# NuQloud Agent Executor (Least Privilege)

Use this pattern when a remote agent needs a few privileged host actions without granting full root/docker access.

## Files

- `scripts/automation/nuqloud-op`: root-owned host wrapper command
- `scripts/automation/nuqloud-op.sudoers`: sudoers template

## Install on a target host

```bash
sudo cp scripts/automation/nuqloud-op /usr/local/sbin/nuqloud-op
sudo chown root:root /usr/local/sbin/nuqloud-op
sudo chmod 0750 /usr/local/sbin/nuqloud-op
sudo visudo -f /etc/sudoers.d/nuqloud-op
```

Paste/adapt:

```sudoers
Defaults!/usr/local/sbin/nuqloud-op !setenv, noexec
openclaw-agent ALL=(root) NOPASSWD: /usr/local/sbin/nuqloud-op *
```

Then secure the sudoers file:

```bash
sudo chown root:root /etc/sudoers.d/nuqloud-op
sudo chmod 0440 /etc/sudoers.d/nuqloud-op
```

## Supported actions

- `broker-health`
- `invite-create <createdBy> <hours> [comment...]`
- `provision-upsert <qortalAddress> <email>`

Example:

```bash
sudo /usr/local/sbin/nuqloud-op broker-health
sudo /usr/local/sbin/nuqloud-op invite-create ordersOps 24
sudo /usr/local/sbin/nuqloud-op invite-create ordersOps 24 "sent to jane@example.com"
sudo /usr/local/sbin/nuqloud-op provision-upsert QTESTADDRESS123 provision-test@example.com
```

## Security notes

- Do not add automation users to the `docker` group (root-equivalent).
- Keep `BROKER_INTERNAL_API_TOKEN` only in `.env.devprod` on the target host.
- Prefer short-lived API tokens for external systems and rotate regularly.