# The hub validates and reloads Nginx, and asks Certbot for one certificate per subdomain (§6).
#
# The Certbot rules pin every argument rather than allowing the binary.
#
# That is not tidiness. `sudo certbot ...` with free arguments is a root shell: --deploy-hook runs an
# arbitrary command as root once a certificate is issued, and this hub already holds a client certificate
# for every contract in the estate, so it is a target worth taking seriously. Pinning the argument list
# means an injected flag does not match any rule and sudo refuses it.
#
# The cost is a coupling: NginxConfigService.ProvisionCertificateAsync builds exactly this argument list,
# in this order. Change one and change the other, or provisioning starts failing with a sudo refusal that
# names neither file.
#
# Must be 0440 root:root or sudo ignores the whole file, and every reload then fails with a permission
# error that names neither sudo nor this package.

veiledcrossroads ALL=(root) NOPASSWD: /usr/sbin/nginx -t
veiledcrossroads ALL=(root) NOPASSWD: /usr/sbin/nginx -s reload
veiledcrossroads ALL=(root) NOPASSWD: /usr/bin/systemctl reload nginx

veiledcrossroads ALL=(root) NOPASSWD: /usr/bin/certbot certonly --webroot -w /srv/veiledcrossroads/acme -d [a-z0-9][a-z0-9-]*.* --non-interactive --agree-tos -m * --keep-until-expiring
veiledcrossroads ALL=(root) NOPASSWD: /usr/bin/certbot certonly --webroot -w /srv/veiledcrossroads/acme -d [a-z0-9][a-z0-9-]*.* --non-interactive --agree-tos -m * --keep-until-expiring --staging
