# SPDX-License-Identifier: LicenseRef-CMSD-1.0
# Phase 7 follow-up (#498) — the crowdsec module health + status checks
# run under the aggregator user (`secubox`) and need read-only access
# to cscli + the nft tables the firewall bouncer manages.
#
# All entries are exact-match (no wildcards, no shell, no flag escapes)
# so the residual capability is bounded to read-only listings.
#
# Coverage :
#   - /api/v1/crowdsec/health        : bouncers + nft tables
#   - /api/v1/crowdsec/status        : lapi/capi + decisions + alerts
#   - /api/v1/crowdsec/console/status : console enrollment state
#
# Operator UI symptom if entries are missing : every "CAPI Not enrolled"
# and "LAPI not reachable" gauge on the crowdsec dashboard, even when
# `cscli capi status` works from a root shell. Phase 7.E.2 (2026-06-08)
# regression after the console enrollment landed live — the dashboard
# never picked up the enrolled state because `sudo cscli capi status`
# from the FastAPI failed silently.

secubox ALL=(root) NOPASSWD: /usr/bin/cscli bouncers list -o json
secubox ALL=(root) NOPASSWD: /usr/bin/cscli lapi status
secubox ALL=(root) NOPASSWD: /usr/bin/cscli capi status
secubox ALL=(root) NOPASSWD: /usr/bin/cscli decisions list -o json
secubox ALL=(root) NOPASSWD: /usr/bin/cscli alerts list -o json
secubox ALL=(root) NOPASSWD: /usr/bin/cscli console status
secubox ALL=(root) NOPASSWD: /usr/sbin/nft list tables
