+# security
+%security SECHOSTS=(dak) NOPASSWD: /usr/local/bin/dak new-security-install -[AR] -- *
+%sec_public SECHOSTS=(dak) NOPASSWD: /usr/local/bin/dak new-security-install -[AR] -- *
+%sec_data SECHOSTS=(archvsync) NOPASSWD: /home/archvsync/security/signal ""
+dak SECHOSTS=(archvsync) NOPASSWD: /home/archvsync/signal_security
+# web stuff
+debwww WEBHOSTS=(archvsync) NOPASSWD: /home/archvsync/webmirrors/runmirrors
+# more list stuff
+%list liszt=(root) /usr/sbin/postfix reload
+%list liszt=(root) /usr/sbin/qshape, /usr/sbin/postsuper
+%list liszt=(root) /etc/init.d/spamassassin, /etc/init.d/amavis
+%list liszt=(amavis) NOPASSWD: /usr/bin/sa-learn
+%list liszt=(amavis) ALL
+# geodns may reload bind
+geodnssync geo1,geo2,geo3=(root) NOPASSWD: /etc/init.d/bind9 reload
+geodnssync geo1,geo2,geo3=(root) NOPASSWD: /usr/sbin/rndc reconfig