# Allow wake user to reload/restart services without password.
# Required by waked asset_manager post-deploy actions:
#   kill --signal=HUP — SIGHUP for wake lock-free .thrt/.mmdb/.overlay swap
#   restart — full restart after rulebase/config deploy
#   install/mkdir — deploy configs/rulebases to system directories
#
# Note: 'reload' is not used because many rsyslog unit files lack ExecReload.
# Instead, 'kill --signal=HUP' sends SIGHUP directly (the native rsyslog reload).
# The rsyslog service name is configurable from wakeweb (default: rsyslog).
#
# Install: cp sudoers-wake /etc/sudoers.d/wake && chmod 440 /etc/sudoers.d/wake
wake ALL=(root) NOPASSWD: /usr/bin/systemctl kill --signal=HUP *, /usr/bin/systemctl restart *
wake ALL=(root) NOPASSWD: /usr/bin/install, /bin/mkdir
