# fleetserver: scoped sudo grants for the unprivileged ``_fleetserver``
# system user (Linux variant).  Only the WireGuard hub maintenance
# commands need root; everything else fleetserver does — DB writes,
# REST handlers, audit log writes — happens as ``_fleetserver``
# directly.
#
# Linux only — FreeBSD uses ports/marlinos/fleetserver/files/sudoers-fleetserver
# Permissions: 0440 root:root

# WireGuard live-reload after a wg0.conf rewrite.  ``wg syncconf``
# reads from stdin (peer-level update; survives without dropping the
# tunnel); fall through to a unit restart if it refuses.
_fleetserver ALL=(root) NOPASSWD: /usr/bin/wg-quick strip *
_fleetserver ALL=(root) NOPASSWD: /usr/bin/wg syncconf * /dev/stdin

# Full restart fallback — used when ``wg syncconf`` reports an
# incompatible config (e.g. the listen port changed).
_fleetserver ALL=(root) NOPASSWD: /usr/bin/systemctl restart wg-quick@*
_fleetserver ALL=(root) NOPASSWD: /usr/bin/systemctl reload wg-quick@*
