| 1 |
# Sando companion-deploy grant. Install to /etc/sudoers.d/ on each node that |
| 2 |
# hosts a companion service (currently prod-1 / alpha-west-1): |
| 3 |
# |
| 4 |
# sudo install -m 0440 mnw-companion.sudoers /etc/sudoers.d/mnw-companion |
| 5 |
# sudo visudo -cf /etc/sudoers.d/mnw-companion # validate before trusting it |
| 6 |
# |
| 7 |
# The deploy user (makenotwork on prod — the same user Sando's executor SSHes as) |
| 8 |
# may run ONLY the companion installer, with any args. The args are bounded by |
| 9 |
# the script itself (src must be inside a release bundle, dst under /opt, service |
| 10 |
# a bare *.service unit), so the wildcard is a script-guarded grant, not a broad |
| 11 |
# install/systemctl grant. This is the companion analogue of the existing |
| 12 |
# `makenotwork ... /bin/systemctl reload-or-restart makenotwork.service` line. |
| 13 |
makenotwork ALL=(root) NOPASSWD: /usr/local/lib/mnw/install-companion.sh * |
| 14 |
|