# /etc/doas.conf — minimal sudo replacement on OpenBSD

# user = primary admin, can do anything with password
permit persist user as root

# Common operational commands without password (for cron + scripts)
permit nopass user as root cmd /usr/sbin/rcctl
permit nopass user as root cmd /usr/local/sbin/acme-client
permit nopass user as root cmd /sbin/pfctl args -nf /etc/pf.conf
permit nopass user as root cmd /bin/sh args /usr/local/sbin/cert-renew-check.sh