# Managed by the transcoder-node .deb — the node agent controls the per-channel
# transcoder-ffmpeg@ worker units. Scoped to the systemctl BINARY (sudoers can't
# safely constrain args). The only copy of this grant. Validated by the .deb
# postinst (visudo -cf).
esto  ALL=(root) NOPASSWD: /usr/bin/systemctl
# Hardware-fault report (registry v3.40): SMART + BMC reads. The wrapper owns the
# argument check (fixed read-only verbs, validated disk name) — never grant
# smartctl/ipmitool directly, both have write verbs.
esto  ALL=(root) NOPASSWD: /usr/lib/transcoder-node/hw-read
