From a194017abbe89abbcf322231430aa95272a35a42 Mon Sep 17 00:00:00 2001
From: "AMC Coding Agent[bot]"
 <2922326+amc-coding-agent[bot]@users.noreply.github.com>
Date: Tue, 14 Apr 2026 02:57:48 +0000
Subject: [PATCH] Allow opencode user to restart amc-radio, amc-bot, and kimaki
 without password

Add a NOPASSWD sudoers rule so the opencode service user can run
systemctl restart amc-radio amc-bot kimaki without prompting for
a password. This enables automated service restarts from the
OpenCode agent.
---
 machines/amc-peripheral/configuration.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/machines/amc-peripheral/configuration.nix b/machines/amc-peripheral/configuration.nix
index 24520ec..f23fe4b 100644
--- a/machines/amc-peripheral/configuration.nix
+++ b/machines/amc-peripheral/configuration.nix
@@ -1107,7 +1107,7 @@ in {
     '';
   };
 
-  # ── Sudoers: opencode can deploy via nixos-rebuild ─────────────────
+  # ── Sudoers: opencode can deploy via nixos-rebuild and restart services ──
   security.sudo.extraRules = [
     {
       users = ["opencode"];
@@ -1116,6 +1116,10 @@ in {
           command = "/run/current-system/sw/bin/nixos-rebuild switch *";
           options = ["NOPASSWD"];
         }
+        {
+          command = "/run/current-system/sw/bin/systemctl restart amc-radio amc-bot kimaki";
+          options = ["NOPASSWD"];
+        }
       ];
     }
   ];