# Install with: sudo visudo -cf backend/deploy/audit-deploy-sudoers && \
#               sudo cp backend/deploy/audit-deploy-sudoers /etc/sudoers.d/audit-deploy
#
# Grants the unprivileged `auditapi` user exactly two commands, nothing else:
# restarting the audit-endpoint unit (from deploy.sh) and its own webhook
# unit (for the rare manual restart noted in deploy.sh). No shell, no wildcard
# arguments, no other systemctl verb - "restart" only, these two unit names
# only.
auditapi ALL=(root) NOPASSWD: /usr/bin/systemctl restart audit-endpoint
auditapi ALL=(root) NOPASSWD: /usr/bin/systemctl restart audit-webhook