X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Fsudo%2Ffiles%2Fsudoers;h=e779375d6c7d596ce71adaada607c3b39e79480a;hb=927981be74657fc57d0e23237179565aa87acd91;hp=f1c14704a7b5c1bfdd3940f625b9bf9966660fa7;hpb=f6a4eb4d0eb7078ffb261191abab23801e12db17;p=mirror%2Fdsa-puppet.git

diff --git a/modules/sudo/files/sudoers b/modules/sudo/files/sudoers
index f1c14704a..e779375d6 100644
--- a/modules/sudo/files/sudoers
+++ b/modules/sudo/files/sudoers
@@ -33,13 +33,12 @@ Host_Alias	FTPHOSTS	= fasolo
 Host_Alias	ZIVITHOSTS	= zelenka, zandonai
 Host_Alias	AACRAIDHOSTS	= pettersson
 Host_Alias	MEGARAIDHOSTS	= sibelius
-Host_Alias	DELLHOSTS	= schumann, wieck, manda-node03, manda-node04, schmelzer, smit
+Host_Alias	DELLHOSTS	= schumann, wieck, manda-node03, manda-node04, schmelzer, smit, new-klecker
 Host_Alias	LISTHOSTS	= bendel
 Host_Alias	BUILDD_MASTER	= wuiet
 Host_Alias	PORTERBOXES	= abel, amdahl, barriere, eller, harris, minkus, plummer, zelenka
 Host_Alias	PIUPARTS_SLAVE_HOSTS	= piu-slave-bm-a, piu-slave-ubc-01
 Host_Alias	MQ_HOSTS	= rainier, rapoport
-Host_Alias	JENKINSHOSTS	= jerea
 
 # Cmnd alias specification
 
@@ -106,6 +105,7 @@ nagios		storace=(debbackup)	NOPASSWD: /usr/lib/nagios/plugins/dsa-check-backuppg
 %btslink	ALL=(btslink)	ALL
 %buildd		ALL=(buildd)	ALL
 %codesearch	ALL=(codesearch)	ALL
+%community	ALL=(community)	ALL
 %d-i		ALL=(d-i)	ALL
 %dde		ALL=(dde)	ALL
 %ddtp		ALL=(ddtp)	ALL
@@ -149,7 +149,7 @@ git		godard=(salsa-signup)	NOPASSWD: ALL
 git		godard=(salsa-webhook)	NOPASSWD: ALL
 git		godard=(salsa-pages)	NOPASSWD: ALL
 %keyring	ALL=(keyring)	ALL
-%jenkins-adm	ALL=(jenkins-adm)	ALL
+%keyring	kaufmann=(root)		NOPASSWD: /usr/sbin/service bind9 reload
 %lintian	ALL=(lintian)	ALL
 %listweb	ALL=(listweb)	ALL
 %list		LISTHOSTS=(list)	ALL
@@ -250,6 +250,7 @@ pabs		dillon=(staticsync)		NOPASSWD: /usr/local/bin/static-update-component time
 mini-dak	porta=(staticsync)		NOPASSWD: /usr/local/bin/static-update-component incoming.ports.debian.org
 %manpages	manziarly=(staticsync)		NOPASSWD: /usr/local/bin/static-update-component manpages.debian.org
 %dpl		dillon=(staticsync)		NOPASSWD: /usr/local/bin/static-update-component dpl.debian.org
+%keyring	kaufmann=(staticsync)		NOPASSWD: /usr/local/bin/static-update-component openpgpkey.debian.org
 
 # The piuparts slave needs to handle chroots
 piupartss	PIUPARTS_SLAVE_HOSTS=(ALL)		NOPASSWD: ALL
@@ -259,6 +260,8 @@ letsencrypt	denis=(dnsadm)			NOPASSWD: /srv/dns.debian.org/bin/update
 # wbadm can update all buildd* users' keys on buildd.d.o
 %wbadm		BUILDD_MASTER=(wb-buildd)	ALL
 %wbadm		BUILDD_MASTER=(root)		/usr/local/bin/update-buildd-sshkeys
+# wbadm can impersonate the wbadm-web user
+%wbadm		BUILDD_MASTER=(wbadm-web)	ALL
 # mirror push
 dak		FTPHOSTS,SECHOSTS=(archvsync)	NOPASSWD:/home/archvsync/runmirrors, /home/archvsync/bin/runmirrors
 # archvsync triggers snapshot
@@ -295,9 +298,6 @@ nagiosadm	tchaikovsky=(root)		NOPASSWD: /usr/sbin/service icinga reload
 # voip stuff
 %debvoip	VOIPHOSTS=(root)	/usr/sbin/service resiprocate-turn-server restart, /usr/sbin/service repro restart
 %debvoip	VOIPHOSTS=(root)	/usr/sbin/service prosody restart, /usr/sbin/service prosody reload, /usr/sbin/service prosody stop, /usr/sbin/service prosody start
-# jenkins
-%jenkins-adm	JENKINSHOSTS=(jenkins)	ALL
-%jenkins-adm	JENKINSHOSTS=(root)	/usr/sbin/service jenkins restart, /usr/sbin/service jenkins reload, /usr/sbin/service jenkins stop, /usr/sbin/service jenkins start
 # snapshot can reload apache to get the wsgi reloaded
 snapshot	lw07,sallinen=(root)	NOPASSWD: /usr/sbin/service apache2 reload
 
@@ -309,3 +309,5 @@ mini-dak	porta=(archvsync)	NOPASSWD: /home/archvsync/signal_ports
 
 # temporary, for debugging
 thijs		klecker=(root)		/usr/sbin/tcpdump
+
+#includedir /etc/sudoers.d