{
  "permissions": {
    "defaultMode": "auto",

    "additionalDirectories": [
      "/srv/apps",
      "/srv/data"
    ],

    "ask": [
      "Bash(rm -rf:*)",
      "Bash(sudo rm:*)",
      "Bash(sudo rm -rf:*)",

      "Bash(docker volume rm:*)",
      "Bash(docker volume prune:*)",
      "Bash(docker system prune:*)",
      "Bash(docker compose down -v:*)",

      "Bash(sudo ufw:*)",
      "Bash(sudo tee /etc/ssh:*)",
      "Bash(sudo systemctl restart ssh:*)",
      "Bash(sudo systemctl stop:*)",
      "Bash(sudo systemctl disable:*)",
      "Edit(/etc/ssh/**)",
      "Write(/etc/ssh/**)",
      "Edit(/etc/fail2ban/**)",
      "Edit(/etc/sudoers*)",
      "Write(/etc/sudoers*)",

      "Bash(sudo reboot:*)",
      "Bash(sudo shutdown:*)",
      "Bash(sudo poweroff:*)",

      "Bash(sudo adduser:*)",
      "Bash(sudo useradd:*)",
      "Bash(sudo deluser:*)",
      "Bash(sudo usermod:*)",
      "Bash(sudo passwd:*)",
      "Edit(**/authorized_keys)",
      "Write(**/authorized_keys)",

      "Bash(dropdb:*)",
      "Bash(psql:*)",
      "Bash(mysql:*)",
      "Bash(docker compose exec db:*)",

      "Bash(git push --force:*)",
      "Bash(git reset --hard:*)",
      "Bash(git clean:*)"
    ],

    "deny": [
      "Read(**/.env)",
      "Read(**/.env.*)",
      "Read(**/*.pem)",
      "Read(**/*.key)",
      "Read(**/id_rsa*)",
      "Read(**/id_ed25519*)",
      "Read(**/acme.json)"
    ]
  }
}