# felhom-op operator sudoers (TASK H1) — install as /etc/sudoers.d/felhom-op (0440 root:root).
#
# The DEFAULT operator identity (login via felhom-sshd only; key in /etc/felhom-sshd/authorized_keys/
# felhom-op, outside ~/.ssh, so the customer's sshd never honours it [SF-3]). felhom-op is a normal
# login user with NO ambient privilege — it escalates ONLY through these explicit repair verbs, so a
# leaked operator key's blast radius is this verb set, not the box (locked decision §6). Deep repairs
# that genuinely need root (pct, deeper systemctl) remain available via `root` as a tunnel-gated
# break-glass account (PermitRootLogin prohibit-password on felhom-sshd), but the day-to-day identity
# is felhom-op.
Cmnd_Alias FELHOM_OP_REPAIR = \
  /usr/bin/mkdir -p /run/sshd, \
  /usr/bin/systemctl reset-failed wg-quick@wg-felhom, \
  /usr/bin/systemctl restart wg-quick@wg-felhom, \
  /usr/bin/systemctl start felhom-agent, \
  /usr/bin/systemctl restart felhom-agent, \
  /usr/bin/systemctl reset-failed felhom-sshd, \
  /usr/bin/systemctl restart felhom-sshd, \
  /usr/sbin/pct list, \
  /usr/sbin/pct start [0-9]*, \
  /usr/sbin/pct stop [0-9]*, \
  /usr/sbin/pct unlock [0-9]*

felhom-op ALL=(root) NOPASSWD: FELHOM_OP_REPAIR