| 1 |
# Bento service-deploy grant. Install on each host that runs a Bento-deployed |
| 2 |
# service (currently astra and alpha-west-1, both running pom): |
| 3 |
# |
| 4 |
# sudo install -m 0440 bento-deploy.sudoers /etc/sudoers.d/bento-deploy |
| 5 |
# sudo visudo -cf /etc/sudoers.d/bento-deploy # validate before trusting it |
| 6 |
# |
| 7 |
# The deploy user -- the same user Bento's executor SSHes as -- may run ONLY the |
| 8 |
# service installer, with any arguments. The arguments are bounded by the script |
| 9 |
# itself (src under /var/tmp/bento-deploy, dst under /usr/local/bin, service a |
| 10 |
# bare *.service unit), so this is a script-guarded grant rather than a broad |
| 11 |
# install + systemctl one. Sando's mnw-companion.sudoers is the same line for |
| 12 |
# the same reason. |
| 13 |
# |
| 14 |
# Uncomment the line matching how Bento reaches this host. Both are listed |
| 15 |
# because pom's two instances are reached as different users: astra over the |
| 16 |
# tailnet as max, and the Hetzner box over Tailscale SSH as root. A root deploy |
| 17 |
# user does not need the grant at all -- the line is harmless there and keeps |
| 18 |
# the two hosts configured identically. |
| 19 |
|
| 20 |
max ALL=(root) NOPASSWD: /usr/local/lib/bento/install-service.sh * |
| 21 |
# root ALL=(root) NOPASSWD: /usr/local/lib/bento/install-service.sh * |
| 22 |
|