# MirrorDash application — scoped passwordless sudo
pi ALL=(ALL) NOPASSWD: /usr/bin/systemctl enable ssh
pi ALL=(ALL) NOPASSWD: /usr/bin/systemctl disable ssh
pi ALL=(ALL) NOPASSWD: /usr/bin/systemctl start ssh
pi ALL=(ALL) NOPASSWD: /usr/bin/systemctl stop ssh
pi ALL=(ALL) NOPASSWD: /usr/bin/timedatectl set-timezone *
pi ALL=(ALL) NOPASSWD: /usr/bin/raspi-config nonint do_wifi_country *
pi ALL=(ALL) NOPASSWD: /usr/sbin/chpasswd
pi ALL=(ALL) NOPASSWD: /usr/bin/nmcli *
pi ALL=(ALL) NOPASSWD: /usr/bin/tee /sys/class/backlight/*/brightness
pi ALL=(ALL) NOPASSWD: /usr/bin/ddcutil --noverify setvcp 10 *
pi ALL=(ALL) NOPASSWD: /usr/sbin/reboot
pi ALL=(ALL) NOPASSWD: /usr/sbin/poweroff
pi ALL=(ALL) NOPASSWD: /usr/local/bin/mirrordash-gpio-overlays
pi ALL=(ALL) NOPASSWD: /usr/local/bin/mirrordash-factory-reset --yes
# nmcli gets the Wi-Fi password as an argument: keep it out of the journal (and the admin Logs tab).
# ponytail: it still shows in `ps` while nmcli runs (local only); passwd-file would close that.
Defaults!/usr/bin/nmcli !log_allowed
