# Installed as /etc/sudoers.d/hostit-relay (mode 0440).
#
# The SSH-relay frontend needs root for exactly two things, each one root-owned
# helper:
#  - hostit-control drives the reconcile (create/remove stub accounts + keys).
#  - a relay stub reaches the forwarder, which holds the root-only relay key and
#    ignores its arguments when choosing a target (the app is SUDO_UID), so a
#    stub can only ever relay as its own app.
# (The helpers run without a tty; modern sudo does not require one.)
hostit-control ALL=(root) NOPASSWD: /usr/lib/hostit/bin/hostit-relay-sync
%hostit-relay  ALL=(root) NOPASSWD: /usr/lib/hostit/bin/hostit-relay
