# House style: the UserParameter calls sudo, and the rule below allows the
# SCRIPT -- never the tool it invokes. One line per script that needs root.
#
# s6_services.sh is deliberately absent: /run/s6-rc/servicedirs is readable for
# the zabbix user (verified on srv-crb2-1, 2026-09-22), so that check runs
# unprivileged. Add a line only after measuring, not on suspicion.
zabbix ALL=(root) NOPASSWD: /usr/lib/aep-zabbix-checks/zfs_stats.sh
zabbix ALL=(root) NOPASSWD: /usr/lib/aep-zabbix-checks/k8s_cert_expiry.sh
zabbix ALL=(root) NOPASSWD: /usr/lib/aep-zabbix-checks/fw_rules_drift.sh
