# SecuBox YaCy — allow the secubox user to control the LXC.
# secubox-yacy.service (host FastAPI) runs as User=secubox. Read-only
# component/status introspection no longer needs this (it probes the daemon
# port directly), but `yacyctl reload` still uses lxc-attach to restart the
# in-container YaCy daemon, which needs root. Sibling: secubox-streamlit,
# secubox-lxc.

# Password sync: secubox-users (User=secubox) pushes the master 'admin' user's
# password into YaCy's single admin account. The password is read from STDIN
# (never argv), so it cannot leak via ps/sudo logs. Exact-command match — no
# wildcard args — so only the bare subcommand is permitted.
secubox ALL=(root) NOPASSWD: /usr/sbin/yacyctl set-admin-password
# Les commandes lxc passent par /usr/sbin/secubox-lxcctl (secubox-core, #1785).
