# This is the sudoers file for the ops user to give limited access to specific commands without a password
# Used for automations like ansible and maintenance

# Hostname
ops ALL=(root) NOPASSWD: /usr/bin/hostnamectl hostname *

# Reboot
ops ALL=(root) NOPASSWD: /usr/bin/reboot

# System updates
ops ALL=(root) NOPASSWD: /usr/bin/dnf update*, /usr/bin/dnf upgrade*, /usr/bin/dnf install *, /usr/bin/dnf remove *

# Package cache management
ops ALL=(root) NOPASSWD: /usr/bin/dnf clean all, /usr/bin/dnf makecache, /usr/bin/dnf autoremove

# Repos
ops ALL=(root) NOPASSWD: /usr/bin/dnf config-manager addrepo *

# Service management
ops ALL=(root) NOPASSWD: /usr/bin/systemctl start *, /usr/bin/systemctl restart *, /usr/bin/systemctl reload *, /usr/bin/systemctl enable *

# Firewall
ops ALL=(root) NOPASSWD: /usr/bin/firewall-cmd *

# Ansible
ops ALL=(root) NOPASSWD: /bin/sh -c echo BECOME-SUCCESS-* ; /usr/bin/python3 /home/ops/.ansible*

# qemu-img
ops ALL=(root) NOPASSWD: /usr/bin/qemu-img *

# virsh
ops ALL=(root) NOPASSWD: /usr/bin/virsh *

# virt-install
ops ALL=(root) NOPASSWD: /usr/bin/virt-install *

# composer-cli
ops ALL=(root) NOPASSWD: /usr/bin/composer-cli *

# osbuild
ops ALL=(root) NOPASSWD: /usr/local/bin/osbuild-auto.sh

# getfacl
ops ALL=(root) NOPASSWD: /usr/sbin/getfacl*

# set default rwx sbin
ops ALL=(root) NOPASSWD: /usr/sbin/setfacl -R -d -m u\:ops\:rwx /usr/local/sbin

# set existing rwx sbin
ops ALL=(root) NOPASSWD: /usr/sbin/setfacl -R -m u\:ops\:rwx /usr/local/sbin

# set default rwx /srv
ops ALL=(root) NOPASSWD: /usr/sbin/setfacl -R -d -m u\:ops\:rwx /srv/*

# set existing rwx /srv
ops ALL=(root) NOPASSWD: /usr/sbin/setfacl -R -m u\:ops\:rwx /srv/*

# Start btrfs scrub
ops ALL=(root) NOPASSWD: /usr/bin/btrfs scrub*