X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Fsudo%2Ffiles%2Fcommon%2Fsudoers;h=f2ab9d0c0cd52f5be124f74fbc6bc17a9b2ab598;hb=d2fb6ec43156bdc5bf259fd5af0ebd2e0211b574;hp=dac41788c58cd03049bb83910dc5a39c304759c8;hpb=6c5c6836db020d25288c0e3318befc13340ebfd3;p=mirror%2Fdsa-puppet.git

diff --git a/modules/sudo/files/common/sudoers b/modules/sudo/files/common/sudoers
index dac41788c..f2ab9d0c0 100644
--- a/modules/sudo/files/common/sudoers
+++ b/modules/sudo/files/common/sudoers
@@ -21,16 +21,14 @@ Defaults	env_reset
 Defaults	passprompt="[sudo] password for %u on %h: "
 
 # Host alias specification
-Host_Alias	QAHOSTS		= master, merkel
+Host_Alias	QAHOSTS		= master, merkel, quantz
 Host_Alias	WEBHOSTS	= klecker, wolkenstein
-Host_Alias	SECHOSTS	= klecker, chopin
-Host_Alias	FTPHOSTS	= ries, franck
+Host_Alias	SECHOSTS	= chopin
+Host_Alias	FTPHOSTS	= franck, ries
 Host_Alias	ZIVITHOSTS	= zelenka, zandonai
 Host_Alias	AACRAIDHOSTS	= bellini, cimarosa, morricone, paganini, respighi, vivaldi, beethoven, pettersson
 Host_Alias	MEGARAIDHOSTS	= grieg, rautavaara, sibelius
 Host_Alias	MPTRAIDHOSTS	= master, fasch, holter, barber, biber, cilea, vitry, krenek, scelsi, orff, field
-# User alias specification
-User_Alias	QACORE		= aba, djpig, geissert, hertzog, jeroen, joerg, lucas, luk, myon, tbm, weasel, zack
 
 # Cmnd alias specification
 
@@ -99,7 +97,7 @@ nagios		beethoven=(debbackup)	NOPASSWD: /usr/lib/nagios/plugins/dsa-check-backup
 %volatile	ALL=(volatile)	ALL
 %wbadm		ALL=(wbadm)	ALL
 %wikiadm	ALL=(wiki)	ALL
-QACORE		QAHOSTS=(qa)	ALL
+%qa-core	QAHOSTS=(qa)	ALL
 
 # some groups are in apachectrl on "their" hosts so they can reload apache and update their vhost
 %apachectrl	ALL=(root)	/usr/sbin/apache2-vhost-update
@@ -114,19 +112,21 @@ piupartss	piatti=(ALL)		NOPASSWD: ALL
 # trigger of mirror run for packages
 pkg_user	powell=(archvsync)	NOPASSWD: /home/archvsync/bin/pushpdo
 # on draghi, the domains git thing will run bind9 reload afterwards
-%dnsadm		draghi=(root)		NOPASSWD: /etc/init.d/bind9 reload
-%dnsadm		draghi=(geodnssync)	NOPASSWD: /usr/bin/make -C /srv/dns.debian.org/geo
+%dnsadm		draghi,orff=(root)		NOPASSWD: /etc/init.d/bind9 reload
+%dnsadm		draghi,orff=(geodnssync)	NOPASSWD: /usr/bin/make -C /srv/dns.debian.org/geo
 # remote power to babylon5 in the same rack:
 joerg		unger=(ALL)		/usr/bin/sispmctl -t [12], /usr/bin/sispmctl -g [12]
 # wbadm can update all buildd* users' keys on buildd.d.o
 %wbadm		cimarosa,grieg=(root)		/usr/local/bin/update-buildd-sshkeys
 wbadm		cimarosa,grieg=(postgres)	NOPASSWD: /usr/bin/pg_dumpall --cluster 8.4/wanna-build
 # mirror push
-dak		FTPHOSTS=(archvsync)	NOPASSWD:/home/archvsync/runmirrors
+dak		FTPHOSTS,morricone=(archvsync)	NOPASSWD:/home/archvsync/runmirrors
 planet		senfl=(archvsync)	NOPASSWD: /home/archvsync/bin/runplanet ""
 # archvsync triggers snapshot
 archvsync	sibelius,stabile=(snapshot)	NOPASSWD: /srv/snapshot.debian.org/bin/update-trigger
 archvsync	sibelius,stabile=(snapshot)	NOPASSWD: /srv/2ndsnapshot/bin/update-trigger
+# allow the debbugs-mirror user on rietz to release the afs volume so changes make it to the read-only replicas
+debbugs-mirror	rietz=(root)		NOPASSWD: /usr/bin/vos release -id srv.mirrors.bugs -localauth
 # dak stuff
 %debian-release	FTPHOSTS=(dak)		/usr/local/bin/dak transitions --import *
 %ftpteam	FTPHOSTS=(dak)		/usr/local/bin/dak transitions --import *