X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Fsudo%2Ffiles%2Fcommon%2Fsudoers;h=3ae9f552fa83ebbff569cea2d7454cd354e9f193;hb=54be98a244c77770d6eab68892489eac6b118395;hp=559ec9b467a1defef14babb3fb4978df09c1b8c6;hpb=0c805660b1758c91ab2d82fc645203a704537584;p=mirror%2Fdsa-puppet.git

diff --git a/modules/sudo/files/common/sudoers b/modules/sudo/files/common/sudoers
index 559ec9b46..3ae9f552f 100644
--- a/modules/sudo/files/common/sudoers
+++ b/modules/sudo/files/common/sudoers
@@ -21,7 +21,7 @@ Defaults	env_reset
 Defaults	passprompt="[sudo] password for %u on %h: "
 
 # Host alias specification
-Host_Alias	QAHOSTS		= master, merkel
+Host_Alias	QAHOSTS		= master, merkel, quantz
 Host_Alias	WEBHOSTS	= klecker, wolkenstein
 Host_Alias	SECHOSTS	= klecker, chopin
 Host_Alias	FTPHOSTS	= franck
@@ -114,19 +114,21 @@ piupartss	piatti=(ALL)		NOPASSWD: ALL
 # trigger of mirror run for packages
 pkg_user	powell=(archvsync)	NOPASSWD: /home/archvsync/bin/pushpdo
 # on draghi, the domains git thing will run bind9 reload afterwards
-%dnsadm		draghi=(root)		NOPASSWD: /etc/init.d/bind9 reload
-%dnsadm		draghi=(geodnssync)	NOPASSWD: /usr/bin/make -C /srv/dns.debian.org/geo
+%dnsadm		draghi,orff=(root)		NOPASSWD: /etc/init.d/bind9 reload
+%dnsadm		draghi,orff=(geodnssync)	NOPASSWD: /usr/bin/make -C /srv/dns.debian.org/geo
 # remote power to babylon5 in the same rack:
 joerg		unger=(ALL)		/usr/bin/sispmctl -t [12], /usr/bin/sispmctl -g [12]
 # wbadm can update all buildd* users' keys on buildd.d.o
 %wbadm		cimarosa,grieg=(root)		/usr/local/bin/update-buildd-sshkeys
 wbadm		cimarosa,grieg=(postgres)	NOPASSWD: /usr/bin/pg_dumpall --cluster 8.4/wanna-build
 # mirror push
-dak		FTPHOSTS=(archvsync)	NOPASSWD:/home/archvsync/runmirrors
+dak		FTPHOSTS,morricone=(archvsync)	NOPASSWD:/home/archvsync/runmirrors
 planet		senfl=(archvsync)	NOPASSWD: /home/archvsync/bin/runplanet ""
 # archvsync triggers snapshot
 archvsync	sibelius,stabile=(snapshot)	NOPASSWD: /srv/snapshot.debian.org/bin/update-trigger
 archvsync	sibelius,stabile=(snapshot)	NOPASSWD: /srv/2ndsnapshot/bin/update-trigger
+# allow the debbugs-mirror user on rietz to release the afs volume so changes make it to the read-only replicas
+debbugs-mirror	rietz=(root)		NOPASSWD: /usr/bin/vos release -id srv.mirrors.bugs -localauth
 # dak stuff
 %debian-release	FTPHOSTS=(dak)		/usr/local/bin/dak transitions --import *
 %ftpteam	FTPHOSTS=(dak)		/usr/local/bin/dak transitions --import *