merge: testing → main (reconcile 2-week divergence)

deploy/polkit/50-decnet-workers.rules.j2

@@ -0,0 +1,23 @@
+// Allow members of the '{{ group }}' group to manage DECNET systemd units
+// (start / stop / restart / reload) without a password prompt.
+//
+// Scope is locked to units matching `decnet-<name>.service` or the
+// `decnet.target` grouping unit. Any other unit is unaffected by this
+// rule and still goes through the default polkit policy.
+//
+// The group name is rendered at `decnet init` time from --group; the
+// default is `decnet`, but dev boxes that pass --group $USER get a
+// rule that matches the operator's own login group.
+//
+// Install: /etc/polkit-1/rules.d/50-decnet-workers.rules
+
+polkit.addRule(function(action, subject) {
+    if (action.id == "org.freedesktop.systemd1.manage-units") {
+        var unit = action.lookup("unit");
+        if (unit &&
+            /^decnet-[a-z]+\.service$|^decnet\.target$/.test(unit) &&
+            subject.isInGroup("{{ group }}")) {
+            return polkit.Result.YES;
+        }
+    }
+});