# /etc/sudoers.d/sysagent
# Install with: sudo install -m 440 sudoers/sysagent /etc/sudoers.d/sysagent
# Validate with: sudo visudo -cf /etc/sudoers.d/sysagent
#
# Dedicated user "sysagent" may run a narrow set of commands without a password.
# Members of the "sysagent" group may invoke the agent via /usr/bin/sysagent.

Defaults:sysagent !requiretty

sysagent ALL=(root) NOPASSWD: /usr/bin/apt-get, /usr/bin/apt
sysagent ALL=(root) NOPASSWD: /usr/bin/env DEBIAN_FRONTEND=noninteractive /usr/bin/apt-get *
sysagent ALL=(root) NOPASSWD: /bin/systemctl, /usr/bin/systemctl
sysagent ALL=(root) NOPASSWD: /usr/bin/journalctl

# Allow members of the sysagent group to run the agent wrapper as the sysagent user
%sysagent ALL=(sysagent) NOPASSWD: /opt/sysadmin_agent/.venv/bin/sysagent
