# Permisos limitados para rastreador — SOLO gestionar su worker
# Usar el wrapper ~/.bin/svc

Cmnd_Alias WORKER_SVC = \
    /usr/bin/systemctl status worker.service, \
    /usr/bin/systemctl status worker.service *, \
    /usr/bin/systemctl start worker.service, \
    /usr/bin/systemctl stop worker.service, \
    /usr/bin/systemctl restart worker.service, \
    /usr/bin/systemctl reload worker.service, \
    /usr/bin/systemctl is-active worker.service, \
    /usr/bin/systemctl is-active worker.service *, \
    /usr/bin/systemctl cat worker.service, \
    /usr/bin/systemctl cat worker.service *, \
    /usr/bin/systemctl show worker.service, \
    /usr/bin/systemctl show worker.service *, \
    /usr/bin/journalctl -u worker.service, \
    /usr/bin/journalctl -u worker.service *

Defaults:rastreador !requiretty, env_keep += "SUDO_ASKPASS HOME PATH"
rastreador ALL=(root) NOPASSWD: WORKER_SVC