Fix IP validation in DDNS and document journalctl sudo rule

Co-authored-by: naturallaw777 <99053422+naturallaw777@users.noreply.github.com>
2026-08-11 10:45:50 +00:00
parent f2ad9c1f17
commit 9b77b04741
2 changed files with 14 additions and 2 deletions
@@ -61,6 +61,14 @@
        { command = "/run/current-system/sw/bin/systemctl status bitcoind.service";     options = [ "NOPASSWD" ]; }
        { command = "/run/current-system/sw/bin/systemctl status lnd.service";          options = [ "NOPASSWD" ]; }
        { command = "/run/current-system/sw/bin/journalctl *";                          options = [ "NOPASSWD" ]; }
+        # NOTE: journalctl with arbitrary flags is retained to allow support
+        # staff to filter logs by unit, time-range, and priority during
+        # diagnostics.  The --file / --directory flags could theoretically
+        # allow reading arbitrary log files, but the support user already has
+        # read access to /var/log as a system user.  Wallet and secret files
+        # are not stored in journald format, so exposure is limited to
+        # operational logs.  Consider restricting to specific units if a
+        # narrower support workflow is defined in a future release.
      ];
    }
  ];