#!/bin/bash
# Grant the IPA 'admins' group passwordless sudo on this Raspberry Pi.
#
# Writes /etc/sudoers.d/ipa-admins with NOPASSWD: ALL for the admins group.
# Idempotent — safe to re-run.
#
# Run as root (or via the local 'raspi' user's NOPASSWD sudo) after
# ipa-client-install has been completed and SSSD is active.
#
# Usage: sudo ./setup-ipa-sudo.sh
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=lib/common.sh
source "${SCRIPT_DIR}/lib/common.sh"
require_root

if [ ! -f /etc/ipa/default.conf ]; then
    echo "ERROR: /etc/ipa/default.conf not found -- is this host enrolled in FreeIPA?" >&2
    exit 1
fi

write_if_changed /etc/sudoers.d/ipa-admins '%admins ALL=(ALL) NOPASSWD:ALL'
chmod 0440 /etc/sudoers.d/ipa-admins

visudo -c >/dev/null
echo "Sudoers file valid. IPA admins group has NOPASSWD sudo on this host."