# Scoped passwordless sudo for the deploy permission-restore step.
#
# `just deploy-permissions` (and thereby `just deploy-code`) resyncs the app
# tree as the deploy SSH user, then runs `fix-permissions.sh` as root to
# restore www-data:xamxam ownership. Using an interactive remote pty for that
# sudo is fragile: `ssh -t` silently drops the pseudo-terminal when the local
# process stdin is not a TTY, so sudo's password prompt prints but cannot
# receive keystrokes. Because the script is fixed-path, takes no arguments and
# only touches /var/www/xamxam, it is safe to whitelist with NOPASSWD.
#
# Install via `just deploy-sudoers` (must be run interactively once as a
# password-lessed sudoer, or with root).
theophile ALL=(root) NOPASSWD: /bin/bash /tmp/fix-permissions.sh