# Stop sudo from recording the DATA of bulk-copy commands run by infra-ops (Prime 2026-10-04: "we need to stop that …
# we don't need to durably back up weights and rsyncs forever").
#   scripts/elway infra-ops@<host> --playbook playbooks/sudoers-infra-ops-bulk-no-log-output.yaml
#
# Why: `Defaults:infra-ops log_output` records every byte a sudo'd command prints. That turned a `sudo tar` of a
# model directory into a 14.45 G session on fv-ml1 and a nightly ~380 M `sudo rsync --server --sender` of the Home
# Assistant volume into 30+ sessions on esh-docker-vm. With this, those commands are still logged (sudo's syslog line
# says who ran what, when, as whom); only their output stream is no longer recorded. Everything else stays recorded.
# The list: rsync/tar/cat/dd/compressors/pv move data; `docker save|export|cp` dump images and container files.
# Only touches hosts whose infra-ops sudoers already has log_output; the new file is visudo-checked before it lands,
# and the whole sudoers tree is checked after, so a bad edit can never lock infra-ops out.
steps:
  - name: add the BULK_DATA exemption to /etc/sudoers.d/infra-ops (visudo-checked before install)
    sudo: true
    shell: |
      set -e
      cp /etc/sudoers.d/infra-ops /etc/sudoers.d/.infra-ops.new
      cat >> /etc/sudoers.d/.infra-ops.new <<'EOF'
      # Bulk data movers: keep the audit line, do not record the bytes (eshpfi playbooks/sudoers-infra-ops-bulk-no-log-output.yaml)
      Cmnd_Alias BULK_DATA = /usr/bin/rsync, /usr/bin/tar, /usr/bin/cat, /usr/bin/dd, /usr/bin/zstd, /usr/bin/zcat, /usr/bin/gzip, /usr/bin/pv, /usr/bin/docker save *, /usr/bin/docker export *, /usr/bin/docker cp *
      Defaults!BULK_DATA !log_output
      EOF
      chmod 440 /etc/sudoers.d/.infra-ops.new
      if visudo -cf /etc/sudoers.d/.infra-ops.new >/dev/null; then
        mv /etc/sudoers.d/.infra-ops.new /etc/sudoers.d/infra-ops
      else
        rm -f /etc/sudoers.d/.infra-ops.new; echo "VISUDO REJECTED THE NEW FILE"; exit 1
      fi
      visudo -c >/dev/null
      cat /etc/sudoers.d/infra-ops
    when: "grep -q log_output /etc/sudoers.d/infra-ops && ! grep -q BULK_DATA /etc/sudoers.d/infra-ops"

verify:
  - name: whole sudoers tree parses, and infra-ops still has NOPASSWD sudo
    sudo: true
    shell: visudo -c >/dev/null && sudo -n -u infra-ops sudo -n true
    changed_when: "false"
  - name: positive + negative control — `sudo id` still records a session, `sudo tar --version` no longer does
    sudo: true
    shell: |
      set -e
      [ -d /var/log/sudo-io ] || { echo "no sudo-io on this host"; exit 0; }
      n() { find /var/log/sudo-io -mindepth 3 -maxdepth 3 -type d | wc -l; }
      a=$(n); sudo -n -u infra-ops sudo -n /usr/bin/tar --version >/dev/null; b=$(n)
      sudo -n -u infra-ops sudo -n id >/dev/null; c=$(n)
      echo "sessions: start $a, after tar $b, after id $c"
      test "$b" -eq "$a"
      test "$c" -gt "$b"
    changed_when: "false"