feat(sudo-io): stop recording bulk data (sudoers BULK_DATA !log_output fleet-wide), drop >64 MiB streams from archives, prune existing bulk recordings

playbooks/bootstrap-infra-ops-user.yaml

@@ -77,6 +77,11 @@ steps:
     shell: |
       f=/etc/sudoers.d/{{ ops_user }}
       printf 'Defaults:%s log_output\n%s ALL=(ALL) NOPASSWD:ALL\n' '{{ ops_user }}' '{{ ops_user }}' > "$f.tmp"
+      # Bulk data movers keep their audit line but their bytes are not recorded (Prime 2026-10-04; see
+      # playbooks/sudoers-infra-ops-bulk-no-log-output.yaml, which back-filled every existing host)
+      printf '%s\n' '# Bulk data movers: keep the audit line, do not record the bytes (eshpfi playbooks/sudoers-infra-ops-bulk-no-log-output.yaml)' \
+        'Cmnd_Alias BULK_DATA = /usr/bin/rsync, /usr/bin/tar, /usr/bin/cat, /usr/bin/dd, /usr/bin/zstd, /usr/bin/zcat, /usr/bin/gzip, /usr/bin/pv, /usr/bin/docker save *, /usr/bin/docker export *, /usr/bin/docker cp *' \
+        'Defaults!BULK_DATA !log_output' >> "$f.tmp"
       chmod 440 "$f.tmp"
       if visudo -cf "$f.tmp"; then mv "$f.tmp" "$f"; else rm -f "$f.tmp"; echo "VISUDO VALIDATION FAILED"; exit 1; fi
 

playbooks/sudoers-infra-ops-bulk-no-log-output.yaml

@@ -0,0 +1,49 @@
+# Stop sudo from recording the DATA of bulk-copy commands run by infra-ops (Prime 2026-10-04: "we need to stop that …
+# we don't need to durably back up weights and rsyncs forever").
+#   scripts/elway infra-ops@<host> --playbook playbooks/sudoers-infra-ops-bulk-no-log-output.yaml
+#
+# Why: `Defaults:infra-ops log_output` records every byte a sudo'd command prints. That turned a `sudo tar` of a
+# model directory into a 14.45 G session on fv-ml1 and a nightly ~380 M `sudo rsync --server --sender` of the Home
+# Assistant volume into 30+ sessions on esh-docker-vm. With this, those commands are still logged (sudo's syslog line
+# says who ran what, when, as whom); only their output stream is no longer recorded. Everything else stays recorded.
+# The list: rsync/tar/cat/dd/compressors/pv move data; `docker save|export|cp` dump images and container files.
+# Only touches hosts whose infra-ops sudoers already has log_output; the new file is visudo-checked before it lands,
+# and the whole sudoers tree is checked after, so a bad edit can never lock infra-ops out.
+steps:
+  - name: add the BULK_DATA exemption to /etc/sudoers.d/infra-ops (visudo-checked before install)
+    sudo: true
+    shell: |
+      set -e
+      cp /etc/sudoers.d/infra-ops /etc/sudoers.d/.infra-ops.new
+      cat >> /etc/sudoers.d/.infra-ops.new <<'EOF'
+      # Bulk data movers: keep the audit line, do not record the bytes (eshpfi playbooks/sudoers-infra-ops-bulk-no-log-output.yaml)
+      Cmnd_Alias BULK_DATA = /usr/bin/rsync, /usr/bin/tar, /usr/bin/cat, /usr/bin/dd, /usr/bin/zstd, /usr/bin/zcat, /usr/bin/gzip, /usr/bin/pv, /usr/bin/docker save *, /usr/bin/docker export *, /usr/bin/docker cp *
+      Defaults!BULK_DATA !log_output
+      EOF
+      chmod 440 /etc/sudoers.d/.infra-ops.new
+      if visudo -cf /etc/sudoers.d/.infra-ops.new >/dev/null; then
+        mv /etc/sudoers.d/.infra-ops.new /etc/sudoers.d/infra-ops
+      else
+        rm -f /etc/sudoers.d/.infra-ops.new; echo "VISUDO REJECTED THE NEW FILE"; exit 1
+      fi
+      visudo -c >/dev/null
+      cat /etc/sudoers.d/infra-ops
+    when: "grep -q log_output /etc/sudoers.d/infra-ops && ! grep -q BULK_DATA /etc/sudoers.d/infra-ops"
+
+verify:
+  - name: whole sudoers tree parses, and infra-ops still has NOPASSWD sudo
+    sudo: true
+    shell: visudo -c >/dev/null && sudo -n -u infra-ops sudo -n true
+    changed_when: "false"
+  - name: positive + negative control — `sudo id` still records a session, `sudo tar --version` no longer does
+    sudo: true
+    shell: |
+      set -e
+      [ -d /var/log/sudo-io ] || { echo "no sudo-io on this host"; exit 0; }
+      n() { find /var/log/sudo-io -mindepth 3 -maxdepth 3 -type d | wc -l; }
+      a=$(n); sudo -n -u infra-ops sudo -n /usr/bin/tar --version >/dev/null; b=$(n)
+      sudo -n -u infra-ops sudo -n id >/dev/null; c=$(n)
+      echo "sessions: start $a, after tar $b, after id $c"
+      test "$b" -eq "$a"
+      test "$c" -gt "$b"
+    changed_when: "false"