# /etc/sudoers
##
## THIS FILE IS UNDER PUPPET CONTROL. DON'T EDIT IT HERE.
## USE: git clone git+ssh://$USER@puppet.debian.org/srv/puppet.debian.org/git/dsa-puppet.git
##

###################################################################
###################################################################
###################################################################
##
## PLEASE EDIT THIS FILE WITH THE visudo COMMAND TO ENSURE IT
## IS SYNTACTICALLY VALID.
##
##  /usr/sbin/visudo -f sudoers
##
###################################################################
###################################################################
###################################################################

Defaults	env_reset

# Host alias specification
Host_Alias	QAHOSTS		= master, merkel
Host_Alias	WEBHOSTS	= klecker, wolkenstein
# User alias specification
User_Alias	QACORE		= aba, djpig, hertzog, jeroen, joerg, lucas, luk, myon, tbm, weasel, zack

# Cmnd alias specification

# User privilege specification
root	ALL=(ALL) ALL


# DSA and local admins
%adm		ALL=(ALL)	ALL
%adm		ALL=(ALL)	NOPASSWD: /usr/bin/apt-get update, /usr/bin/apt-get dist-upgrade, /usr/bin/apt-get clean, /usr/sbin/samhain -t check -i -p err -s none -l none -m none, /usr/sbin/upgrade-porter-chroots

admin		agnesi=(ALL)	ALL
%zivit-admins	zelenka=(ALL)	NOPASSWD: ALL

# nagios
nagios		ALL=(ALL)	NOPASSWD: /usr/lib/nagios/plugins/dsa-check-dabackup ""
# with smartarray controllers
nagios		ALL=(ALL)	NOPASSWD: /usr/bin/arrayprobe ""
nagios		ALL=(ALL)	NOPASSWD: /usr/sbin/hpacucli controller all show
nagios		ALL=(ALL)	NOPASSWD: /usr/sbin/hpacucli controller slot=[02] pd all show
nagios		ALL=(ALL)	NOPASSWD: /usr/sbin/hpacucli controller slot=0 pd [0-9]\:[0-9] show
nagios		ALL=(ALL)	NOPASSWD: /usr/sbin/hpacucli controller slot=0 pd [0-9]I\:[0-9]\:[0-9] show
nagios		ALL=(ALL)	NOPASSWD: /usr/sbin/hpacucli controller slot=[02] show status
# other raid controllers
nagios		master=(ALL)	NOPASSWD: /usr/sbin/mpt-status -s
nagios		powell=(ALL)	NOPASSWD: /usr/local/sbin/areca-cli vsf info
nagios		puccini=(ALL)	NOPASSWD: /usr/local/bin/tw_cli info c0 u0 status
nagios		bellini,cimarosa,morricone=(ALL)	NOPASSWD: /usr/local/bin/arcconf GETCONFIG 1 LD, /usr/local/bin/arcconf GETCONFIG 1 AD

# groups and their role accounts
%buildd		ALL=(buildd)	ALL
%d-i		ALL=(d-i)	ALL
%dde		ALL=(dde)	ALL
%debadmin	ALL=(dak)	ALL
%debbugs	ALL=(debbugs)	ALL
%debian-release	ALL=(release)	ALL
%debwww		ALL=(debwww)	ALL
%forums		ALL=(forums)	ALL
%keyring	ALL=(keyring)	ALL
%lintian	ALL=(lintian)	ALL
%listweb	ALL=(listweb)	ALL
%list		liszt=(list)	ALL
%mirroradm	ALL=(archvsync)	ALL
%nm		ALL=(nm)	ALL
%piuparts	ALL=(piupartsm)	ALL
%piuparts	ALL=(piupartss)	ALL
%pkg_maint	ALL=(pkg_user)	ALL
%planet		ALL=(planet)	ALL
%popcon		ALL=(popcon)	ALL
%secretary	ALL=(secretary)	ALL
%snapshot	ALL=(snapshot)	ALL
%uddadm		ALL=(udd)	ALL
%volatile	ALL=(volatile)	ALL
%wbadm		ALL=(wbadm)	ALL
%wikiadm	ALL=(wiki)	ALL
QACORE		QAHOSTS=(qa)	ALL

# some groups are in apachectrl on "their" hosts so they can reload apache and update their vhost
%apachectrl	ALL=(root)	/usr/sbin/apache2-vhost-update

# buildd
# FIXME: change that ALL for hosts to a hostlist of buildds?
Defaults:buildd env_reset,env_keep+="APT_CONFIG DEBIAN_FRONTEND"
buildd		ALL=(ALL)		NOPASSWD: ALL

# The piuparts slave needs to handle chroots
piupartss	piatti=(ALL)		NOPASSWD: ALL
# trigger of mirror run for packages
pkg_user	powell=(archvsync)	NOPASSWD: /home/archvsync/bin/pushpdo
# on draghi, the domains git thing will run bind9 reload afterwards
%adm		draghi=(root)		NOPASSWD: /etc/init.d/bind9 reload
%adm		draghi=(geodnssync)	NOPASSWD: /usr/bin/make -C /srv/db.debian.org/dns
# remote power to babylon5 in the same rack:
joerg		unger=(ALL)		/usr/bin/sispmctl -t 1, /usr/bin/sispmctl -g 1
# wbadm can update all buildd* users' keys on buildd.d.o
%wbadm		raff=(root)		/usr/local/bin/update-buildd-sshkeys
%wbadm		cimarosa=(root)		/usr/local/bin/update-buildd-sshkeys
# mirror push
dak		ries=(archvsync)	NOPASSWD:/home/archvsync/runmirrors
planet		senfl=(archvsync)	NOPASSWD: /home/archvsync/bin/runplanet ""
# archvsync triggers snapshot
archvsync	stabile=(snapshot)	NOPASSWD: /srv/snapshot.debian.org/bin/update-trigger
# dak stuff
%debian-release	ries=(dak)		/usr/local/bin/dak transitions --import *
%ftpteam	ries=(dak)		/usr/local/bin/dak transitions --import *
# security
%security	klecker=(dak)		NOPASSWD: /usr/local/bin/dak new-security-install -[AR] -- *
%sec_public	klecker=(dak)		NOPASSWD: /usr/local/bin/dak new-security-install -[AR] -- *
%sec_data	klecker=(archvsync)	NOPASSWD: /home/archvsync/security/signal ""
dak		klecker=(archvsync)	NOPASSWD: /home/archvsync/signal_security
# web stuff
debwww		WEBHOSTS=(archvsync)	NOPASSWD: /home/archvsync/webmirrors/runmirrors
# more list stuff
%list		liszt=(root)		/usr/sbin/postfix reload
%list		liszt=(root)		/usr/sbin/qshape, /usr/sbin/postsuper
%list		liszt=(root)		/etc/init.d/spamassassin, /etc/init.d/amavis
%list		liszt=(amavis)		NOPASSWD: /usr/bin/sa-learn
%list		liszt=(amavis)		ALL
# geodns may reload bind
geodnssync	geo1,geo2,geo3=(root)	NOPASSWD: /etc/init.d/bind9 reload
geodnssync	geo1,geo2,geo3=(root)	NOPASSWD: /usr/sbin/rndc reconfig