y-cluster-sudoers

#!/usr/bin/env bash
[ -z "$DEBUG" ] || set -x
set -eo pipefail

YSTACK_HOME="$(cd "$(dirname "$0")/.." && pwd)"
YBIN="$YSTACK_HOME/bin"

SUDOERS_FILE="/etc/sudoers.d/ystack-cluster"

usage() {
  cat >&2 <<EOF
Usage: y-cluster-sudoers [--write] [username ...]

Maintains passwordless sudo rules for automatic development cluster setup.

Without --write: prints the sudoers rules to stdout.
With    --write: writes the rules to $SUDOERS_FILE (requires sudo).

Usernames: one or more users to grant NOPASSWD rules to.
           Defaults to the current user (via SUDO_USER or USER).

If the script is in an encrypted homedir, pipe from a sudo -u invocation:
  sudo -u USER $0 USERNAME | sudo tee $SUDOERS_FILE
EOF
  exit 0
}

[ "$1" = "-h" ] || [ "$1" = "--help" ] && usage

MODE=show
case "$1" in
  --write) MODE=write; shift ;;
  --show)  shift ;;
esac

USERS=("$@")
for u in "${USERS[@]}"; do
  case "$u" in -*) echo "ERROR: invalid username '$u' (did you mean to put --write first?)" >&2; exit 1 ;; esac
done
[ ${#USERS[@]} -eq 0 ] && USERS=("${SUDO_USER:-$USER}")

rules() {
  echo "# ystack development cluster automation"
  echo "# Generated by y-cluster-sudoers for: ${USERS[*]}"
  echo "# YSTACK_HOME=$YSTACK_HOME"
  for u in "${USERS[@]}"; do
    cat <<EOF

# y-localhost: loopback alias management ($u)
$u ALL=(root) NOPASSWD: $YBIN/y-localhost *

# y-k8s-ingress-hosts: /etc/hosts management ($u)
$u ALL=(root) NOPASSWD: $YBIN/y-k8s-ingress-hosts-v*-bin *
EOF
  done
}

sudo_rs_check() {
  # sudo-rs (default on Ubuntu 25.10+) has a bug where NOPASSWD rules from
  # /etc/sudoers.d/ are listed by "sudo -l" but not applied during execution.
  # The original sudo (sudo.ws) handles these rules correctly.
  if sudo --version 2>&1 | grep -q "sudo-rs"; then
    echo "" >&2
    echo "WARNING: sudo-rs detected. NOPASSWD rules may not work." >&2
    echo "sudo-rs has a known bug where rules in /etc/sudoers.d/ are parsed" >&2
    echo "but not applied. Switch to the original sudo to fix:" >&2
    echo "  sudo update-alternatives --set sudo /usr/bin/sudo.ws" >&2
  fi
}

if [ "$MODE" = "write" ]; then
  if [ $(id -u) -ne 0 ]; then
    if sudo -n true 2>/dev/null; then
      echo "Writing sudoers rules requires root. Re-running with sudo ..."
      exec sudo "$0" --write "${USERS[@]}"
    else
      echo "Can't sudo as $USER. A user with sudo rights can run for example:" >&2
      echo "  sudo -u $USER $0 ${USERS[*]} | sudo tee $SUDOERS_FILE" >&2
      exit 1
    fi
  fi
  TMPFILE=$(mktemp)
  rules > "$TMPFILE"
  if visudo -cf "$TMPFILE"; then
    cp "$TMPFILE" "$SUDOERS_FILE"
    chmod 0440 "$SUDOERS_FILE"
    rm "$TMPFILE"
    echo "Wrote $SUDOERS_FILE"
    sudo_rs_check
  else
    rm "$TMPFILE"
    echo "ERROR: Generated sudoers rules failed validation" >&2
    exit 1
  fi
else
  rules
  sudo_rs_check
fi