Download this file
| 1 | # Eleven Messenger fleet — operator command allowlist. |
| 2 | # Installed at /etc/sudoers.d/lchat-operators (mode 0440) by the operator-setup stage. |
| 3 | # This file IS the operator ops surface: amend it via a reviewed PR + redeploy, |
| 4 | # never by hand-editing on a box. Root shells are bootstrap-only. |
| 5 | # |
| 6 | # NB: the fleet runs Ubuntu 26.04, whose default sudo is sudo-rs (the Rust |
| 7 | # rewrite). sudo-rs rejects argument wildcards (e.g. `systemctl restart |
| 8 | # lchat-*`) — only a whole-argument `*` (any args) is allowed. So systemctl is |
| 9 | # scoped through the lchat-svc helper (deploy/lchat-svc), not an argument glob. |
| 10 | # Keep every command spec here either exact-args or `<path> *`. |
| 11 | %lchat-operators ALL=(root) NOPASSWD: /opt/lchat/lchat, /opt/lchat/lchat * |
| 12 | # Scoped systemctl for lchat* units (the helper enforces the prefix): |
| 13 | %lchat-operators ALL=(root) NOPASSWD: /usr/local/sbin/lchat-svc * |
| 14 | # The SSH-flip deadman units are not lchat-prefixed, so grant them exactly: |
| 15 | %lchat-operators ALL=(root) NOPASSWD: /usr/bin/systemctl start sshroot-revert.service, /usr/bin/systemctl stop sshroot-revert.timer, /usr/bin/systemctl stop sshflip-revert.timer |
| 16 | %lchat-operators ALL=(root) NOPASSWD: /usr/bin/wg, /usr/bin/wg *, /usr/bin/wg-quick save wg0 |
| 17 | %lchat-operators ALL=(root) NOPASSWD: /usr/local/sbin/lchat-env-install * |
| 18 | %lchat-operators ALL=(root) NOPASSWD: /opt/lchat/fleet-backup.sh |
| 19 | |
amadan