Merge branch 'master' of git+ssh://puppet.debian.org/srv/puppet.debian.org/git/dsa...

[dsa-puppet.git] / modules / sudo / files / common / sudoers

diff --git a/modules/sudo/files/common/sudoers b/modules/sudo/files/common/sudoers
index 1f8e7a156d1141974276cda661f8f52d6a3ab794..defa71ea99fddfd93a2d84ec3bce4012add581a8 100644 (file)
--- a/modules/sudo/files/common/sudoers
+++ b/modules/sudo/files/common/sudoers
@@ -21,16 +21,14 @@ Defaults    env_reset
 Defaults       passprompt="[sudo] password for %u on %h: "
 
 # Host alias specification
-Host_Alias     QAHOSTS         = master, merkel
-Host_Alias     WEBHOSTS        = klecker, wolkenstein
-Host_Alias     SECHOSTS        = klecker, chopin
-Host_Alias     FTPHOSTS        = franck
+Host_Alias     QAHOSTS         = master, merkel, quantz
+Host_Alias     WEBHOSTS        = wolkenstein
+Host_Alias     SECHOSTS        = chopin
+Host_Alias     FTPHOSTS        = franck, ries
 Host_Alias     ZIVITHOSTS      = zelenka, zandonai
-Host_Alias     AACRAIDHOSTS    = bellini, cimarosa, morricone, paganini, respighi, vivaldi, beethoven, pettersson
+Host_Alias     AACRAIDHOSTS    = bellini, morricone, paganini, respighi, vivaldi, beethoven, pettersson
 Host_Alias     MEGARAIDHOSTS   = grieg, rautavaara, sibelius
 Host_Alias     MPTRAIDHOSTS    = master, fasch, holter, barber, biber, cilea, vitry, krenek, scelsi, orff, field
-# User alias specification
-User_Alias     QACORE          = aba, djpig, geissert, hertzog, jeroen, joerg, lucas, luk, myon, tbm, weasel, zack
 
 # Cmnd alias specification
 
@@ -40,7 +38,7 @@ root  ALL=(ALL) ALL
 
 # DSA and local admins
 %adm           ALL=(ALL)       ALL
-%adm           ALL=(ALL)       NOPASSWD: /usr/bin/apt-get update, /usr/bin/apt-get dist-upgrade, /usr/bin/apt-get clean, /usr/sbin/samhain -t check -i -p err -s none -l none -m none, /usr/sbin/upgrade-porter-chroots
+%adm           ALL=(ALL)       NOPASSWD: /usr/bin/apt-get update, /usr/bin/apt-get upgrade, /usr/bin/apt-get dist-upgrade, /usr/bin/apt-get clean, /usr/sbin/samhain -t check -i -p err -s none -l none -m none, /usr/sbin/upgrade-porter-chroots
 
 admin          agnesi=(ALL)    ALL
 %zivit-admins  ZIVITHOSTS=(ALL)        NOPASSWD: ALL
@@ -78,6 +76,7 @@ nagios                beethoven=(debbackup)   NOPASSWD: /usr/lib/nagios/plugins/dsa-check-backup
 %debian-release        ALL=(release)   ALL
 %debvoip       cilea=(freeswitch)      ALL
 %debwww                ALL=(debwww)    ALL
+%btslink       ALL=(btslink)   ALL
 %forums                ALL=(forums)    ALL
 %keyring       ALL=(keyring)   ALL
 %lintian       ALL=(lintian)   ALL
@@ -99,7 +98,7 @@ nagios                beethoven=(debbackup)   NOPASSWD: /usr/lib/nagios/plugins/dsa-check-backup
 %volatile      ALL=(volatile)  ALL
 %wbadm         ALL=(wbadm)     ALL
 %wikiadm       ALL=(wiki)      ALL
-QACORE         QAHOSTS=(qa)    ALL
+%qa-core       QAHOSTS=(qa)    ALL
 
 # some groups are in apachectrl on "their" hosts so they can reload apache and update their vhost
 %apachectrl    ALL=(root)      /usr/sbin/apache2-vhost-update
@@ -114,29 +113,32 @@ piupartss piatti=(ALL)            NOPASSWD: ALL
 # trigger of mirror run for packages
 pkg_user       powell=(archvsync)      NOPASSWD: /home/archvsync/bin/pushpdo
 # on draghi, the domains git thing will run bind9 reload afterwards
-%dnsadm                draghi=(root)           NOPASSWD: /etc/init.d/bind9 reload
-%dnsadm                draghi=(geodnssync)     NOPASSWD: /usr/bin/make -C /srv/dns.debian.org/geo
+%dnsadm                draghi,orff=(root)              NOPASSWD: /etc/init.d/bind9 reload
+%dnsadm                draghi,orff=(geodnssync)        NOPASSWD: /usr/bin/make -C /srv/dns.debian.org/geo
 # remote power to babylon5 in the same rack:
 joerg          unger=(ALL)             /usr/bin/sispmctl -t [12], /usr/bin/sispmctl -g [12]
 # wbadm can update all buildd* users' keys on buildd.d.o
-%wbadm         cimarosa,grieg=(root)           /usr/local/bin/update-buildd-sshkeys
-wbadm          cimarosa,grieg=(postgres)       NOPASSWD: /usr/bin/pg_dumpall --cluster 8.4/wanna-build
+%wbadm         grieg=(root)            /usr/local/bin/update-buildd-sshkeys
+wbadm          grieg=(postgres)        NOPASSWD: /usr/bin/pg_dumpall --cluster 8.4/wanna-build
 # mirror push
 dak            FTPHOSTS,morricone=(archvsync)  NOPASSWD:/home/archvsync/runmirrors
 planet         senfl=(archvsync)       NOPASSWD: /home/archvsync/bin/runplanet ""
 # archvsync triggers snapshot
 archvsync      sibelius,stabile=(snapshot)     NOPASSWD: /srv/snapshot.debian.org/bin/update-trigger
 archvsync      sibelius,stabile=(snapshot)     NOPASSWD: /srv/2ndsnapshot/bin/update-trigger
+# allow the debbugs-mirror user on rietz to release the afs volume so changes make it to the read-only replicas
+debbugs-mirror rietz=(root)            NOPASSWD: /usr/bin/vos release -id srv.mirrors.bugs -localauth
 # dak stuff
 %debian-release        FTPHOSTS=(dak)          /usr/local/bin/dak transitions --import *
 %ftpteam       FTPHOSTS=(dak)          /usr/local/bin/dak transitions --import *
 # security
-%security      SECHOSTS=(dak)          NOPASSWD: /usr/local/bin/dak new-security-install -[AR] -- *
-%sec_public    SECHOSTS=(dak)          NOPASSWD: /usr/local/bin/dak new-security-install -[AR] -- *
+%security      SECHOSTS=(dak)          NOPASSWD: /usr/local/bin/dak new-security-install -[AR]
+%sec_public    SECHOSTS=(dak)          NOPASSWD: /usr/local/bin/dak new-security-install -[AR]
 %sec_public    SECHOSTS=(dak)          NOPASSWD: /home/dak/trigger_mirror
 dak            SECHOSTS=(archvsync)    NOPASSWD: /home/archvsync/signal_security
 # web stuff
 debwww         WEBHOSTS=(archvsync)    NOPASSWD: /home/archvsync/webmirrors/runmirrors
+%press         WEBHOSTS=(debwww)       /org/www.debian.org/update-part News
 # more list stuff
 %list          liszt=(root)            /usr/sbin/postfix reload
 %list          liszt=(root)            /usr/sbin/qshape, /usr/sbin/postsuper