root) NOPASSWD: /usr/bin/virsh *
+
+# virt-install
+ops ALL=(root) NOPASSWD: /usr/bin/virt-install *
+
+# composer-cli
+ops ALL=(root) NOPASSWD: /usr/bin/composer-cli *
+
+# osbuild
+ops ALL=(root) NOPASSWD: /usr/local/bin/osbuild-auto.sh
+
+# getfacl
+ops ALL=(root) NOPASSWD: /usr/sbin/getfacl*
+
+# set default rwx sbin
+ops ALL=(root) NOPASSWD: /usr/sbin/setfacl -R -d -m u\:ops\:rwx /usr/local/sbin
+
+# set existing rwx sbin
+ops ALL=(root) NOPASSWD: /usr/sbin/setfacl -R -m u\:ops\:rwx /usr/local/sbin
+
+# set default rwx /srv
+ops ALL=(root) NOPASSWD: /usr/sbin/setfacl -R -d -m u\:ops\:rwx /srv/*
+
+# set existing rwx /srv
+ops ALL=(root) NOPASSWD: /usr/sbin/setfacl -R -m u\:ops\:rwx /srv/*
+
+# Start btrfs scrub
+ops ALL=(root) NOPASSWD: /usr/bin/btrfs scrub*
\ No newline at end of file