# felhom-agent sudoers allowlist — the NARROW host-root surface (slice 5 Phase B, doc 03 §3/§7).
#
# Install as a drop-in: /etc/sudoers.d/felhom-agent (mode 0440, root:root), validated with
# `visudo -cf`. The agent runs as the non-root `felhom-agent` service user and shells out via
# `sudo -n` with FIXED argument vectors (no shell). The fine-grained validation is done IN
# the agent BEFORE exec (internal/storage/validate.go): UUIDs against a strict hex regex,
# mount paths confined+traversal-checked, SMART devices whitelisted to raw disks, LVM names
# charset-checked. These sudoers wildcards are the COARSE allowlist; the agent is the fine
# gate, so a wildcard can never be abused by a value the agent didn't already validate.
#
# Binary paths MUST match the agent config (privileged.systemctl/install/smartctl/lvs). Adjust
# for your distro (Debian/PVE shown). A missing/declined entry degrades the agent with a
# warning (SMART→UNKNOWN, mount→logged error), it does not crash.

Cmnd_Alias FELHOM_MOUNT = \
  /usr/bin/install -o root -g root -m 0644 -- /var/lib/felhom-agent/units/* /etc/systemd/system/*.mount, \
  /usr/bin/systemctl daemon-reload, \
  /usr/bin/systemctl enable --now -- *.mount, \
  /usr/bin/systemctl disable -- *.mount, \
  /usr/bin/systemctl stop -- *.mount

Cmnd_Alias FELHOM_DISK = \
  /usr/sbin/smartctl -a -j /dev/sd[a-z]*, \
  /usr/sbin/smartctl -a -j /dev/nvme[0-9]*n[0-9]*, \
  /usr/sbin/smartctl -a -j /dev/vd[a-z]*, \
  /usr/sbin/smartctl -a -j /dev/hd[a-z]*, \
  /usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- *

felhom-agent ALL=(root) NOPASSWD: FELHOM_MOUNT, FELHOM_DISK