| 1 |
# Sando companion-deploy grant. Install to /etc/sudoers.d/ on each node that |
| 2 |
# hosts a companion service: |
| 3 |
# |
| 4 |
# sudo install -m 0440 mnw-companion.sudoers /etc/sudoers.d/mnw-companion |
| 5 |
# sudo visudo -cf /etc/sudoers.d/mnw-companion # validate before trusting it |
| 6 |
# |
| 7 |
# The deploy user — the user Sando's executor SSHes as, per that node's |
| 8 |
# `ssh_target` in sando.toml — may run ONLY the companion installer, with any |
| 9 |
# args. The args are bounded by the script itself (src must be inside a release |
| 10 |
# bundle, dst under /opt, service a bare *.service unit), so the wildcard is a |
| 11 |
# script-guarded grant, not a broad install/systemctl grant. This is the |
| 12 |
# companion analogue of the existing |
| 13 |
# `makenotwork ... /bin/systemctl reload-or-restart makenotwork.service` line. |
| 14 |
# |
| 15 |
# Sando does not SSH as the same user everywhere: prod-1 is `makenotwork@alpha-west-1` |
| 16 |
# (a pre-existing service user, kept rather than renamed) and testnot-1 is |
| 17 |
# `deploy@testnot`. Both are named here rather than the file being edited per |
| 18 |
# node, because a hand-edit at install time is the failure mode this replaces: |
| 19 |
# the grant looks present, `visudo -c` passes, and the install is denied only on |
| 20 |
# the far side of the symlink swap. sudoers accepts a user that does not exist on |
| 21 |
# the box, so the line for the other node is inert, not an error — the file |
| 22 |
# installs verbatim everywhere. |
| 23 |
# |
| 24 |
# A node added later needs its deploy user added here. Keep this list and the |
| 25 |
# `ssh_target` values in sando.toml in step. |
| 26 |
makenotwork ALL=(root) NOPASSWD: /usr/local/lib/mnw/install-companion.sh * |
| 27 |
deploy ALL=(root) NOPASSWD: /usr/local/lib/mnw/install-companion.sh * |
| 28 |
|